[JamBalaya56562]

[bootstrap.secrets] was missing from the JSON schema, so a strict schema checker such as tombi rejected any config that used it, even though mise reads it:

[bootstrap.secrets]
github_token = "GITHUB_TOKEN"
"deploy.key" = { env = "DEPLOY_KEY", description = "Deploy key", allow_empty = true }

The schema now describes it the way src/system/secrets.rs reads it:

• The key is the secret name. It uses ASCII letters, digits, ., _ or -.
• The value is an environment variable name, either as a string or as a table with env, description and allow_empty.

The table form rejects unknown keys. mise silently ignores a misspelled option such as allow_emty = true, which leaves allow_empty at its default, so the schema is where that typo can be caught.

This takes over #12789 by @risu729, which pr-closer closed after 7 days of failing checks on the fork run. They are credited as co-author. CodeRabbit and Greptile both left the same open thread on #12789: add additionalProperties: false to the table form. This PR does that.

Validation

• e2e/config/test_schema_tombi:
  • The strict mise.toml fixture now declares both forms above.
  • Three new fixtures must each fail:
    • an unknown key: "allow_emty" is not allowed;
    • an invalid variable name 1BAD: does not match the pattern ^[A-Za-z_][A-Za-z0-9_]*$;
    • an invalid secret name bad name: does not match the pattern ^[A-Za-z0-9_.-]+$.
• Ran tombi 0.9.22: with main's schema the mise.toml fixture fails, and with this PR's it passes. The three invalid fixtures fail with the messages above.
• With mise 2026.10.5, mise bootstrap secrets status gave these results:
  • It lists both secrets above.
  • It accepts allow_emty without a word.
  • It rejects 1BAD (invalid environment variable name) and bad name (invalid bootstrap secret name). These are the same rules the schema now applies.

AI-assisted — Tool: Claude Code; model: anthropic/claude-opus-5-5; version: unavailable.

🤖 Generated with Claude Code

Summary by CodeRabbit

• New Features
  • Added schema support for configuring bootstrap secrets by environment-variable name or object. Secret objects can include a description and an allow_empty setting, which defaults to false.
• Bug Fixes
  • The schema now rejects invalid secret names, environment-variable names, and secret table keys. Added regression coverage for valid and invalid bootstrap-secret configurations.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Repository YAML (base), Central YAML (inherited), Organization UI (inherited)
• Review profile: CHILL
• Plan: Advanced
• Run ID: 46e3d96c-226f-4996-96fa-9ec25c7b0815

---

📥 Commits

Reviewing files that changed from the base of the PR and between f4c616d and 9c7e4ad.

---

📒 Files selected for processing (2)

• e2e/config/test_schema_tombi
• schema/mise.json

---

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 9 remain after this review.

---

---

📝 Walkthrough

Walkthrough

The bootstrap secret schema now defines accepted secret names and value forms. The tombi regression test covers valid declarations and rejects invalid table options, environment-variable names, and secret names.

Changes

Bootstrap secret schema

Layer / File(s)	Summary
Bootstrap secret schema and validation coverage schema/mise.json, e2e/config/test_schema_tombi	The schema defines secret-name and environment-variable patterns, accepted value forms, and optional object fields. The regression test adds valid examples and invalid lint cases.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Bug fix

Suggested reviewers: jdx

---

Merge Risk: ⚪ Minimal · up to 9c7e4

No actionable merge-blocking risk is identified; the change is ready for normal checks.

Pre-merge checks | 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly and concisely describes the main change: adding schema support for [bootstrap.secrets].
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

---

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

---

_{Comment @coderabbitai help to get the list of available commands.}

[greptile-apps]

Confidence Score: 5/5

[Medium impact] The PR appears safe to merge; no actionable issues were found.

Summary

Adds [bootstrap.secrets] to the configuration schema.

• Strict schema checkers accept valid bootstrap secrets and reject invalid names or options.

JamBalaya56562 explicitly described rejecting unknown table fields as intentional: mise ignores misspelled fields, so the schema should catch them.

No actionable issues found. Tests were not run during this review.

_{Reviews (1) · Last reviewed commit: "fix(schema): accept [bootstrap.secrets]" · Reviewed by Greptile}