What causes "group update requires a desired gid" in jdx/mise?

Add the desired gid to the group resource configuration so the update action has a concrete target.

group update requires a desired gid

Error message

group update requires a desired gid

What it means

In src/system/accounts.rs, a group resource being updated must carry a desired gid. When converting a planned group change into an AccountAction::UpdateGroup, gid.expect fires if the update plan has no target gid — the caller built an Update action without specifying what gid the group should have.

Source

Thrown at src/system/accounts.rs:320

            }
        }
    }

    fn action(&self) -> Result<Option<AccountAction>> {
        match self.plan().action {
            ResourceAction::Noop => Ok(None),
            ResourceAction::Unknown => bail!(
                "refusing unsafe change to bootstrap group '{}'; inspect `mise bootstrap plan`",
                self.name
            ),
            ResourceAction::Create => Ok(Some(AccountAction::CreateGroup {
                name: self.name.clone(),
                gid: self.gid,
                system: self.system,
            })),
            ResourceAction::Update => Ok(Some(AccountAction::UpdateGroup {
                name: self.name.clone(),
                gid: self.gid.expect("group update requires a desired gid"),
            })),
            ResourceAction::Remove => Ok(Some(AccountAction::RemoveGroup {
                name: self.name.clone(),
            })),
        }
    }
}

impl UserRequest {
    fn from_toml(name: String, config: UserTomlConfig) -> Result<Self> {
        validate_name("user", &name)?;
        if config.state == AccountState::Present && config.group.is_none() {
            bail!("present bootstrap user '{name}' requires a primary group");
        }
        if config.state == AccountState::Present && config.remove_home {
            bail!("present bootstrap user '{name}' must not set remove_home");
        }
        if config.state == AccountState::Absent

View on GitHub (pinned to afd2eddd3a)

Solutions

Add the desired gid to the group resource configuration so the update action has a concrete target.
Use a create action (with gid) instead of update if the group does not yet exist.
Drop the update action and manage the group outside mise if you only need membership checks.
Report a schema/validation gap if the config format permits gid-less update actions.

Example fix

// before
[[groups]]
name = "devs"
action = "update"
// after
[[groups]]
name = "devs"
action = "update"
gid = 1500

Defensive patterns

Strategy: validation

Validate before calling

# validate group config before applying
if g.action == "update" and not g.get("gid"):
    raise ValueError(f"group {g['name']}: update requires gid")

Prevention

Always specify gid for update actions on managed groups.
Lint account/group configs for required fields per action type.
Prefer create actions with explicit gids over partially-specified updates.

When it happens

Trigger: A system package/config (e.g. mise system accounts/group management) declares a group with an 'update' action but omits the gid field, so plan_account_actions produces UpdateGroup with gid: None.

Common situations: Config declaring an existing group to manage but forgetting gid; renaming/merging group configs where the gid was dropped; schema allowing update actions without requiring gid.

Understand the failure class

Background: "is required", "must be set", "missing required field": configuration validation errors across open-source libraries — this error's family across 36 libraries.

Related errors

AI-assisted analysis of jdx/mise@afd2eddd3a (2026-09-09). Data as JSON: /api/errors/2452933e5b4ca114. Report an issue: GitHub.