fix: skip trust check for plain .tool-versions in task list

[dportalesr]

Summary

PR #8675 added trust gating for .tool-versions files containing Tera template syntax, but task_list.rs still calls is_trusted() on all config files when checking for untrusted configs. This causes plain .tool-versions files (just tool names and versions, no templates) to trigger trust errors like:

mise ERROR Config file(s) in ~/dev/myproject are not trusted: ~/dev/myproject/.tool-versions
Trust them with `mise trust`.

This skips the trust check for .tool-versions files that don't contain template syntax ({{, {%, {#), consistent with the parsing logic added in #8675.

Changes

• src/task/task_list.rs: Added is_plain_tool_versions() helper that checks if a path is a .tool-versions file without Tera template markers. The err_no_task trust check now skips these files since they can't define tasks or execute code.

Test plan

• Plain .tool-versions (e.g. ruby 3.3.3\nnodejs 14.21.3) no longer triggers trust error
• .tool-versions with template syntax (e.g. nodejs {{ exec("echo 20") }}) still requires trust
• .mise.toml trust behavior unchanged

[greptile-apps]

Greptile Summary

This PR fixes a false-positive trust error for plain .tool-versions files in err_no_task by reusing the existing is_tool_versions_file helper (promoted to pub(crate)). The fix is simpler than the PR description suggests — no content inspection is needed because .tool-versions files can never define tasks, so a filename-only skip is both sufficient and correct.

Confidence Score: 5/5

Safe to merge — the fix is minimal, logically correct, and consistent with how the rest of the codebase handles .tool-versions files.

All remaining findings are P2 or lower. The implementation correctly skips all .tool-versions files from the task-trust check since they can never contain task definitions. The E2E test covers the basic regression case.

e2e/tasks/test_tool_versions_trust — the test exercises mise task ls rather than mise run , which means it doesn't directly call err_no_task (the modified function). This is a minor coverage gap but does not block merge.

Important Files Changed

Filename	Overview
src/task/task_list.rs	Added is_tool_versions_file filter in err_no_task to correctly skip .tool-versions from the task-trust check; logic is sound since .tool-versions can never define tasks.
src/config/mod.rs	Visibility of is_tool_versions_file widened to pub(crate) to allow reuse in task_list.rs; minimal, safe change.
e2e/tasks/test_tool_versions_trust	New E2E test verifying mise task ls doesn't emit trust errors for plain .tool-versions; covers the happy path but does not directly exercise the modified err_no_task code path.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[mise run task-name] --> B[get_task_lists]
    B --> C{task found?}
    C -- yes --> D[Execute task]
    C -- no --> E[err_no_task]
    E --> F{tasks empty?}
    F -- no --> G[Return task-not-found error]
    F -- yes --> H[config_files_in_dir]
    H --> I{is_tool_versions_file?}
    I -- yes --> J[Skip — .tool-versions cannot define tasks]
    I -- no --> K{is_trusted?}
    K -- yes --> L[Skip trusted file]
    K -- no --> M[Collect as untrusted]
    M --> N{any untrusted?}
    N -- yes --> O[bail: Config files not trusted]
    N -- no --> P[Continue with other diagnostics]

Loading

_{Reviews (8): Last reviewed commit: "[autofix.ci] apply automated fixes" | Re-trigger Greptile}

[gemini-code-assist]

Code Review

This pull request updates the task resolution logic to ignore .tool-versions files when checking for untrusted configuration files, as these files are declarative and cannot define tasks. The reviewer suggests simplifying this logic by skipping all .tool-versions files based on the filename alone, rather than reading file contents to check for template syntax, and recommends reusing existing helper functions to avoid code duplication.

[jdx]

?

[dportalesr]

???

[jdx]

The extra file read to check for template syntax is wasteful. .tool-versions files can't define tasks regardless of content, so there's no need to read the file.

This comment was generated by Claude Code.

[greptile-apps]

PR Review: fix: skip trust check for .tool-versions in task list

Verdict: Approve (confidence 5/5) — Safe to merge.

Summary

Fixes a regression from #8675 where .tool-versions files incorrectly triggered a trust error in mise run. The fix filters out .tool-versions files (using the configurable MISE_DEFAULT_TOOL_VERSIONS_FILENAME) from the untrusted-config check in err_no_task, since these files cannot define tasks regardless of content. A new assert_fail_not_contains helper and an e2e test covering both plain and template-syntax .tool-versions files are included.

File Analysis

File	Confidence	Summary
src/task/task_list.rs	5/5	Adds filename filter to skip .tool-versions files (via MISE_DEFAULT_TOOL_VERSIONS_FILENAME) in the untrusted-config check inside err_no_task
e2e/tasks/test_tool_versions_trust	5/5	New e2e test verifying .tool-versions files never trigger trust errors in the task runner, for both plain and template-syntax variants
e2e/assert.sh	5/5	Adds assert_fail_not_contains helper, mirroring the existing assert_fail_contains pattern

Logic Flow

The err_no_task function now filters config files before checking trust:

• mise run nonexistent → task not found → task list empty?
• If yes → check cwd config files → filter out any file named MISE_DEFAULT_TOOL_VERSIONS_FILENAME (can't define tasks)
• Remaining files → is_trusted check → if untrusted → bail with 'not trusted' error

Key Observations

1. Implementation correctly uses MISE_DEFAULT_TOOL_VERSIONS_FILENAME (not a hardcoded ".tool-versions" string), which respects the env var override — consistent with how the rest of the codebase handles this configurable filename.

2. All .tool-versions files are skipped, not just plain ones. This is semantically correct: .tool-versions files cannot define tasks regardless of content, so they should never block the task runner with a trust error.

3. Test coverage is solid — e2e/tasks/test_tool_versions_trust covers both the plain and template cases using MISE_PARANOID=1 MISE_YES=0, which bypasses the CI trust shortcut and exercises the real trust logic.

4. No P0 or P1 issues found. The fix is minimal, correct, and well-tested.

Safety Assessment

Safe to merge — the fix is minimal, correct, and tested.

---

This comment was generated by Claude Code.

[jdx]

A couple suggestions:

1. The test uses ruby 3.3.3 in .tool-versions, but mise run nonexistent will try to install ruby before failing — that'll be very slow in CI. Other e2e tests use tiny 3.1.0 or dummy 1 as lightweight stand-ins.

2. Rather than asserting on a failing command (assert_fail_not_contains "mise run nonexistent" "not trusted"), it might be cleaner to use a command that loads config but doesn't require a task, like mise ls or mise task ls, and check its output doesn't contain "not trusted". That avoids the indirection of a deliberately-failing command.

Something like:

echo "tiny 3.1.0" >.tool-versions
assert_not_contains "MISE_YES=0 mise task ls" "not trusted"

This comment was generated by Claude Code.