Cache mise tool installations (.mise/installs/ and .mise/downloads/) to
avoid re-downloading and re-installing tools on every pipeline run. The
cache key is based on .tool-versions and .mise.toml files, so it
invalidates when tool versions change.

Adds caching to both setup-mise and asdf-tool-versions components,
following the same pattern as the Go module caching (internal/go/caching.yml
+ .go-mod-cache). Because asdf-tool-versions is now generated from Jsonnet,
the caching is wired in via src/ci/components/asdf-tool-versions.jsonnet.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

feat: add GitLab CI caching for mise tool installations

See merge request !1362

## [5.4.0](https://gitlab.com/[secure]/gl-infra/common-ci-tasks/-/compare/...) (2026-08-25)

### Features

* add GitLab CI caching for mise tool installations ([0055a7ec](https://gitlab.com/[secure]/gl-infra/common-ci-tasks/-/commit/0055a7ec01d35ac83d757b3c96f93cb88fa9c388))

chore(deps): update dependency gitlab-org/labkit to v2.36.0

See merge request !1812

chore(deps): update dependency jdx/mise to v2026.8.8

See merge request !1739

fix(release-platform): move merge-train activation into a dedicated sync job

See merge request !1811

## [5.4.1](https://gitlab.com/[secure]/gl-infra/common-ci-tasks/-/compare/...) (2026-08-26)

### Fixes

* **release-platform:** move merge-train activation into a dedicated sync job ([f329524f](https://gitlab.com/[secure]/gl-infra/common-ci-tasks/-/commit/f329524f01953142313d2230e4cf42032589409f))

### Dependencies

* **deps:** update dependency gitlab-org/labkit to v2.36.0 ([bdf56c56](https://gitlab.com/[secure]/gl-infra/common-ci-tasks/-/commit/bdf56c56b7a90e18a00f6e13f0f44f104cf233e1))
* **deps:** update dependency jdx/mise to v2026.8.8 ([1f491941](https://gitlab.com/[secure]/gl-infra/common-ci-tasks/-/commit/1f491941f06203c74d43cb9d3cd7e516d6896e2a))

semantic-release >= 25.0.8 broadened its hide-sensitive regex to also match
env var names containing key/auth/webhook. It replaces the value of every
matching var (>= 5 chars) with [secure] throughout its output, including the
generated release notes. Common *_KEY / *_AUTH_* variables holding low-entropy
values like "gitlab-com" or "shared" now get blanket-replaced, corrupting notes
and breaking URLs.

Unset secret-named env vars in the release and dry-run jobs before invoking
semantic-release, keeping only the token(s) it needs. Extra vars can be
preserved via SEMANTIC_RELEASE_KEEP_ENV.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Introduce a bats-core shell unit testing framework so shell extracted from
Jsonnet components via importstr can be tested directly. bats is pinned in
.tool-versions and a shell_unit_test CI job runs `bats --recursive src/ci`.

Cover scrub-env.sh: secret-named low-entropy vars (e.g. gitlab-com, shared)
and SEMANTIC_RELEASE_AUTH_SOURCE are dropped, required tokens are kept, matching
is case-insensitive, and SEMANTIC_RELEASE_KEEP_ENV preserves named vars.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Reference the semantic-release source the keyword list is copied from so it can
be kept in sync when upstream changes, addressing review feedback.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

fix(semantic-release): scrub secret-named env vars before running

See merge request !1813

## [5.4.2](https://gitlab.com/gitlab-com/gl-infra/common-ci-tasks/-/compare/...) (2026-08-27)

### Fixes

* **semantic-release:** scrub secret-named env vars before running ([8ed090db](8ed090db))

### Docs

* **semantic-release:** link upstream hide-sensitive matcher in scrub-env ([bb4c4721](bb4c4721))

### Tests

* **semantic-release:** add bats unit tests for scrub-env ([b7aad0c1](b7aad0c1))

The jsonnet_test job was pathologically slow on release-platform: the manitest
has 83 tests, almost all doing std.length(std.findSubstr(substring, yaml)).
Under jsonnet-tool's interpreter std.findSubstr is an O(n) *interpreted* scan
costing ~1.5s per call on these multi-KB strings, so the suite exceeded a
5-minute timeout locally.

Fix: express the substring assertions with std.strReplace, which is native and
~0ms. A single count(text, substring) helper returns the number of
non-overlapping occurrences and reproduces the old findSubstr counts exactly for
every substring used here (none self-overlap). The release-platform manitest
drops from >5min (timeout) to ~0.2s; all 84 tests still pass and the generated
release-platform.yml is untouched.

Work item #73 proposed splitting the body into a .libsonnet and asserting
against the object graph, on the theory that std.manifestYamlStream was the
bottleneck. Measured, manifestYamlStream is only ~9ms here; the real cost is
std.findSubstr, so this targets that directly without the split (which would
also have moved the renovate:managed version pins out of renovate.json's match
patterns).

perf(release-platform): replace std.findSubstr with native strReplace in tests

Closes #73

See merge request !1817

## [5.4.3](https://gitlab.com/gitlab-com/gl-infra/common-ci-tasks/-/compare/...) (2026-08-27)

### Performance Improvements

* **release-platform:** replace std.findSubstr with native strReplace in tests ([1efd755e](1efd755e)), closes [#73](https://gitlab.com/gitlab-com/gl-infra/common-ci-tasks/-/issues/)