chore(ci): adopt mbx 0.5.4

[jdx]

Summary

• update the composite CI wrapper to install mbx 0.5.4
• pin the action revision that supports immutable release digests and Windows ARM64
• refresh mise.lock URLs, checksums, asset IDs, and GitHub attestation provenance
• preserve the existing trusted-server and fork-safe GitHub cache routing

mbx 0.5.4 includes the persistent compiler-shim fix needed by builds that retain HOST_CC paths across sessions.

Testing

• mise lock --bump --minimum-release-age 0 github:jdx/mr-boxington
• locked Linux install reports mbx 0.5.4
• git diff --check

AI-assisted — Tool: Codex; model: openai/gpt-5; version: unavailable.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Central YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Pro Plus

Run ID: da42977f-cbb5-4c6a-836a-44d31f0982af

📥 Commits

Reviewing files that changed from the base of the PR and between a4e0dcf and 3b220ec.

⛔ Files ignored due to path filters (1)

• mise.lock is excluded by !**/*.lock

📒 Files selected for processing (1)

• .github/actions/mbx/action.yml

Included review availability: Your plan provides up to 4 included reviews per hour; 3 remain after this review.

---

📝 Walkthrough

Walkthrough

The composite action updates both jdx/mr-boxington-action steps from version 0.5.3 to 0.5.4. Existing backend settings remain unchanged.

Changes

mr-boxington action update

Layer / File(s)	Summary
Update action references .github/actions/mbx/action.yml	Both action steps use version 0.5.4. The first keeps backend: github, and the second keeps its dynamic backend selection.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Merge Risk: ⚪ Minimal · up to 3b220

This PR updates the CI cache tooling version without changing application or authentication behavior. No actionable merge-blocking risk remains after normal checks and review.

Poem

A rabbit spots a version hop,
Both action steps get a crop.
The backend paths remain the same,
While 0.5.4 joins the game.
Clean and quiet, off they trot.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely identifies the main change: updating the CI tooling to mbx 0.5.4.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit a4e0dcf. Configure here.}

[github-actions]

Instruction counts

benchmark	trend	instructions	Δ	wall (min)	Δ
markdown	▁▄▇▄▅▅▇██▅▅▇▇▅▅█▅▇▅▅	337,146,503 → 337,063,316	-0.02%	28.93 → 29.25ms	+1.12%
startup	▁██████▇▇▇▇█████████	910,346 → 910,267	-0.01%	0.90 → 0.89ms	-0.45%

No instruction-count regression above 1%.

_{Only instruction counts gate. Wall clock is shown for context — on identical hardware it moves 4-20% run to run.}

_{Measured by tak — instruction-counted CLI benchmarks, stored in this repository's git notes.}

Shadow comparison

Parsing mise use -g node@20 against a shadow of mise's committed spec.
Reported, not gated: the shadow grows as the derive learns to express more, so
what to watch is the ratio rather than either column.

framework	stripped binary, bytes
usage	1321264
bpaf	2493280
clap	3101832

framework	instructions, cold parse	vs usage
usage	8345	—
clap	6315248	756x
bpaf	21909169	2625x

                                              min       p01       p10    median
usage-rs: argv -> struct                      409       415       420       427  ns
clap: build tree + parse -> struct         521288    522753    525734    532522  ns
bpaf: build parser + parse -> struct      1594742   1594742   1613812   1649250  ns

usage: argv -> struct                             484 ns      0.48 µs
clap: build tree + parse -> struct             531529 ns    531.53 µs
clap: parse -> struct, tree reused              24929 ns     24.93 µs
clap: build tree only                          330316 ns    330.32 µs

_{1b3171bb5c67 vs 99e9c6d45d02 · measured on the runner, not pushed to the history.}