@jdxcode
Account based inUnited States
About this account
- Account based in
- United States
- Connected via
- United States App Store
Account-level information from X, not a live location or the device used for a specific post.
I make open source dev tools at https://xitter.cf/t.co/lrm2L4SCse like mise, aube, fnox, hk, mbx, pitchfork. Previously I wrote the heroku cli and oclif. ex-amazon/meta.
Dallas, TX
Joined July 2006
- Tweets1.9K
- Following1.3K
- Followers7.2K
- Likes1.6K
This week’s eMudhra CA compromise is a reminder: if your release binaries are only protected by TLS (e.g.: `curl | sh`), anyone with a forged cert can swap them.
I am working to get the packslip cli into Linux distros for bootstrapping package managers. Spread the word, if this gets popular enough we'll all eventually be able to stop using `curl | sh` for anything.
mise also understands packslip and in addition to hardened supply chains, users can also get agent skills and completions tied to tool versions.
packslip.dev/
it's coming to more pages soon but you can play with it here: mise.jdx.dev/configuration/p…
I forgot to add: you should be able to use mise without a GitHub token now. There are some edge cases that still require it but it should be less than 1% of users I think.
If you’re still hitting unauthenticated gh rate limits let me know why—I can probably fix it.
perf in mise has improved significantly in 2026.10.11. the version listing (which is on the critical path for many commands) has been greatly optimized. With python, for example, it's gone down from 2.4s to 130ms in my benchmark.
github.com/jdx/mise/releases…
perf in mise has improved significantly in 2026.10.11. the version listing (which is on the critical path for many commands) has been greatly optimized. With python, for example, it's gone down from 2.4s to 130ms in my benchmark.
github.com/jdx/mise/releases…
jactionlint supports this!
github.blog/changelog/2026-1…
jactionlint 2.2 is out.
28 new rules (133 → 161), mostly for script injection, token permissions, pinning and runner limits.
• --changed-since: only report what a PR changed
• shell syntax errors, even without shellcheck
• flags jobs whose permissions are too narrow for their actions
• checks GitHub’s Actions lock file
• uvx jactionlint
Some new rules are on by default, so read the notes before upgrading.
github.com/jdx/jactionlint/r…
jdx retweeted
Made a mise extension for RayCast a few weeks ago and it just got approved.
Thanks to @jdxcode for making mise such a pleasure to work with.
raycast.com/lachieh/mise
jactionlint 2.0 is out.
actionlint, maintained, plus zizmor-style security audits in one binary.
Rules: actionlint 17, zizmor 41, jactionlint 130+ (not entirely comparable, but still)
• `--fix` that converges
• dependabot.yml and composite action.yml linting
• your `# zizmor: ignore` comments keep working
• baseline mode to adopt it gradually
github.com/jdx/jactionlint
i'm taking a trip to houston today. a few days ago i asked my tesla what the weather would be like and it suggested letting me know on the day.
it just emailed me with a forecast.
presumably this means i could be merging prs with a button on my steering wheel now.
i think this feature would be particularly useful for omarchy so the agents are more up-to-date, see my pr for this: github.com/omacom/omarchy/pu…
new in mise: tools that keep themselves up to date.
set auto_update on a global tool and mise upgrades it right before it runs. optionally run a daemon to do upgrades in the background.
mise.jdx.dev/dev-tools/#auto…
