From bdca8cd0b0e5bb1797d75da13c0ba05b7d0c3168 Mon Sep 17 00:00:00 2001
From: Gregor Zeitlinger <gregor.zeitlinger@grafana.com>
Date: Fri, 24 Jul 2026 12:57:08 +0000
Subject: [PATCH 01/10] ci: validate unreleased Flint Checkstyle support

Signed-off-by: Gregor Zeitlinger <gregor.zeitlinger@grafana.com>
---
 .github/renovate-tracked-deps.json |  3 +-
 checkstyle-suppressions.xml        |  8 ++++++
 mise.lock                          | 46 ++++++++++++++++++++++++++++++
 mise.toml                          |  3 +-
 4 files changed, 58 insertions(+), 2 deletions(-)

diff --git a/.github/renovate-tracked-deps.json b/.github/renovate-tracked-deps.json
index 513b437c6..d138ca7b9 100644
--- a/.github/renovate-tracked-deps.json
+++ b/.github/renovate-tracked-deps.json
@@ -157,13 +157,14 @@
     "mise.toml": {
       "mise": [
         "actionlint",
-        "aqua:grafana/flint",
         "aqua:grafana/gcx",
         "aqua:grafana/oats",
         "aqua:jonwiggins/xmloxide",
         "aqua:owenlamont/ryl",
         "biome",
+        "cargo:https://github.com/grafana/flint",
         "editorconfig-checker",
+        "github:checkstyle/checkstyle",
         "google-java-format",
         "hugo",
         "java",
diff --git a/checkstyle-suppressions.xml b/checkstyle-suppressions.xml
index 82e964658..976903e13 100644
--- a/checkstyle-suppressions.xml
+++ b/checkstyle-suppressions.xml
@@ -21,4 +21,12 @@
 
   <!-- Suppress all Javadoc checks for integration tests -->
   <suppress checks="Javadoc" files=".*[/\\]integration-tests[/\\].*"/>
+
+  <!-- The Maven Checkstyle plugin checks main sources only. Flint invokes the standalone CLI
+       with explicit Java files, so preserve the existing policy for test and archived sources. -->
+  <suppress checks=".*" files=".*[/\\]src[/\\]test[/\\]java[/\\].*"/>
+  <suppress checks=".*" files=".*[/\\]src[/\\]archive[/\\]java[/\\].*"/>
+
+  <!-- Example setup intentionally groups declarations before the simulated work that uses them. -->
+  <suppress checks="VariableDeclarationUsageDistance" files=".*[/\\]examples[/\\].*"/>
 </suppressions>
diff --git a/mise.lock b/mise.lock
index 179dfef1d..c8c5d94d0 100644
--- a/mise.lock
+++ b/mise.lock
@@ -296,6 +296,10 @@ url = "https://github.com/biomejs/biome/releases/download/%40biomejs/biome%402.5
 url_api = "https://api.github.com/repos/biomejs/biome/releases/assets/470058831"
 provenance = "github-attestations"
 
+[[tools."cargo:https://github.com/grafana/flint"]]
+version = "rev:3619bdc"
+backend = "cargo:https://github.com/grafana/flint"
+
 [[tools.editorconfig-checker]]
 version = "3.8.0"
 backend = "aqua:editorconfig-checker/editorconfig-checker"
@@ -335,6 +339,48 @@ checksum = "sha256:7ec31e1a6a9983aa2a4942cb66dfd35e8b61e76263460413988438ae14269
 url = "https://github.com/editorconfig-checker/editorconfig-checker/releases/download/v3.8.0/ec-windows-amd64.zip"
 url_api = "https://api.github.com/repos/editorconfig-checker/editorconfig-checker/releases/assets/460248513"
 
+[[tools."github:checkstyle/checkstyle"]]
+version = "checkstyle-13.8.0"
+backend = "github:checkstyle/checkstyle"
+
+[tools."github:checkstyle/checkstyle".options]
+matching = "all.jar"
+
+[tools."github:checkstyle/checkstyle"."platforms.linux-arm64"]
+checksum = "sha256:cb0b1083eb5d3f9f0b7f0edd9a86d8dbe406bf44da73c3df869abace8cb8502c"
+url = "https://github.com/checkstyle/checkstyle/releases/download/checkstyle-13.8.0/checkstyle-13.8.0-all.jar"
+url_api = "https://api.github.com/repos/checkstyle/checkstyle/releases/assets/474019260"
+
+[tools."github:checkstyle/checkstyle"."platforms.linux-arm64-musl"]
+checksum = "sha256:cb0b1083eb5d3f9f0b7f0edd9a86d8dbe406bf44da73c3df869abace8cb8502c"
+url = "https://github.com/checkstyle/checkstyle/releases/download/checkstyle-13.8.0/checkstyle-13.8.0-all.jar"
+url_api = "https://api.github.com/repos/checkstyle/checkstyle/releases/assets/474019260"
+
+[tools."github:checkstyle/checkstyle"."platforms.linux-x64"]
+checksum = "sha256:cb0b1083eb5d3f9f0b7f0edd9a86d8dbe406bf44da73c3df869abace8cb8502c"
+url = "https://github.com/checkstyle/checkstyle/releases/download/checkstyle-13.8.0/checkstyle-13.8.0-all.jar"
+url_api = "https://api.github.com/repos/checkstyle/checkstyle/releases/assets/474019260"
+
+[tools."github:checkstyle/checkstyle"."platforms.linux-x64-musl"]
+checksum = "sha256:cb0b1083eb5d3f9f0b7f0edd9a86d8dbe406bf44da73c3df869abace8cb8502c"
+url = "https://github.com/checkstyle/checkstyle/releases/download/checkstyle-13.8.0/checkstyle-13.8.0-all.jar"
+url_api = "https://api.github.com/repos/checkstyle/checkstyle/releases/assets/474019260"
+
+[tools."github:checkstyle/checkstyle"."platforms.macos-arm64"]
+checksum = "sha256:cb0b1083eb5d3f9f0b7f0edd9a86d8dbe406bf44da73c3df869abace8cb8502c"
+url = "https://github.com/checkstyle/checkstyle/releases/download/checkstyle-13.8.0/checkstyle-13.8.0-all.jar"
+url_api = "https://api.github.com/repos/checkstyle/checkstyle/releases/assets/474019260"
+
+[tools."github:checkstyle/checkstyle"."platforms.macos-x64"]
+checksum = "sha256:cb0b1083eb5d3f9f0b7f0edd9a86d8dbe406bf44da73c3df869abace8cb8502c"
+url = "https://github.com/checkstyle/checkstyle/releases/download/checkstyle-13.8.0/checkstyle-13.8.0-all.jar"
+url_api = "https://api.github.com/repos/checkstyle/checkstyle/releases/assets/474019260"
+
+[tools."github:checkstyle/checkstyle"."platforms.windows-x64"]
+checksum = "sha256:cb0b1083eb5d3f9f0b7f0edd9a86d8dbe406bf44da73c3df869abace8cb8502c"
+url = "https://github.com/checkstyle/checkstyle/releases/download/checkstyle-13.8.0/checkstyle-13.8.0-all.jar"
+url_api = "https://api.github.com/repos/checkstyle/checkstyle/releases/assets/474019260"
+
 [[tools.google-java-format]]
 version = "1.35.0"
 backend = "aqua:google/google-java-format"
diff --git a/mise.toml b/mise.toml
index 94c3beb17..f2c02e4b2 100644
--- a/mise.toml
+++ b/mise.toml
@@ -8,11 +8,12 @@ protoc = "35.1"
 
 # Linters
 actionlint = "1.7.12"
-"aqua:grafana/flint" = "0.22.9"
 "aqua:jonwiggins/xmloxide" = "v0.4.3"
 "aqua:owenlamont/ryl" = "0.21.0"
 biome = "2.5.3"
+"cargo:https://github.com/grafana/flint" = "rev:3619bdc"
 editorconfig-checker = "3.8.0"
+"github:checkstyle/checkstyle[matching=all.jar,rename_exe=checkstyle]" = "checkstyle-13.8.0"
 google-java-format = "1.35.0"
 lychee = "0.24.2"
 "npm:renovate" = "43.257.4"

From 6279b77214b312530e6d4ec6d43375ae14d08d2d Mon Sep 17 00:00:00 2001
From: Gregor Zeitlinger <gregor.zeitlinger@grafana.com>
Date: Fri, 24 Jul 2026 13:38:06 +0000
Subject: [PATCH 02/10] ci: replace Maven Checkstyle with Flint Signed-off-by:
 Gregor Zeitlinger <gregor.zeitlinger@grafana.com>

---
 .github/renovate-tracked-deps.json      |  2 +-
 AGENTS.md                               |  8 +--
 CONTRIBUTING.md                         |  4 +-
 checkstyle-suppressions.xml             |  4 +-
 mise.lock                               | 83 ++++++++++++-------------
 mise.toml                               | 11 ++--
 pom.xml                                 | 23 -------
 prometheus-metrics-otel-support/pom.xml |  1 -
 prometheus-metrics-parent/pom.xml       |  1 -
 9 files changed, 53 insertions(+), 84 deletions(-)

diff --git a/.github/renovate-tracked-deps.json b/.github/renovate-tracked-deps.json
index d138ca7b9..18ab66cb3 100644
--- a/.github/renovate-tracked-deps.json
+++ b/.github/renovate-tracked-deps.json
@@ -157,6 +157,7 @@
     "mise.toml": {
       "mise": [
         "actionlint",
+        "aqua:checkstyle/checkstyle",
         "aqua:grafana/gcx",
         "aqua:grafana/oats",
         "aqua:jonwiggins/xmloxide",
@@ -164,7 +165,6 @@
         "biome",
         "cargo:https://github.com/grafana/flint",
         "editorconfig-checker",
-        "github:checkstyle/checkstyle",
         "google-java-format",
         "hugo",
         "java",
diff --git a/AGENTS.md b/AGENTS.md
index 24481b8e5..e776815c1 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -15,7 +15,7 @@ mise run ci
 # Quick compile without tests or checks (fastest)
 mise run compile
 
-# Run unit tests only (skips formatting/coverage/checkstyle)
+# Run unit tests only (skips formatting and coverage)
 mise run test
 
 # Run all tests including integration tests
@@ -23,15 +23,15 @@ mise run test-all
 
 # Run a single test class
 ./mvnw test -Dtest=CounterTest \
-  -Dcoverage.skip=true -Dcheckstyle.skip=true
+  -Dcoverage.skip=true
 
 # Run a single test method
 ./mvnw test -Dtest=CounterTest#testIncrement \
-  -Dcoverage.skip=true -Dcheckstyle.skip=true
+  -Dcoverage.skip=true
 
 # Run tests in a specific module
 ./mvnw test -pl prometheus-metrics-core \
-  -Dcoverage.skip=true -Dcheckstyle.skip=true
+  -Dcoverage.skip=true
 
 # Regenerate protobuf classes (after protobuf dep update)
 mise run generate
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 519b98fea..a3ea0ef3a 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -89,14 +89,12 @@ mise --cd .mise/envs/native run native-test
 ### Avoid failures while running tests
 
 - Use `-Dcoverage.skip=true` to skip the coverage check during development.
-- Use `-Dcheckstyle.skip=true` to skip the checkstyle check during development.
 - Use `-Dwarnings=-nowarn` to skip the warnings during development.
 
 Combine all with
 
 ```shell
-./mvnw install -DskipTests -Dcoverage.skip=true \
-  -Dcheckstyle.skip=true -Dwarnings=-nowarn
+./mvnw install -DskipTests -Dcoverage.skip=true -Dwarnings=-nowarn
 ```
 
 or simply
diff --git a/checkstyle-suppressions.xml b/checkstyle-suppressions.xml
index 976903e13..b1b9d6cfe 100644
--- a/checkstyle-suppressions.xml
+++ b/checkstyle-suppressions.xml
@@ -22,8 +22,8 @@
   <!-- Suppress all Javadoc checks for integration tests -->
   <suppress checks="Javadoc" files=".*[/\\]integration-tests[/\\].*"/>
 
-  <!-- The Maven Checkstyle plugin checks main sources only. Flint invokes the standalone CLI
-       with explicit Java files, so preserve the existing policy for test and archived sources. -->
+  <!-- Preserve the repository's main-source-only Checkstyle policy when Flint invokes the
+       standalone CLI with explicit Java files. -->
   <suppress checks=".*" files=".*[/\\]src[/\\]test[/\\]java[/\\].*"/>
   <suppress checks=".*" files=".*[/\\]src[/\\]archive[/\\]java[/\\].*"/>
 
diff --git a/mise.lock b/mise.lock
index c8c5d94d0..89137bfb3 100644
--- a/mise.lock
+++ b/mise.lock
@@ -46,6 +46,45 @@ url = "https://github.com/rhysd/actionlint/releases/download/v1.7.12/actionlint_
 url_api = "https://api.github.com/repos/rhysd/actionlint/releases/assets/384924919"
 provenance = "github-attestations"
 
+[[tools."aqua:checkstyle/checkstyle"]]
+version = "checkstyle-13.8.0"
+backend = "aqua:checkstyle/checkstyle"
+
+[tools."aqua:checkstyle/checkstyle"."platforms.linux-arm64"]
+checksum = "sha256:cb0b1083eb5d3f9f0b7f0edd9a86d8dbe406bf44da73c3df869abace8cb8502c"
+url = "https://github.com/checkstyle/checkstyle/releases/download/checkstyle-13.8.0/checkstyle-13.8.0-all.jar"
+url_api = "https://api.github.com/repos/checkstyle/checkstyle/releases/assets/474019260"
+
+[tools."aqua:checkstyle/checkstyle"."platforms.linux-arm64-musl"]
+checksum = "sha256:cb0b1083eb5d3f9f0b7f0edd9a86d8dbe406bf44da73c3df869abace8cb8502c"
+url = "https://github.com/checkstyle/checkstyle/releases/download/checkstyle-13.8.0/checkstyle-13.8.0-all.jar"
+url_api = "https://api.github.com/repos/checkstyle/checkstyle/releases/assets/474019260"
+
+[tools."aqua:checkstyle/checkstyle"."platforms.linux-x64"]
+checksum = "sha256:cb0b1083eb5d3f9f0b7f0edd9a86d8dbe406bf44da73c3df869abace8cb8502c"
+url = "https://github.com/checkstyle/checkstyle/releases/download/checkstyle-13.8.0/checkstyle-13.8.0-all.jar"
+url_api = "https://api.github.com/repos/checkstyle/checkstyle/releases/assets/474019260"
+
+[tools."aqua:checkstyle/checkstyle"."platforms.linux-x64-musl"]
+checksum = "sha256:cb0b1083eb5d3f9f0b7f0edd9a86d8dbe406bf44da73c3df869abace8cb8502c"
+url = "https://github.com/checkstyle/checkstyle/releases/download/checkstyle-13.8.0/checkstyle-13.8.0-all.jar"
+url_api = "https://api.github.com/repos/checkstyle/checkstyle/releases/assets/474019260"
+
+[tools."aqua:checkstyle/checkstyle"."platforms.macos-arm64"]
+checksum = "sha256:cb0b1083eb5d3f9f0b7f0edd9a86d8dbe406bf44da73c3df869abace8cb8502c"
+url = "https://github.com/checkstyle/checkstyle/releases/download/checkstyle-13.8.0/checkstyle-13.8.0-all.jar"
+url_api = "https://api.github.com/repos/checkstyle/checkstyle/releases/assets/474019260"
+
+[tools."aqua:checkstyle/checkstyle"."platforms.macos-x64"]
+checksum = "sha256:cb0b1083eb5d3f9f0b7f0edd9a86d8dbe406bf44da73c3df869abace8cb8502c"
+url = "https://github.com/checkstyle/checkstyle/releases/download/checkstyle-13.8.0/checkstyle-13.8.0-all.jar"
+url_api = "https://api.github.com/repos/checkstyle/checkstyle/releases/assets/474019260"
+
+[tools."aqua:checkstyle/checkstyle"."platforms.windows-x64"]
+checksum = "sha256:cb0b1083eb5d3f9f0b7f0edd9a86d8dbe406bf44da73c3df869abace8cb8502c"
+url = "https://github.com/checkstyle/checkstyle/releases/download/checkstyle-13.8.0/checkstyle-13.8.0-all.jar"
+url_api = "https://api.github.com/repos/checkstyle/checkstyle/releases/assets/474019260"
+
 [[tools."aqua:grafana/flint"]]
 version = "0.22.9"
 backend = "aqua:grafana/flint"
@@ -297,7 +336,7 @@ url_api = "https://api.github.com/repos/biomejs/biome/releases/assets/470058831"
 provenance = "github-attestations"
 
 [[tools."cargo:https://github.com/grafana/flint"]]
-version = "rev:3619bdc"
+version = "rev:3f8aa74"
 backend = "cargo:https://github.com/grafana/flint"
 
 [[tools.editorconfig-checker]]
@@ -339,48 +378,6 @@ checksum = "sha256:7ec31e1a6a9983aa2a4942cb66dfd35e8b61e76263460413988438ae14269
 url = "https://github.com/editorconfig-checker/editorconfig-checker/releases/download/v3.8.0/ec-windows-amd64.zip"
 url_api = "https://api.github.com/repos/editorconfig-checker/editorconfig-checker/releases/assets/460248513"
 
-[[tools."github:checkstyle/checkstyle"]]
-version = "checkstyle-13.8.0"
-backend = "github:checkstyle/checkstyle"
-
-[tools."github:checkstyle/checkstyle".options]
-matching = "all.jar"
-
-[tools."github:checkstyle/checkstyle"."platforms.linux-arm64"]
-checksum = "sha256:cb0b1083eb5d3f9f0b7f0edd9a86d8dbe406bf44da73c3df869abace8cb8502c"
-url = "https://github.com/checkstyle/checkstyle/releases/download/checkstyle-13.8.0/checkstyle-13.8.0-all.jar"
-url_api = "https://api.github.com/repos/checkstyle/checkstyle/releases/assets/474019260"
-
-[tools."github:checkstyle/checkstyle"."platforms.linux-arm64-musl"]
-checksum = "sha256:cb0b1083eb5d3f9f0b7f0edd9a86d8dbe406bf44da73c3df869abace8cb8502c"
-url = "https://github.com/checkstyle/checkstyle/releases/download/checkstyle-13.8.0/checkstyle-13.8.0-all.jar"
-url_api = "https://api.github.com/repos/checkstyle/checkstyle/releases/assets/474019260"
-
-[tools."github:checkstyle/checkstyle"."platforms.linux-x64"]
-checksum = "sha256:cb0b1083eb5d3f9f0b7f0edd9a86d8dbe406bf44da73c3df869abace8cb8502c"
-url = "https://github.com/checkstyle/checkstyle/releases/download/checkstyle-13.8.0/checkstyle-13.8.0-all.jar"
-url_api = "https://api.github.com/repos/checkstyle/checkstyle/releases/assets/474019260"
-
-[tools."github:checkstyle/checkstyle"."platforms.linux-x64-musl"]
-checksum = "sha256:cb0b1083eb5d3f9f0b7f0edd9a86d8dbe406bf44da73c3df869abace8cb8502c"
-url = "https://github.com/checkstyle/checkstyle/releases/download/checkstyle-13.8.0/checkstyle-13.8.0-all.jar"
-url_api = "https://api.github.com/repos/checkstyle/checkstyle/releases/assets/474019260"
-
-[tools."github:checkstyle/checkstyle"."platforms.macos-arm64"]
-checksum = "sha256:cb0b1083eb5d3f9f0b7f0edd9a86d8dbe406bf44da73c3df869abace8cb8502c"
-url = "https://github.com/checkstyle/checkstyle/releases/download/checkstyle-13.8.0/checkstyle-13.8.0-all.jar"
-url_api = "https://api.github.com/repos/checkstyle/checkstyle/releases/assets/474019260"
-
-[tools."github:checkstyle/checkstyle"."platforms.macos-x64"]
-checksum = "sha256:cb0b1083eb5d3f9f0b7f0edd9a86d8dbe406bf44da73c3df869abace8cb8502c"
-url = "https://github.com/checkstyle/checkstyle/releases/download/checkstyle-13.8.0/checkstyle-13.8.0-all.jar"
-url_api = "https://api.github.com/repos/checkstyle/checkstyle/releases/assets/474019260"
-
-[tools."github:checkstyle/checkstyle"."platforms.windows-x64"]
-checksum = "sha256:cb0b1083eb5d3f9f0b7f0edd9a86d8dbe406bf44da73c3df869abace8cb8502c"
-url = "https://github.com/checkstyle/checkstyle/releases/download/checkstyle-13.8.0/checkstyle-13.8.0-all.jar"
-url_api = "https://api.github.com/repos/checkstyle/checkstyle/releases/assets/474019260"
-
 [[tools.google-java-format]]
 version = "1.35.0"
 backend = "aqua:google/google-java-format"
diff --git a/mise.toml b/mise.toml
index f2c02e4b2..7a7bced85 100644
--- a/mise.toml
+++ b/mise.toml
@@ -8,12 +8,12 @@ protoc = "35.1"
 
 # Linters
 actionlint = "1.7.12"
+"aqua:checkstyle/checkstyle" = "checkstyle-13.8.0"
 "aqua:jonwiggins/xmloxide" = "v0.4.3"
 "aqua:owenlamont/ryl" = "0.21.0"
 biome = "2.5.3"
-"cargo:https://github.com/grafana/flint" = "rev:3619bdc"
+"cargo:https://github.com/grafana/flint" = "rev:3f8aa74"
 editorconfig-checker = "3.8.0"
-"github:checkstyle/checkstyle[matching=all.jar,rename_exe=checkstyle]" = "checkstyle-13.8.0"
 google-java-format = "1.35.0"
 lychee = "0.24.2"
 "npm:renovate" = "43.257.4"
@@ -47,16 +47,16 @@ run = "./mvnw clean"
 
 [tasks.compile]
 description = "bare compile, ignoring formatting and linters"
-run = "./mvnw install -DskipTests -Dcoverage.skip=true -Dcheckstyle.skip=true -Dwarnings=-nowarn"
+run = "./mvnw install -DskipTests -Dcoverage.skip=true -Dwarnings=-nowarn"
 
 [tasks.generate]
 description = "regenerate protobuf sources"
-run = "./mvnw clean install -DskipTests -Dcoverage.skip=true -Dcheckstyle.skip=true -Dwarnings=-nowarn"
+run = "./mvnw clean install -DskipTests -Dcoverage.skip=true -Dwarnings=-nowarn"
 env.PROTO_GENERATION = "true"
 
 [tasks.test]
 description = "run unit tests, ignoring formatting and linters"
-run = "./mvnw test -Dcoverage.skip=true -Dcheckstyle.skip=true -Dwarnings=-nowarn"
+run = "./mvnw test -Dcoverage.skip=true -Dwarnings=-nowarn"
 
 [tasks.test-all]
 description = "run all tests"
@@ -77,7 +77,6 @@ BASELINE_OVERRIDE="${API_DIFF_BASELINE_VERSION:+-Dapi.diff.baseline.version=${AP
   ${BASELINE_OVERRIDE} \
   -DskipTests \
   -Dcoverage.skip=true \
-  -Dcheckstyle.skip=true \
   -Dwarnings=-nowarn
 ./.github/scripts/sync-api-diffs.sh
 """
diff --git a/pom.xml b/pom.xml
index d03c6cd6c..e0cfda23d 100644
--- a/pom.xml
+++ b/pom.xml
@@ -32,7 +32,6 @@
     <!-- Bumped by .github/workflows/bump-api-diff-baseline.yml after each release. -->
     <api.diff.baseline.version>1.8.0</api.diff.baseline.version>
     <jacoco.line-coverage>0.70</jacoco.line-coverage>
-    <checkstyle.skip>false</checkstyle.skip>
     <coverage.skip>false</coverage.skip>
     <javadoc.skip>false</javadoc.skip>
     <warnings>-Werror</warnings>
@@ -182,28 +181,6 @@
       </plugins>
     </pluginManagement>
     <plugins>
-      <plugin>
-        <groupId>org.apache.maven.plugins</groupId>
-        <artifactId>maven-checkstyle-plugin</artifactId>
-        <version>3.6.0</version>
-        <configuration>
-          <consoleOutput>true</consoleOutput>
-          <configLocation>google_checks.xml</configLocation>
-          <configLocation>checkstyle.xml</configLocation>
-          <violationSeverity>warning</violationSeverity>
-          <failOnViolation>true</failOnViolation>
-          <skip>${checkstyle.skip}</skip>
-          <suppressionsLocation>checkstyle-suppressions.xml</suppressionsLocation>
-          <excludes>**/generated/**,**/jmh_generated/*</excludes>
-        </configuration>
-        <executions>
-          <execution>
-            <goals>
-              <goal>check</goal>
-            </goals>
-          </execution>
-        </executions>
-      </plugin>
       <plugin>
         <groupId>org.jacoco</groupId>
         <artifactId>jacoco-maven-plugin</artifactId>
diff --git a/prometheus-metrics-otel-support/pom.xml b/prometheus-metrics-otel-support/pom.xml
index a4d179114..0365c4695 100644
--- a/prometheus-metrics-otel-support/pom.xml
+++ b/prometheus-metrics-otel-support/pom.xml
@@ -19,7 +19,6 @@
   </description>
 
   <properties>
-    <checkstyle.skip>true</checkstyle.skip>
     <coverage.skip>true</coverage.skip>
     <javadoc.skip>true</javadoc.skip>
   </properties>
diff --git a/prometheus-metrics-parent/pom.xml b/prometheus-metrics-parent/pom.xml
index d84511964..94467188d 100644
--- a/prometheus-metrics-parent/pom.xml
+++ b/prometheus-metrics-parent/pom.xml
@@ -14,7 +14,6 @@
   </description>
 
   <properties>
-    <checkstyle.skip>true</checkstyle.skip>
     <coverage.skip>true</coverage.skip>
     <javadoc.skip>true</javadoc.skip>
   </properties>

From 979dd934fc52997db10b8a444b623fe344354233 Mon Sep 17 00:00:00 2001
From: Gregor Zeitlinger <gregor.zeitlinger@grafana.com>
Date: Fri, 24 Jul 2026 14:17:45 +0000
Subject: [PATCH 03/10] ci: refresh unreleased Flint Checkstyle pin
 Signed-off-by: Gregor Zeitlinger <gregor.zeitlinger@grafana.com>

---
 mise.lock | 2 +-
 mise.toml | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/mise.lock b/mise.lock
index 89137bfb3..d4b24e791 100644
--- a/mise.lock
+++ b/mise.lock
@@ -336,7 +336,7 @@ url_api = "https://api.github.com/repos/biomejs/biome/releases/assets/470058831"
 provenance = "github-attestations"
 
 [[tools."cargo:https://github.com/grafana/flint"]]
-version = "rev:3f8aa74"
+version = "rev:67309cf"
 backend = "cargo:https://github.com/grafana/flint"
 
 [[tools.editorconfig-checker]]
diff --git a/mise.toml b/mise.toml
index 7a7bced85..4f81a9ff0 100644
--- a/mise.toml
+++ b/mise.toml
@@ -12,7 +12,7 @@ actionlint = "1.7.12"
 "aqua:jonwiggins/xmloxide" = "v0.4.3"
 "aqua:owenlamont/ryl" = "0.21.0"
 biome = "2.5.3"
-"cargo:https://github.com/grafana/flint" = "rev:3f8aa74"
+"cargo:https://github.com/grafana/flint" = "rev:67309cf"
 editorconfig-checker = "3.8.0"
 google-java-format = "1.35.0"
 lychee = "0.24.2"

From c949ba4470ba2e8a75385de779dd1a53d698864e Mon Sep 17 00:00:00 2001
From: Gregor Zeitlinger <gregor.zeitlinger@grafana.com>
Date: Tue, 28 Jul 2026 10:25:06 +0000
Subject: [PATCH 04/10] ci: use released Flint Checkstyle support

Signed-off-by: Gregor Zeitlinger <gregor.zeitlinger@grafana.com>
---
 .github/renovate-tracked-deps.json |  2 +-
 mise.lock                          | 42 ++++++++++++++++--------------
 mise.toml                          |  4 +--
 3 files changed, 25 insertions(+), 23 deletions(-)

diff --git a/.github/renovate-tracked-deps.json b/.github/renovate-tracked-deps.json
index 18ab66cb3..8a7736645 100644
--- a/.github/renovate-tracked-deps.json
+++ b/.github/renovate-tracked-deps.json
@@ -163,7 +163,7 @@
         "aqua:jonwiggins/xmloxide",
         "aqua:owenlamont/ryl",
         "biome",
-        "cargo:https://github.com/grafana/flint",
+        "aqua:grafana/flint",
         "editorconfig-checker",
         "google-java-format",
         "hugo",
diff --git a/mise.lock b/mise.lock
index d4b24e791..7513a1598 100644
--- a/mise.lock
+++ b/mise.lock
@@ -86,43 +86,49 @@ url = "https://github.com/checkstyle/checkstyle/releases/download/checkstyle-13.
 url_api = "https://api.github.com/repos/checkstyle/checkstyle/releases/assets/474019260"
 
 [[tools."aqua:grafana/flint"]]
-version = "0.22.9"
+version = "0.22.10"
 backend = "aqua:grafana/flint"
 
 [tools."aqua:grafana/flint"."platforms.linux-arm64"]
-checksum = "sha256:aae323ea911f9a5012879b79fd3b913837d301098173684d5f9672b6d15c1193"
-url = "https://github.com/grafana/flint/releases/download/v0.22.9/flint-aarch64-unknown-linux-gnu.tar.gz"
-url_api = "https://api.github.com/repos/grafana/flint/releases/assets/476876537"
+checksum = "sha256:6dec82cb6486b7e645e0b1674493497191d92a8e28c5c79194e5553882d213de"
+url = "https://github.com/grafana/flint/releases/download/v0.22.10/flint-aarch64-unknown-linux-gnu.tar.gz"
+url_api = "https://api.github.com/repos/grafana/flint/releases/assets/491750275"
 provenance = "github-attestations"
 
 [tools."aqua:grafana/flint"."platforms.linux-arm64-musl"]
+checksum = "sha256:373060c08a4cdd905d6e8e83f62ef43da8778d9133cb66b7801f392587812e8f"
+url = "https://github.com/grafana/flint/releases/download/v0.22.10/flint-aarch64-unknown-linux-musl.tar.gz"
+url_api = "https://api.github.com/repos/grafana/flint/releases/assets/491750193"
 provenance = "github-attestations"
 
 [tools."aqua:grafana/flint"."platforms.linux-x64"]
-checksum = "sha256:e7b0597d82568e441dab13091f674f15c36914b0f412c8fcc19d3ed880da320a"
-url = "https://github.com/grafana/flint/releases/download/v0.22.9/flint-x86_64-unknown-linux-gnu.tar.gz"
-url_api = "https://api.github.com/repos/grafana/flint/releases/assets/476875905"
+checksum = "sha256:a9f7f3768ec02cdd082c12cea0e815fc142d3ee721f4d8485f4ba9fc2c7d0521"
+url = "https://github.com/grafana/flint/releases/download/v0.22.10/flint-x86_64-unknown-linux-gnu.tar.gz"
+url_api = "https://api.github.com/repos/grafana/flint/releases/assets/491749844"
 provenance = "github-attestations"
 
 [tools."aqua:grafana/flint"."platforms.linux-x64-musl"]
+checksum = "sha256:3b174b31f10b1ded2cf0a54e8b62e5526713a49816c1fd74b00073519044f7bb"
+url = "https://github.com/grafana/flint/releases/download/v0.22.10/flint-x86_64-unknown-linux-musl.tar.gz"
+url_api = "https://api.github.com/repos/grafana/flint/releases/assets/491750257"
 provenance = "github-attestations"
 
 [tools."aqua:grafana/flint"."platforms.macos-arm64"]
-checksum = "sha256:0370a9f0f16b262cb2c683cc2da539d39e131a3167ac44d3471b57135508b3b2"
-url = "https://github.com/grafana/flint/releases/download/v0.22.9/flint-aarch64-apple-darwin.tar.gz"
-url_api = "https://api.github.com/repos/grafana/flint/releases/assets/476875995"
+checksum = "sha256:f9aa1a95aa5953f7f5a64c0d72f86e634c4930e9cb73422a95e342c6cb9be5d5"
+url = "https://github.com/grafana/flint/releases/download/v0.22.10/flint-aarch64-apple-darwin.tar.gz"
+url_api = "https://api.github.com/repos/grafana/flint/releases/assets/491750245"
 provenance = "github-attestations"
 
 [tools."aqua:grafana/flint"."platforms.macos-x64"]
-checksum = "sha256:b14167a1e47ac34439518680ff5df16554056c5099bafd650f01a37cf29b4a3a"
-url = "https://github.com/grafana/flint/releases/download/v0.22.9/flint-x86_64-apple-darwin.tar.gz"
-url_api = "https://api.github.com/repos/grafana/flint/releases/assets/476878878"
+checksum = "sha256:b55731f1b74196afea675bdbd6ebbbd94171b4e9d31f79ecee36372bdf8818cf"
+url = "https://github.com/grafana/flint/releases/download/v0.22.10/flint-x86_64-apple-darwin.tar.gz"
+url_api = "https://api.github.com/repos/grafana/flint/releases/assets/491752660"
 provenance = "github-attestations"
 
 [tools."aqua:grafana/flint"."platforms.windows-x64"]
-checksum = "sha256:b5b9fb31413e11600ec0f8d4c0cf56c7698b1e38f156018364b3f1a2dcfbcbd0"
-url = "https://github.com/grafana/flint/releases/download/v0.22.9/flint-x86_64-pc-windows-msvc.zip"
-url_api = "https://api.github.com/repos/grafana/flint/releases/assets/476892021"
+checksum = "sha256:494f16ad4d2d8eae137438832e544675d196a2887086ab8070a5a346d70650be"
+url = "https://github.com/grafana/flint/releases/download/v0.22.10/flint-x86_64-pc-windows-msvc.zip"
+url_api = "https://api.github.com/repos/grafana/flint/releases/assets/491751016"
 provenance = "github-attestations"
 
 [[tools."aqua:grafana/gcx"]]
@@ -335,10 +341,6 @@ url = "https://github.com/biomejs/biome/releases/download/%40biomejs/biome%402.5
 url_api = "https://api.github.com/repos/biomejs/biome/releases/assets/470058831"
 provenance = "github-attestations"
 
-[[tools."cargo:https://github.com/grafana/flint"]]
-version = "rev:67309cf"
-backend = "cargo:https://github.com/grafana/flint"
-
 [[tools.editorconfig-checker]]
 version = "3.8.0"
 backend = "aqua:editorconfig-checker/editorconfig-checker"
diff --git a/mise.toml b/mise.toml
index 4f81a9ff0..1fa765b32 100644
--- a/mise.toml
+++ b/mise.toml
@@ -1,4 +1,5 @@
 [tools]
+"aqua:checkstyle/checkstyle" = "checkstyle-13.8.0"
 "aqua:grafana/gcx" = "v0.6.0"
 "aqua:grafana/oats" = "0.8.0"
 hugo = "0.164.0"
@@ -8,11 +9,10 @@ protoc = "35.1"
 
 # Linters
 actionlint = "1.7.12"
-"aqua:checkstyle/checkstyle" = "checkstyle-13.8.0"
+"aqua:grafana/flint" = "0.22.10"
 "aqua:jonwiggins/xmloxide" = "v0.4.3"
 "aqua:owenlamont/ryl" = "0.21.0"
 biome = "2.5.3"
-"cargo:https://github.com/grafana/flint" = "rev:67309cf"
 editorconfig-checker = "3.8.0"
 google-java-format = "1.35.0"
 lychee = "0.24.2"

From 51c8efd608d2bb50aeeb79c78d2489a3399cc59b Mon Sep 17 00:00:00 2001
From: Gregor Zeitlinger <gregor.zeitlinger@grafana.com>
Date: Tue, 28 Jul 2026 10:32:00 +0000
Subject: [PATCH 05/10] ci: use portable Checkstyle backend

Signed-off-by: Gregor Zeitlinger <gregor.zeitlinger@grafana.com>
---
 .github/renovate-tracked-deps.json |  2 +-
 mise.lock                          | 81 ++++++++++++++++--------------
 mise.toml                          |  2 +-
 3 files changed, 44 insertions(+), 41 deletions(-)

diff --git a/.github/renovate-tracked-deps.json b/.github/renovate-tracked-deps.json
index 8a7736645..8544e07c3 100644
--- a/.github/renovate-tracked-deps.json
+++ b/.github/renovate-tracked-deps.json
@@ -157,7 +157,7 @@
     "mise.toml": {
       "mise": [
         "actionlint",
-        "aqua:checkstyle/checkstyle",
+        "github:checkstyle/checkstyle",
         "aqua:grafana/gcx",
         "aqua:grafana/oats",
         "aqua:jonwiggins/xmloxide",
diff --git a/mise.lock b/mise.lock
index 7513a1598..ce995c88a 100644
--- a/mise.lock
+++ b/mise.lock
@@ -46,45 +46,6 @@ url = "https://github.com/rhysd/actionlint/releases/download/v1.7.12/actionlint_
 url_api = "https://api.github.com/repos/rhysd/actionlint/releases/assets/384924919"
 provenance = "github-attestations"
 
-[[tools."aqua:checkstyle/checkstyle"]]
-version = "checkstyle-13.8.0"
-backend = "aqua:checkstyle/checkstyle"
-
-[tools."aqua:checkstyle/checkstyle"."platforms.linux-arm64"]
-checksum = "sha256:cb0b1083eb5d3f9f0b7f0edd9a86d8dbe406bf44da73c3df869abace8cb8502c"
-url = "https://github.com/checkstyle/checkstyle/releases/download/checkstyle-13.8.0/checkstyle-13.8.0-all.jar"
-url_api = "https://api.github.com/repos/checkstyle/checkstyle/releases/assets/474019260"
-
-[tools."aqua:checkstyle/checkstyle"."platforms.linux-arm64-musl"]
-checksum = "sha256:cb0b1083eb5d3f9f0b7f0edd9a86d8dbe406bf44da73c3df869abace8cb8502c"
-url = "https://github.com/checkstyle/checkstyle/releases/download/checkstyle-13.8.0/checkstyle-13.8.0-all.jar"
-url_api = "https://api.github.com/repos/checkstyle/checkstyle/releases/assets/474019260"
-
-[tools."aqua:checkstyle/checkstyle"."platforms.linux-x64"]
-checksum = "sha256:cb0b1083eb5d3f9f0b7f0edd9a86d8dbe406bf44da73c3df869abace8cb8502c"
-url = "https://github.com/checkstyle/checkstyle/releases/download/checkstyle-13.8.0/checkstyle-13.8.0-all.jar"
-url_api = "https://api.github.com/repos/checkstyle/checkstyle/releases/assets/474019260"
-
-[tools."aqua:checkstyle/checkstyle"."platforms.linux-x64-musl"]
-checksum = "sha256:cb0b1083eb5d3f9f0b7f0edd9a86d8dbe406bf44da73c3df869abace8cb8502c"
-url = "https://github.com/checkstyle/checkstyle/releases/download/checkstyle-13.8.0/checkstyle-13.8.0-all.jar"
-url_api = "https://api.github.com/repos/checkstyle/checkstyle/releases/assets/474019260"
-
-[tools."aqua:checkstyle/checkstyle"."platforms.macos-arm64"]
-checksum = "sha256:cb0b1083eb5d3f9f0b7f0edd9a86d8dbe406bf44da73c3df869abace8cb8502c"
-url = "https://github.com/checkstyle/checkstyle/releases/download/checkstyle-13.8.0/checkstyle-13.8.0-all.jar"
-url_api = "https://api.github.com/repos/checkstyle/checkstyle/releases/assets/474019260"
-
-[tools."aqua:checkstyle/checkstyle"."platforms.macos-x64"]
-checksum = "sha256:cb0b1083eb5d3f9f0b7f0edd9a86d8dbe406bf44da73c3df869abace8cb8502c"
-url = "https://github.com/checkstyle/checkstyle/releases/download/checkstyle-13.8.0/checkstyle-13.8.0-all.jar"
-url_api = "https://api.github.com/repos/checkstyle/checkstyle/releases/assets/474019260"
-
-[tools."aqua:checkstyle/checkstyle"."platforms.windows-x64"]
-checksum = "sha256:cb0b1083eb5d3f9f0b7f0edd9a86d8dbe406bf44da73c3df869abace8cb8502c"
-url = "https://github.com/checkstyle/checkstyle/releases/download/checkstyle-13.8.0/checkstyle-13.8.0-all.jar"
-url_api = "https://api.github.com/repos/checkstyle/checkstyle/releases/assets/474019260"
-
 [[tools."aqua:grafana/flint"]]
 version = "0.22.10"
 backend = "aqua:grafana/flint"
@@ -380,6 +341,48 @@ checksum = "sha256:7ec31e1a6a9983aa2a4942cb66dfd35e8b61e76263460413988438ae14269
 url = "https://github.com/editorconfig-checker/editorconfig-checker/releases/download/v3.8.0/ec-windows-amd64.zip"
 url_api = "https://api.github.com/repos/editorconfig-checker/editorconfig-checker/releases/assets/460248513"
 
+[[tools."github:checkstyle/checkstyle"]]
+version = "checkstyle-13.8.0"
+backend = "github:checkstyle/checkstyle"
+
+[tools."github:checkstyle/checkstyle".options]
+matching = "all.jar"
+
+[tools."github:checkstyle/checkstyle"."platforms.linux-arm64"]
+checksum = "sha256:cb0b1083eb5d3f9f0b7f0edd9a86d8dbe406bf44da73c3df869abace8cb8502c"
+url = "https://github.com/checkstyle/checkstyle/releases/download/checkstyle-13.8.0/checkstyle-13.8.0-all.jar"
+url_api = "https://api.github.com/repos/checkstyle/checkstyle/releases/assets/474019260"
+
+[tools."github:checkstyle/checkstyle"."platforms.linux-arm64-musl"]
+checksum = "sha256:cb0b1083eb5d3f9f0b7f0edd9a86d8dbe406bf44da73c3df869abace8cb8502c"
+url = "https://github.com/checkstyle/checkstyle/releases/download/checkstyle-13.8.0/checkstyle-13.8.0-all.jar"
+url_api = "https://api.github.com/repos/checkstyle/checkstyle/releases/assets/474019260"
+
+[tools."github:checkstyle/checkstyle"."platforms.linux-x64"]
+checksum = "sha256:cb0b1083eb5d3f9f0b7f0edd9a86d8dbe406bf44da73c3df869abace8cb8502c"
+url = "https://github.com/checkstyle/checkstyle/releases/download/checkstyle-13.8.0/checkstyle-13.8.0-all.jar"
+url_api = "https://api.github.com/repos/checkstyle/checkstyle/releases/assets/474019260"
+
+[tools."github:checkstyle/checkstyle"."platforms.linux-x64-musl"]
+checksum = "sha256:cb0b1083eb5d3f9f0b7f0edd9a86d8dbe406bf44da73c3df869abace8cb8502c"
+url = "https://github.com/checkstyle/checkstyle/releases/download/checkstyle-13.8.0/checkstyle-13.8.0-all.jar"
+url_api = "https://api.github.com/repos/checkstyle/checkstyle/releases/assets/474019260"
+
+[tools."github:checkstyle/checkstyle"."platforms.macos-arm64"]
+checksum = "sha256:cb0b1083eb5d3f9f0b7f0edd9a86d8dbe406bf44da73c3df869abace8cb8502c"
+url = "https://github.com/checkstyle/checkstyle/releases/download/checkstyle-13.8.0/checkstyle-13.8.0-all.jar"
+url_api = "https://api.github.com/repos/checkstyle/checkstyle/releases/assets/474019260"
+
+[tools."github:checkstyle/checkstyle"."platforms.macos-x64"]
+checksum = "sha256:cb0b1083eb5d3f9f0b7f0edd9a86d8dbe406bf44da73c3df869abace8cb8502c"
+url = "https://github.com/checkstyle/checkstyle/releases/download/checkstyle-13.8.0/checkstyle-13.8.0-all.jar"
+url_api = "https://api.github.com/repos/checkstyle/checkstyle/releases/assets/474019260"
+
+[tools."github:checkstyle/checkstyle"."platforms.windows-x64"]
+checksum = "sha256:cb0b1083eb5d3f9f0b7f0edd9a86d8dbe406bf44da73c3df869abace8cb8502c"
+url = "https://github.com/checkstyle/checkstyle/releases/download/checkstyle-13.8.0/checkstyle-13.8.0-all.jar"
+url_api = "https://api.github.com/repos/checkstyle/checkstyle/releases/assets/474019260"
+
 [[tools.google-java-format]]
 version = "1.35.0"
 backend = "aqua:google/google-java-format"
diff --git a/mise.toml b/mise.toml
index 1fa765b32..f21098bb6 100644
--- a/mise.toml
+++ b/mise.toml
@@ -1,7 +1,7 @@
 [tools]
-"aqua:checkstyle/checkstyle" = "checkstyle-13.8.0"
 "aqua:grafana/gcx" = "v0.6.0"
 "aqua:grafana/oats" = "0.8.0"
+"github:checkstyle/checkstyle[matching=all.jar,rename_exe=checkstyle]" = "checkstyle-13.8.0"
 hugo = "0.164.0"
 java = "temurin-25.0.3+9.0.LTS"
 node = "24.18.0"

From c581686653386d8e3c454cd927187a3cfb14c9bd Mon Sep 17 00:00:00 2001
From: Gregor Zeitlinger <gregor.zeitlinger@grafana.com>
Date: Tue, 28 Jul 2026 13:00:32 +0000
Subject: [PATCH 06/10] ci: use the Checkstyle mise entry

Signed-off-by: Gregor Zeitlinger <gregor.zeitlinger@grafana.com>
---
 .github/renovate-tracked-deps.json |  4 +-
 mise.lock                          | 81 ++++++++++++++----------------
 mise.toml                          |  2 +-
 3 files changed, 42 insertions(+), 45 deletions(-)

diff --git a/.github/renovate-tracked-deps.json b/.github/renovate-tracked-deps.json
index 8544e07c3..292f6b0d8 100644
--- a/.github/renovate-tracked-deps.json
+++ b/.github/renovate-tracked-deps.json
@@ -157,13 +157,13 @@
     "mise.toml": {
       "mise": [
         "actionlint",
-        "github:checkstyle/checkstyle",
+        "aqua:grafana/flint",
         "aqua:grafana/gcx",
         "aqua:grafana/oats",
         "aqua:jonwiggins/xmloxide",
         "aqua:owenlamont/ryl",
         "biome",
-        "aqua:grafana/flint",
+        "checkstyle",
         "editorconfig-checker",
         "google-java-format",
         "hugo",
diff --git a/mise.lock b/mise.lock
index ce995c88a..4b71df0da 100644
--- a/mise.lock
+++ b/mise.lock
@@ -302,6 +302,45 @@ url = "https://github.com/biomejs/biome/releases/download/%40biomejs/biome%402.5
 url_api = "https://api.github.com/repos/biomejs/biome/releases/assets/470058831"
 provenance = "github-attestations"
 
+[[tools.checkstyle]]
+version = "13.8.0"
+backend = "aqua:checkstyle/checkstyle"
+
+[tools.checkstyle."platforms.linux-arm64"]
+checksum = "sha256:cb0b1083eb5d3f9f0b7f0edd9a86d8dbe406bf44da73c3df869abace8cb8502c"
+url = "https://github.com/checkstyle/checkstyle/releases/download/checkstyle-13.8.0/checkstyle-13.8.0-all.jar"
+url_api = "https://api.github.com/repos/checkstyle/checkstyle/releases/assets/474019260"
+
+[tools.checkstyle."platforms.linux-arm64-musl"]
+checksum = "sha256:cb0b1083eb5d3f9f0b7f0edd9a86d8dbe406bf44da73c3df869abace8cb8502c"
+url = "https://github.com/checkstyle/checkstyle/releases/download/checkstyle-13.8.0/checkstyle-13.8.0-all.jar"
+url_api = "https://api.github.com/repos/checkstyle/checkstyle/releases/assets/474019260"
+
+[tools.checkstyle."platforms.linux-x64"]
+checksum = "sha256:cb0b1083eb5d3f9f0b7f0edd9a86d8dbe406bf44da73c3df869abace8cb8502c"
+url = "https://github.com/checkstyle/checkstyle/releases/download/checkstyle-13.8.0/checkstyle-13.8.0-all.jar"
+url_api = "https://api.github.com/repos/checkstyle/checkstyle/releases/assets/474019260"
+
+[tools.checkstyle."platforms.linux-x64-musl"]
+checksum = "sha256:cb0b1083eb5d3f9f0b7f0edd9a86d8dbe406bf44da73c3df869abace8cb8502c"
+url = "https://github.com/checkstyle/checkstyle/releases/download/checkstyle-13.8.0/checkstyle-13.8.0-all.jar"
+url_api = "https://api.github.com/repos/checkstyle/checkstyle/releases/assets/474019260"
+
+[tools.checkstyle."platforms.macos-arm64"]
+checksum = "sha256:cb0b1083eb5d3f9f0b7f0edd9a86d8dbe406bf44da73c3df869abace8cb8502c"
+url = "https://github.com/checkstyle/checkstyle/releases/download/checkstyle-13.8.0/checkstyle-13.8.0-all.jar"
+url_api = "https://api.github.com/repos/checkstyle/checkstyle/releases/assets/474019260"
+
+[tools.checkstyle."platforms.macos-x64"]
+checksum = "sha256:cb0b1083eb5d3f9f0b7f0edd9a86d8dbe406bf44da73c3df869abace8cb8502c"
+url = "https://github.com/checkstyle/checkstyle/releases/download/checkstyle-13.8.0/checkstyle-13.8.0-all.jar"
+url_api = "https://api.github.com/repos/checkstyle/checkstyle/releases/assets/474019260"
+
+[tools.checkstyle."platforms.windows-x64"]
+checksum = "sha256:cb0b1083eb5d3f9f0b7f0edd9a86d8dbe406bf44da73c3df869abace8cb8502c"
+url = "https://github.com/checkstyle/checkstyle/releases/download/checkstyle-13.8.0/checkstyle-13.8.0-all.jar"
+url_api = "https://api.github.com/repos/checkstyle/checkstyle/releases/assets/474019260"
+
 [[tools.editorconfig-checker]]
 version = "3.8.0"
 backend = "aqua:editorconfig-checker/editorconfig-checker"
@@ -341,48 +380,6 @@ checksum = "sha256:7ec31e1a6a9983aa2a4942cb66dfd35e8b61e76263460413988438ae14269
 url = "https://github.com/editorconfig-checker/editorconfig-checker/releases/download/v3.8.0/ec-windows-amd64.zip"
 url_api = "https://api.github.com/repos/editorconfig-checker/editorconfig-checker/releases/assets/460248513"
 
-[[tools."github:checkstyle/checkstyle"]]
-version = "checkstyle-13.8.0"
-backend = "github:checkstyle/checkstyle"
-
-[tools."github:checkstyle/checkstyle".options]
-matching = "all.jar"
-
-[tools."github:checkstyle/checkstyle"."platforms.linux-arm64"]
-checksum = "sha256:cb0b1083eb5d3f9f0b7f0edd9a86d8dbe406bf44da73c3df869abace8cb8502c"
-url = "https://github.com/checkstyle/checkstyle/releases/download/checkstyle-13.8.0/checkstyle-13.8.0-all.jar"
-url_api = "https://api.github.com/repos/checkstyle/checkstyle/releases/assets/474019260"
-
-[tools."github:checkstyle/checkstyle"."platforms.linux-arm64-musl"]
-checksum = "sha256:cb0b1083eb5d3f9f0b7f0edd9a86d8dbe406bf44da73c3df869abace8cb8502c"
-url = "https://github.com/checkstyle/checkstyle/releases/download/checkstyle-13.8.0/checkstyle-13.8.0-all.jar"
-url_api = "https://api.github.com/repos/checkstyle/checkstyle/releases/assets/474019260"
-
-[tools."github:checkstyle/checkstyle"."platforms.linux-x64"]
-checksum = "sha256:cb0b1083eb5d3f9f0b7f0edd9a86d8dbe406bf44da73c3df869abace8cb8502c"
-url = "https://github.com/checkstyle/checkstyle/releases/download/checkstyle-13.8.0/checkstyle-13.8.0-all.jar"
-url_api = "https://api.github.com/repos/checkstyle/checkstyle/releases/assets/474019260"
-
-[tools."github:checkstyle/checkstyle"."platforms.linux-x64-musl"]
-checksum = "sha256:cb0b1083eb5d3f9f0b7f0edd9a86d8dbe406bf44da73c3df869abace8cb8502c"
-url = "https://github.com/checkstyle/checkstyle/releases/download/checkstyle-13.8.0/checkstyle-13.8.0-all.jar"
-url_api = "https://api.github.com/repos/checkstyle/checkstyle/releases/assets/474019260"
-
-[tools."github:checkstyle/checkstyle"."platforms.macos-arm64"]
-checksum = "sha256:cb0b1083eb5d3f9f0b7f0edd9a86d8dbe406bf44da73c3df869abace8cb8502c"
-url = "https://github.com/checkstyle/checkstyle/releases/download/checkstyle-13.8.0/checkstyle-13.8.0-all.jar"
-url_api = "https://api.github.com/repos/checkstyle/checkstyle/releases/assets/474019260"
-
-[tools."github:checkstyle/checkstyle"."platforms.macos-x64"]
-checksum = "sha256:cb0b1083eb5d3f9f0b7f0edd9a86d8dbe406bf44da73c3df869abace8cb8502c"
-url = "https://github.com/checkstyle/checkstyle/releases/download/checkstyle-13.8.0/checkstyle-13.8.0-all.jar"
-url_api = "https://api.github.com/repos/checkstyle/checkstyle/releases/assets/474019260"
-
-[tools."github:checkstyle/checkstyle"."platforms.windows-x64"]
-checksum = "sha256:cb0b1083eb5d3f9f0b7f0edd9a86d8dbe406bf44da73c3df869abace8cb8502c"
-url = "https://github.com/checkstyle/checkstyle/releases/download/checkstyle-13.8.0/checkstyle-13.8.0-all.jar"
-url_api = "https://api.github.com/repos/checkstyle/checkstyle/releases/assets/474019260"
-
 [[tools.google-java-format]]
 version = "1.35.0"
 backend = "aqua:google/google-java-format"
diff --git a/mise.toml b/mise.toml
index f21098bb6..9e3c82065 100644
--- a/mise.toml
+++ b/mise.toml
@@ -1,7 +1,6 @@
 [tools]
 "aqua:grafana/gcx" = "v0.6.0"
 "aqua:grafana/oats" = "0.8.0"
-"github:checkstyle/checkstyle[matching=all.jar,rename_exe=checkstyle]" = "checkstyle-13.8.0"
 hugo = "0.164.0"
 java = "temurin-25.0.3+9.0.LTS"
 node = "24.18.0"
@@ -13,6 +12,7 @@ actionlint = "1.7.12"
 "aqua:jonwiggins/xmloxide" = "v0.4.3"
 "aqua:owenlamont/ryl" = "0.21.0"
 biome = "2.5.3"
+checkstyle = "13.8.0"
 editorconfig-checker = "3.8.0"
 google-java-format = "1.35.0"
 lychee = "0.24.2"

From 37d1ab50eca20ba4b003b57800c8babcb2eca618 Mon Sep 17 00:00:00 2001
From: Gregor Zeitlinger <gregor.zeitlinger@grafana.com>
Date: Tue, 28 Jul 2026 13:05:10 +0000
Subject: [PATCH 07/10] ci: update mise for the Checkstyle registry entry

Signed-off-by: Gregor Zeitlinger <gregor.zeitlinger@grafana.com>
---
 .github/workflows/acceptance-tests.yml           | 2 +-
 .github/workflows/api-diff.yml                   | 2 +-
 .github/workflows/build.yml                      | 2 +-
 .github/workflows/bump-api-diff-baseline.yml     | 2 +-
 .github/workflows/generate-protobuf.yml          | 2 +-
 .github/workflows/github-pages.yaml              | 2 +-
 .github/workflows/java-version-matrix-tests.yml  | 2 +-
 .github/workflows/jmx-exporter-compatibility.yml | 2 +-
 .github/workflows/lint.yml                       | 2 +-
 .github/workflows/micrometer-compatibility.yml   | 2 +-
 .github/workflows/native-tests.yml               | 2 +-
 .github/workflows/nightly-benchmarks.yml         | 2 +-
 .github/workflows/pr-benchmarks.yml              | 2 +-
 .github/workflows/regenerate-api-diff-otel.yml   | 2 +-
 .github/workflows/release.yml                    | 2 +-
 .github/workflows/test-release-build.yml         | 2 +-
 16 files changed, 16 insertions(+), 16 deletions(-)

diff --git a/.github/workflows/acceptance-tests.yml b/.github/workflows/acceptance-tests.yml
index 410da0c3f..32c40d85e 100644
--- a/.github/workflows/acceptance-tests.yml
+++ b/.github/workflows/acceptance-tests.yml
@@ -15,7 +15,7 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       - uses: jdx/mise-action@9e7f7633ff6f6d6048a9418a68d48f288f50eb14 # v4.2.3
         with:
-          version: v2026.7.5
+          version: v2026.7.15
           sha256: 5f7ab76afdf0780d12edeaa67e908094e9ccf7924cfe203e415c1cfb87bbf778
       - name: Run acceptance tests
         run: mise run acceptance-test
diff --git a/.github/workflows/api-diff.yml b/.github/workflows/api-diff.yml
index c7ad1f065..ffcf6f164 100644
--- a/.github/workflows/api-diff.yml
+++ b/.github/workflows/api-diff.yml
@@ -34,7 +34,7 @@ jobs:
           persist-credentials: false
       - uses: jdx/mise-action@9e7f7633ff6f6d6048a9418a68d48f288f50eb14 # v4.2.3
         with:
-          version: v2026.7.5
+          version: v2026.7.15
           sha256: 5f7ab76afdf0780d12edeaa67e908094e9ccf7924cfe203e415c1cfb87bbf778
       - name: Cache local Maven repository
         uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 765b685f2..d5221f874 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -14,7 +14,7 @@ jobs:
           persist-credentials: false
       - uses: jdx/mise-action@9e7f7633ff6f6d6048a9418a68d48f288f50eb14 # v4.2.3
         with:
-          version: v2026.7.5
+          version: v2026.7.15
           sha256: 5f7ab76afdf0780d12edeaa67e908094e9ccf7924cfe203e415c1cfb87bbf778
       - name: Cache local Maven repository
         uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
diff --git a/.github/workflows/bump-api-diff-baseline.yml b/.github/workflows/bump-api-diff-baseline.yml
index edbf002f8..c75e709cf 100644
--- a/.github/workflows/bump-api-diff-baseline.yml
+++ b/.github/workflows/bump-api-diff-baseline.yml
@@ -35,7 +35,7 @@ jobs:
           persist-credentials: true
       - uses: jdx/mise-action@9e7f7633ff6f6d6048a9418a68d48f288f50eb14 # v4.2.3
         with:
-          version: v2026.7.5
+          version: v2026.7.15
           sha256: 5f7ab76afdf0780d12edeaa67e908094e9ccf7924cfe203e415c1cfb87bbf778
       - name: Cache local Maven repository
         uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
diff --git a/.github/workflows/generate-protobuf.yml b/.github/workflows/generate-protobuf.yml
index 6c6e54495..3ece2705c 100644
--- a/.github/workflows/generate-protobuf.yml
+++ b/.github/workflows/generate-protobuf.yml
@@ -20,7 +20,7 @@ jobs:
           persist-credentials: false
       - uses: jdx/mise-action@9e7f7633ff6f6d6048a9418a68d48f288f50eb14 # v4.2.3
         with:
-          version: v2026.7.5
+          version: v2026.7.15
           sha256: 5f7ab76afdf0780d12edeaa67e908094e9ccf7924cfe203e415c1cfb87bbf778
       - name: Cache local Maven repository
         uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
diff --git a/.github/workflows/github-pages.yaml b/.github/workflows/github-pages.yaml
index a168df077..47266bb8c 100644
--- a/.github/workflows/github-pages.yaml
+++ b/.github/workflows/github-pages.yaml
@@ -39,7 +39,7 @@ jobs:
           fetch-depth: 0
       - uses: jdx/mise-action@9e7f7633ff6f6d6048a9418a68d48f288f50eb14 # v4.2.3
         with:
-          version: v2026.7.5
+          version: v2026.7.15
           sha256: 5f7ab76afdf0780d12edeaa67e908094e9ccf7924cfe203e415c1cfb87bbf778
           cache: "false"
       - name: Setup Pages
diff --git a/.github/workflows/java-version-matrix-tests.yml b/.github/workflows/java-version-matrix-tests.yml
index fbe49c90f..6415a5bc3 100644
--- a/.github/workflows/java-version-matrix-tests.yml
+++ b/.github/workflows/java-version-matrix-tests.yml
@@ -33,7 +33,7 @@ jobs:
       - name: Set up mise
         uses: jdx/mise-action@9e7f7633ff6f6d6048a9418a68d48f288f50eb14 # v4.2.3
         with:
-          version: v2026.7.5
+          version: v2026.7.15
           sha256: 5f7ab76afdf0780d12edeaa67e908094e9ccf7924cfe203e415c1cfb87bbf778
 
       - name: Cache local Maven repository
diff --git a/.github/workflows/jmx-exporter-compatibility.yml b/.github/workflows/jmx-exporter-compatibility.yml
index 154c6f0a2..725e908de 100644
--- a/.github/workflows/jmx-exporter-compatibility.yml
+++ b/.github/workflows/jmx-exporter-compatibility.yml
@@ -24,7 +24,7 @@ jobs:
           persist-credentials: false
       - uses: jdx/mise-action@9e7f7633ff6f6d6048a9418a68d48f288f50eb14 # v4.2.3
         with:
-          version: v2026.7.5
+          version: v2026.7.15
           sha256: 5f7ab76afdf0780d12edeaa67e908094e9ccf7924cfe203e415c1cfb87bbf778
           working_directory: .mise/envs/jmx-exporter
       - name: Cache local Maven repository
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index a78b590f9..8886b0fd7 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -23,7 +23,7 @@ jobs:
       - name: Setup mise
         uses: jdx/mise-action@9e7f7633ff6f6d6048a9418a68d48f288f50eb14 # v4.2.3
         with:
-          version: v2026.7.5
+          version: v2026.7.15
           sha256: 5f7ab76afdf0780d12edeaa67e908094e9ccf7924cfe203e415c1cfb87bbf778
 
       - name: Lint
diff --git a/.github/workflows/micrometer-compatibility.yml b/.github/workflows/micrometer-compatibility.yml
index a27f75048..9ae64636e 100644
--- a/.github/workflows/micrometer-compatibility.yml
+++ b/.github/workflows/micrometer-compatibility.yml
@@ -32,7 +32,7 @@ jobs:
           persist-credentials: false
       - uses: jdx/mise-action@9e7f7633ff6f6d6048a9418a68d48f288f50eb14 # v4.2.3
         with:
-          version: v2026.7.5
+          version: v2026.7.15
           sha256: 5f7ab76afdf0780d12edeaa67e908094e9ccf7924cfe203e415c1cfb87bbf778
           working_directory: .mise/envs/micrometer
       - name: Cache local Maven repository
diff --git a/.github/workflows/native-tests.yml b/.github/workflows/native-tests.yml
index 473a2935f..a5b1e833f 100644
--- a/.github/workflows/native-tests.yml
+++ b/.github/workflows/native-tests.yml
@@ -15,7 +15,7 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       - uses: jdx/mise-action@9e7f7633ff6f6d6048a9418a68d48f288f50eb14 # v4.2.3
         with:
-          version: v2026.7.5
+          version: v2026.7.15
           sha256: 5f7ab76afdf0780d12edeaa67e908094e9ccf7924cfe203e415c1cfb87bbf778
           working_directory: .mise/envs/native
       - name: Run native tests
diff --git a/.github/workflows/nightly-benchmarks.yml b/.github/workflows/nightly-benchmarks.yml
index 2aa5bf1aa..00644abc6 100644
--- a/.github/workflows/nightly-benchmarks.yml
+++ b/.github/workflows/nightly-benchmarks.yml
@@ -36,7 +36,7 @@ jobs:
       - name: Setup mise
         uses: jdx/mise-action@9e7f7633ff6f6d6048a9418a68d48f288f50eb14 # v4.2.3
         with:
-          version: v2026.7.5
+          version: v2026.7.15
           sha256: 5f7ab76afdf0780d12edeaa67e908094e9ccf7924cfe203e415c1cfb87bbf778
 
       - name: Cache local Maven repository
diff --git a/.github/workflows/pr-benchmarks.yml b/.github/workflows/pr-benchmarks.yml
index 39f02cae9..9ebdd2e5e 100644
--- a/.github/workflows/pr-benchmarks.yml
+++ b/.github/workflows/pr-benchmarks.yml
@@ -47,7 +47,7 @@ jobs:
       - name: Setup mise
         uses: jdx/mise-action@9e7f7633ff6f6d6048a9418a68d48f288f50eb14 # v4.2.3
         with:
-          version: v2026.7.5
+          version: v2026.7.15
           sha256: 5f7ab76afdf0780d12edeaa67e908094e9ccf7924cfe203e415c1cfb87bbf778
 
       - name: Cache local Maven repository
diff --git a/.github/workflows/regenerate-api-diff-otel.yml b/.github/workflows/regenerate-api-diff-otel.yml
index da1db33b2..3a483cab3 100644
--- a/.github/workflows/regenerate-api-diff-otel.yml
+++ b/.github/workflows/regenerate-api-diff-otel.yml
@@ -20,7 +20,7 @@ jobs:
           persist-credentials: false
       - uses: jdx/mise-action@9e7f7633ff6f6d6048a9418a68d48f288f50eb14 # v4.2.3
         with:
-          version: v2026.7.5
+          version: v2026.7.15
           sha256: 5f7ab76afdf0780d12edeaa67e908094e9ccf7924cfe203e415c1cfb87bbf778
       - name: Cache local Maven repository
         uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index a30db041e..7adfb6daf 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -71,7 +71,7 @@ jobs:
 
       - uses: jdx/mise-action@9e7f7633ff6f6d6048a9418a68d48f288f50eb14 # v4.2.3
         with:
-          version: v2026.7.5
+          version: v2026.7.15
           sha256: 5f7ab76afdf0780d12edeaa67e908094e9ccf7924cfe203e415c1cfb87bbf778
           cache: false
 
diff --git a/.github/workflows/test-release-build.yml b/.github/workflows/test-release-build.yml
index 64bc75b30..ad2b6ec3b 100644
--- a/.github/workflows/test-release-build.yml
+++ b/.github/workflows/test-release-build.yml
@@ -20,7 +20,7 @@ jobs:
           fetch-depth: 0
       - uses: jdx/mise-action@9e7f7633ff6f6d6048a9418a68d48f288f50eb14 # v4.2.3
         with:
-          version: v2026.7.5
+          version: v2026.7.15
           sha256: 5f7ab76afdf0780d12edeaa67e908094e9ccf7924cfe203e415c1cfb87bbf778
       - name: Cache local Maven repository
         uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0

From 3b01612f24665e12aa63ba1207131f7a99f74842 Mon Sep 17 00:00:00 2001
From: Gregor Zeitlinger <gregor.zeitlinger@grafana.com>
Date: Tue, 28 Jul 2026 13:07:25 +0000
Subject: [PATCH 08/10] ci: update the mise binary checksum

Signed-off-by: Gregor Zeitlinger <gregor.zeitlinger@grafana.com>
---
 .github/workflows/acceptance-tests.yml           | 2 +-
 .github/workflows/api-diff.yml                   | 2 +-
 .github/workflows/build.yml                      | 2 +-
 .github/workflows/bump-api-diff-baseline.yml     | 2 +-
 .github/workflows/generate-protobuf.yml          | 2 +-
 .github/workflows/github-pages.yaml              | 2 +-
 .github/workflows/java-version-matrix-tests.yml  | 2 +-
 .github/workflows/jmx-exporter-compatibility.yml | 2 +-
 .github/workflows/lint.yml                       | 2 +-
 .github/workflows/micrometer-compatibility.yml   | 2 +-
 .github/workflows/native-tests.yml               | 2 +-
 .github/workflows/nightly-benchmarks.yml         | 2 +-
 .github/workflows/pr-benchmarks.yml              | 2 +-
 .github/workflows/regenerate-api-diff-otel.yml   | 2 +-
 .github/workflows/release.yml                    | 2 +-
 .github/workflows/test-release-build.yml         | 2 +-
 16 files changed, 16 insertions(+), 16 deletions(-)

diff --git a/.github/workflows/acceptance-tests.yml b/.github/workflows/acceptance-tests.yml
index 32c40d85e..24cc97559 100644
--- a/.github/workflows/acceptance-tests.yml
+++ b/.github/workflows/acceptance-tests.yml
@@ -16,6 +16,6 @@ jobs:
       - uses: jdx/mise-action@9e7f7633ff6f6d6048a9418a68d48f288f50eb14 # v4.2.3
         with:
           version: v2026.7.15
-          sha256: 5f7ab76afdf0780d12edeaa67e908094e9ccf7924cfe203e415c1cfb87bbf778
+          sha256: 9a729bbe121135da0c717d86d3328f21de5efcc6fa27ac8487ef481e428008d3
       - name: Run acceptance tests
         run: mise run acceptance-test
diff --git a/.github/workflows/api-diff.yml b/.github/workflows/api-diff.yml
index ffcf6f164..1f1bba199 100644
--- a/.github/workflows/api-diff.yml
+++ b/.github/workflows/api-diff.yml
@@ -35,7 +35,7 @@ jobs:
       - uses: jdx/mise-action@9e7f7633ff6f6d6048a9418a68d48f288f50eb14 # v4.2.3
         with:
           version: v2026.7.15
-          sha256: 5f7ab76afdf0780d12edeaa67e908094e9ccf7924cfe203e415c1cfb87bbf778
+          sha256: 9a729bbe121135da0c717d86d3328f21de5efcc6fa27ac8487ef481e428008d3
       - name: Cache local Maven repository
         uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index d5221f874..d0edfb564 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -15,7 +15,7 @@ jobs:
       - uses: jdx/mise-action@9e7f7633ff6f6d6048a9418a68d48f288f50eb14 # v4.2.3
         with:
           version: v2026.7.15
-          sha256: 5f7ab76afdf0780d12edeaa67e908094e9ccf7924cfe203e415c1cfb87bbf778
+          sha256: 9a729bbe121135da0c717d86d3328f21de5efcc6fa27ac8487ef481e428008d3
       - name: Cache local Maven repository
         uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
diff --git a/.github/workflows/bump-api-diff-baseline.yml b/.github/workflows/bump-api-diff-baseline.yml
index c75e709cf..361a8bc69 100644
--- a/.github/workflows/bump-api-diff-baseline.yml
+++ b/.github/workflows/bump-api-diff-baseline.yml
@@ -36,7 +36,7 @@ jobs:
       - uses: jdx/mise-action@9e7f7633ff6f6d6048a9418a68d48f288f50eb14 # v4.2.3
         with:
           version: v2026.7.15
-          sha256: 5f7ab76afdf0780d12edeaa67e908094e9ccf7924cfe203e415c1cfb87bbf778
+          sha256: 9a729bbe121135da0c717d86d3328f21de5efcc6fa27ac8487ef481e428008d3
       - name: Cache local Maven repository
         uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
diff --git a/.github/workflows/generate-protobuf.yml b/.github/workflows/generate-protobuf.yml
index 3ece2705c..4df60151f 100644
--- a/.github/workflows/generate-protobuf.yml
+++ b/.github/workflows/generate-protobuf.yml
@@ -21,7 +21,7 @@ jobs:
       - uses: jdx/mise-action@9e7f7633ff6f6d6048a9418a68d48f288f50eb14 # v4.2.3
         with:
           version: v2026.7.15
-          sha256: 5f7ab76afdf0780d12edeaa67e908094e9ccf7924cfe203e415c1cfb87bbf778
+          sha256: 9a729bbe121135da0c717d86d3328f21de5efcc6fa27ac8487ef481e428008d3
       - name: Cache local Maven repository
         uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
diff --git a/.github/workflows/github-pages.yaml b/.github/workflows/github-pages.yaml
index 47266bb8c..50f94da6c 100644
--- a/.github/workflows/github-pages.yaml
+++ b/.github/workflows/github-pages.yaml
@@ -40,7 +40,7 @@ jobs:
       - uses: jdx/mise-action@9e7f7633ff6f6d6048a9418a68d48f288f50eb14 # v4.2.3
         with:
           version: v2026.7.15
-          sha256: 5f7ab76afdf0780d12edeaa67e908094e9ccf7924cfe203e415c1cfb87bbf778
+          sha256: 9a729bbe121135da0c717d86d3328f21de5efcc6fa27ac8487ef481e428008d3
           cache: "false"
       - name: Setup Pages
         id: pages
diff --git a/.github/workflows/java-version-matrix-tests.yml b/.github/workflows/java-version-matrix-tests.yml
index 6415a5bc3..2be421450 100644
--- a/.github/workflows/java-version-matrix-tests.yml
+++ b/.github/workflows/java-version-matrix-tests.yml
@@ -34,7 +34,7 @@ jobs:
         uses: jdx/mise-action@9e7f7633ff6f6d6048a9418a68d48f288f50eb14 # v4.2.3
         with:
           version: v2026.7.15
-          sha256: 5f7ab76afdf0780d12edeaa67e908094e9ccf7924cfe203e415c1cfb87bbf778
+          sha256: 9a729bbe121135da0c717d86d3328f21de5efcc6fa27ac8487ef481e428008d3
 
       - name: Cache local Maven repository
         uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
diff --git a/.github/workflows/jmx-exporter-compatibility.yml b/.github/workflows/jmx-exporter-compatibility.yml
index 725e908de..e04f39083 100644
--- a/.github/workflows/jmx-exporter-compatibility.yml
+++ b/.github/workflows/jmx-exporter-compatibility.yml
@@ -25,7 +25,7 @@ jobs:
       - uses: jdx/mise-action@9e7f7633ff6f6d6048a9418a68d48f288f50eb14 # v4.2.3
         with:
           version: v2026.7.15
-          sha256: 5f7ab76afdf0780d12edeaa67e908094e9ccf7924cfe203e415c1cfb87bbf778
+          sha256: 9a729bbe121135da0c717d86d3328f21de5efcc6fa27ac8487ef481e428008d3
           working_directory: .mise/envs/jmx-exporter
       - name: Cache local Maven repository
         uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index 8886b0fd7..d7622514a 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -24,7 +24,7 @@ jobs:
         uses: jdx/mise-action@9e7f7633ff6f6d6048a9418a68d48f288f50eb14 # v4.2.3
         with:
           version: v2026.7.15
-          sha256: 5f7ab76afdf0780d12edeaa67e908094e9ccf7924cfe203e415c1cfb87bbf778
+          sha256: 9a729bbe121135da0c717d86d3328f21de5efcc6fa27ac8487ef481e428008d3
 
       - name: Lint
         env:
diff --git a/.github/workflows/micrometer-compatibility.yml b/.github/workflows/micrometer-compatibility.yml
index 9ae64636e..14c616ddc 100644
--- a/.github/workflows/micrometer-compatibility.yml
+++ b/.github/workflows/micrometer-compatibility.yml
@@ -33,7 +33,7 @@ jobs:
       - uses: jdx/mise-action@9e7f7633ff6f6d6048a9418a68d48f288f50eb14 # v4.2.3
         with:
           version: v2026.7.15
-          sha256: 5f7ab76afdf0780d12edeaa67e908094e9ccf7924cfe203e415c1cfb87bbf778
+          sha256: 9a729bbe121135da0c717d86d3328f21de5efcc6fa27ac8487ef481e428008d3
           working_directory: .mise/envs/micrometer
       - name: Cache local Maven repository
         uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
diff --git a/.github/workflows/native-tests.yml b/.github/workflows/native-tests.yml
index a5b1e833f..17976affc 100644
--- a/.github/workflows/native-tests.yml
+++ b/.github/workflows/native-tests.yml
@@ -16,7 +16,7 @@ jobs:
       - uses: jdx/mise-action@9e7f7633ff6f6d6048a9418a68d48f288f50eb14 # v4.2.3
         with:
           version: v2026.7.15
-          sha256: 5f7ab76afdf0780d12edeaa67e908094e9ccf7924cfe203e415c1cfb87bbf778
+          sha256: 9a729bbe121135da0c717d86d3328f21de5efcc6fa27ac8487ef481e428008d3
           working_directory: .mise/envs/native
       - name: Run native tests
         working-directory: .mise/envs/native
diff --git a/.github/workflows/nightly-benchmarks.yml b/.github/workflows/nightly-benchmarks.yml
index 00644abc6..921dcf818 100644
--- a/.github/workflows/nightly-benchmarks.yml
+++ b/.github/workflows/nightly-benchmarks.yml
@@ -37,7 +37,7 @@ jobs:
         uses: jdx/mise-action@9e7f7633ff6f6d6048a9418a68d48f288f50eb14 # v4.2.3
         with:
           version: v2026.7.15
-          sha256: 5f7ab76afdf0780d12edeaa67e908094e9ccf7924cfe203e415c1cfb87bbf778
+          sha256: 9a729bbe121135da0c717d86d3328f21de5efcc6fa27ac8487ef481e428008d3
 
       - name: Cache local Maven repository
         uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
diff --git a/.github/workflows/pr-benchmarks.yml b/.github/workflows/pr-benchmarks.yml
index 9ebdd2e5e..5d59cbc7f 100644
--- a/.github/workflows/pr-benchmarks.yml
+++ b/.github/workflows/pr-benchmarks.yml
@@ -48,7 +48,7 @@ jobs:
         uses: jdx/mise-action@9e7f7633ff6f6d6048a9418a68d48f288f50eb14 # v4.2.3
         with:
           version: v2026.7.15
-          sha256: 5f7ab76afdf0780d12edeaa67e908094e9ccf7924cfe203e415c1cfb87bbf778
+          sha256: 9a729bbe121135da0c717d86d3328f21de5efcc6fa27ac8487ef481e428008d3
 
       - name: Cache local Maven repository
         uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
diff --git a/.github/workflows/regenerate-api-diff-otel.yml b/.github/workflows/regenerate-api-diff-otel.yml
index 3a483cab3..3533e8e7f 100644
--- a/.github/workflows/regenerate-api-diff-otel.yml
+++ b/.github/workflows/regenerate-api-diff-otel.yml
@@ -21,7 +21,7 @@ jobs:
       - uses: jdx/mise-action@9e7f7633ff6f6d6048a9418a68d48f288f50eb14 # v4.2.3
         with:
           version: v2026.7.15
-          sha256: 5f7ab76afdf0780d12edeaa67e908094e9ccf7924cfe203e415c1cfb87bbf778
+          sha256: 9a729bbe121135da0c717d86d3328f21de5efcc6fa27ac8487ef481e428008d3
       - name: Cache local Maven repository
         uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 7adfb6daf..1a5a91158 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -72,7 +72,7 @@ jobs:
       - uses: jdx/mise-action@9e7f7633ff6f6d6048a9418a68d48f288f50eb14 # v4.2.3
         with:
           version: v2026.7.15
-          sha256: 5f7ab76afdf0780d12edeaa67e908094e9ccf7924cfe203e415c1cfb87bbf778
+          sha256: 9a729bbe121135da0c717d86d3328f21de5efcc6fa27ac8487ef481e428008d3
           cache: false
 
       - name: Build release version
diff --git a/.github/workflows/test-release-build.yml b/.github/workflows/test-release-build.yml
index ad2b6ec3b..cd28dfbd5 100644
--- a/.github/workflows/test-release-build.yml
+++ b/.github/workflows/test-release-build.yml
@@ -21,7 +21,7 @@ jobs:
       - uses: jdx/mise-action@9e7f7633ff6f6d6048a9418a68d48f288f50eb14 # v4.2.3
         with:
           version: v2026.7.15
-          sha256: 5f7ab76afdf0780d12edeaa67e908094e9ccf7924cfe203e415c1cfb87bbf778
+          sha256: 9a729bbe121135da0c717d86d3328f21de5efcc6fa27ac8487ef481e428008d3
       - name: Cache local Maven repository
         uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:

From b16e318fde853833b3f889a02e66aa3b101645fe Mon Sep 17 00:00:00 2001
From: Gregor Zeitlinger <gregor.zeitlinger@grafana.com>
Date: Tue, 28 Jul 2026 13:11:57 +0000
Subject: [PATCH 09/10] ci: allow the verified Renovate dependency release

Signed-off-by: Gregor Zeitlinger <gregor.zeitlinger@grafana.com>
---
 mise.toml | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/mise.toml b/mise.toml
index 9e3c82065..83ae49227 100644
--- a/mise.toml
+++ b/mise.toml
@@ -16,7 +16,8 @@ checkstyle = "13.8.0"
 editorconfig-checker = "3.8.0"
 google-java-format = "1.35.0"
 lychee = "0.24.2"
-"npm:renovate" = "43.257.4"
+# @yarnpkg/libzip 3.2.2 matches its upstream release but was published without provenance.
+"npm:renovate" = { version = "43.257.4", trust_policy_excludes = ["@yarnpkg/libzip@3.2.2"] }
 ruff = "0.15.21"
 rumdl = "v0.2.31"
 shellcheck = "v0.11.0"

From 0ffb26ac14c62ae7e0e404d0f2127b5a49783930 Mon Sep 17 00:00:00 2001
From: Gregor Zeitlinger <gregor.zeitlinger@grafana.com>
Date: Tue, 28 Jul 2026 13:13:31 +0000
Subject: [PATCH 10/10] ci: lock the Renovate trust exception

Signed-off-by: Gregor Zeitlinger <gregor.zeitlinger@grafana.com>
---
 mise.lock | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/mise.lock b/mise.lock
index 4b71df0da..c5042a98d 100644
--- a/mise.lock
+++ b/mise.lock
@@ -560,6 +560,9 @@ url = "https://nodejs.org/dist/v24.18.0/node-v24.18.0-win-x64.zip"
 version = "43.257.4"
 backend = "npm:renovate"
 
+[tools."npm:renovate".options]
+trust_policy_excludes = '["@yarnpkg/libzip@3.2.2"]'
+
 [[tools.protoc]]
 version = "35.1"
 backend = "aqua:protocolbuffers/protobuf/protoc"