From 8f55a2b1d9a7449f51c1fa27a23b7f98c1081d12 Mon Sep 17 00:00:00 2001 From: Krukon Date: Fri, 21 Aug 2026 13:47:06 +0200 Subject: [PATCH 1/5] chore: migrate CI to mise-action Replace step-security/setup-beam with step-security/mise-action across ci.yaml and dev-publish.yaml, declare elixir/erlang versions in mise.toml, generate mise.lock, and gitignore actions.lock.yaml. --- .github/actions.lock.yaml | 66 +++++++++++++++---------- .github/workflows/ci.yaml | 30 +++--------- .github/workflows/dev-publish.yaml | 10 +--- .gitignore | 3 ++ mise.lock | 79 ++++++++++++++++++++++++++++++ mise.toml | 3 ++ 6 files changed, 133 insertions(+), 58 deletions(-) create mode 100644 mise.lock create mode 100644 mise.toml diff --git a/.github/actions.lock.yaml b/.github/actions.lock.yaml index ea226bf..4814187 100644 --- a/.github/actions.lock.yaml +++ b/.github/actions.lock.yaml @@ -1,5 +1,5 @@ version: 1 -generated_at: 2026-06-11T15:39:11Z +generated_at: 2026-08-21T11:46:49Z internal: [] trusted: - action: actions/checkout @@ -7,6 +7,20 @@ trusted: - 34e114876b0b11c390a56381ad16ebd13914f8d5 occurrences: 34e114876b0b11c390a56381ad16ebd13914f8d5: + .github/workflows/ci.yaml: + - jobs.static.steps.[1].uses + - jobs.test.steps.[1].uses + - jobs.permit.steps.[1].uses + - jobs.publish.steps.[1].uses + - jobs.check_release.steps.[1].uses + .github/workflows/dev-publish.yaml: + - jobs.dev-publish.steps.[1].uses +external: + - action: step-security/harden-runner + refs: + - 9af89fc71515a100421586dfdb3dc9c984fbf411 + occurrences: + 9af89fc71515a100421586dfdb3dc9c984fbf411: .github/workflows/ci.yaml: - jobs.static.steps.[0].uses - jobs.test.steps.[0].uses @@ -15,42 +29,42 @@ trusted: - jobs.check_release.steps.[0].uses .github/workflows/dev-publish.yaml: - jobs.dev-publish.steps.[0].uses - - action: runs-on/cache + - action: step-security/mise-action refs: - - a5f51d6f3fece787d03b7b4e981c82538a0654ed + - 2796166110dee826668caddd4bffedae5116e7cd occurrences: - a5f51d6f3fece787d03b7b4e981c82538a0654ed: + 2796166110dee826668caddd4bffedae5116e7cd: .github/workflows/ci.yaml: - - jobs.static.steps.[4].uses - - jobs.static.steps.[6].uses - - jobs.test.steps.[4].uses - - jobs.test.steps.[6].uses - - action: runs-on/cache/restore - refs: - - a5f51d6f3fece787d03b7b4e981c82538a0654ed - occurrences: - a5f51d6f3fece787d03b7b4e981c82538a0654ed: + - jobs.static.steps.[2].uses + - jobs.test.steps.[2].uses + - jobs.publish.steps.[2].uses .github/workflows/dev-publish.yaml: - - jobs.dev-publish.steps.[2].uses - - action: runs-on/cache/save + - jobs.dev-publish.steps.[4].uses + - action: step-security/runs-on-cache refs: - - a5f51d6f3fece787d03b7b4e981c82538a0654ed + - c5b0cba15d05488ebc630ad8d1e95b3d9b35ac73 occurrences: - a5f51d6f3fece787d03b7b4e981c82538a0654ed: + c5b0cba15d05488ebc630ad8d1e95b3d9b35ac73: .github/workflows/ci.yaml: - - jobs.permit.steps.[3].uses -external: - - action: erlef/setup-beam + - jobs.static.steps.[5].uses + - jobs.static.steps.[7].uses + - jobs.test.steps.[5].uses + - jobs.test.steps.[7].uses + - action: step-security/runs-on-cache/restore refs: - - fc68ffb90438ef2936bbb3251622353b3dcb2f93 + - c5b0cba15d05488ebc630ad8d1e95b3d9b35ac73 occurrences: - fc68ffb90438ef2936bbb3251622353b3dcb2f93: - .github/workflows/ci.yaml: - - jobs.static.steps.[1].uses - - jobs.test.steps.[1].uses - - jobs.publish.steps.[1].uses + c5b0cba15d05488ebc630ad8d1e95b3d9b35ac73: .github/workflows/dev-publish.yaml: - jobs.dev-publish.steps.[3].uses + - action: step-security/runs-on-cache/save + refs: + - c5b0cba15d05488ebc630ad8d1e95b3d9b35ac73 + occurrences: + c5b0cba15d05488ebc630ad8d1e95b3d9b35ac73: + .github/workflows/ci.yaml: + - jobs.permit.steps.[4].uses local: [] docker: [] dynamic: [] +nested_floating_deps: [] diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index 01e7f3e..f8f3ae4 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -46,14 +46,8 @@ jobs: ref: ${{ env.SHA }} clean: false persist-credentials: true - - name: Setup Elixir - uses: step-security/setup-beam@05e480cfdc64c72ab6c25b134dd1f57e29776c84 # v1.24.1 - env: - ImageOS: ${{ matrix.runner-os }} - with: - elixir-version: ${{ matrix.elixir }} - otp-version: ${{ matrix.otp }} - version-type: strict + - name: Setup mise + uses: step-security/mise-action@2796166110dee826668caddd4bffedae5116e7cd # v4.2.0 - name: Get SHA sum (HASH) of relevant files id: hash run: | @@ -121,14 +115,8 @@ jobs: ref: ${{ env.SHA }} clean: false persist-credentials: true - - name: Setup Elixir - uses: step-security/setup-beam@05e480cfdc64c72ab6c25b134dd1f57e29776c84 # v1.24.1 - env: - ImageOS: ${{ matrix.runner-os }} - with: - elixir-version: ${{ matrix.elixir }} - otp-version: ${{ matrix.otp }} - version-type: strict + - name: Setup mise + uses: step-security/mise-action@2796166110dee826668caddd4bffedae5116e7cd # v4.2.0 - name: Get SHA sum (HASH) of relevant files id: hash run: | @@ -243,14 +231,8 @@ jobs: ref: ${{ env.SHA }} clean: false persist-credentials: true - - name: Setup Elixir - uses: step-security/setup-beam@05e480cfdc64c72ab6c25b134dd1f57e29776c84 # v1.24.1 - env: - ImageOS: ${{ env.RUNNER_OS }} - with: - elixir-version: ${{ env.ELIXIR_VERSION }} - otp-version: ${{ env.OTP_VERSION }} - version-type: strict + - name: Setup mise + uses: step-security/mise-action@2796166110dee826668caddd4bffedae5116e7cd # v4.2.0 - name: Hex auth run: mix hex.organization auth fresha --key ${{ secrets.HEX_ORGANIZATION_WRITE_KEY }} shell: bash diff --git a/.github/workflows/dev-publish.yaml b/.github/workflows/dev-publish.yaml index e3b153c..e91d263 100644 --- a/.github/workflows/dev-publish.yaml +++ b/.github/workflows/dev-publish.yaml @@ -49,14 +49,8 @@ jobs: key: ${{ runner.os }}-${{ env.REPOSITORY }}-approval-${{ steps.hash.outputs.HASH }} path: approval.txt fail-on-cache-miss: true - - name: Setup Elixir - uses: step-security/setup-beam@05e480cfdc64c72ab6c25b134dd1f57e29776c84 # v1.24.1 - env: - ImageOS: ${{ env.RUNNER_OS }} - with: - elixir-version: ${{ env.ELIXIR_VERSION }} - otp-version: ${{ env.OTP_VERSION }} - version-type: strict + - name: Setup mise + uses: step-security/mise-action@2796166110dee826668caddd4bffedae5116e7cd # v4.2.0 - name: Hex auth run: mix hex.organization auth fresha --key ${{ secrets.HEX_ORGANIZATION_WRITE_KEY }} shell: bash diff --git a/.gitignore b/.gitignore index cd1cbba..27ff4ac 100644 --- a/.gitignore +++ b/.gitignore @@ -30,3 +30,6 @@ libcluster-*.tar !/priv/test/service_account/.gitkeep /libcluster.iml /.idea/ + +# mise-action generated lockfile for pinned GitHub Actions +.github/actions.lock.yaml diff --git a/mise.lock b/mise.lock new file mode 100644 index 0000000..f357302 --- /dev/null +++ b/mise.lock @@ -0,0 +1,79 @@ +# @generated - this file is auto-generated by `mise lock` https://mise.jdx.dev/dev-tools/mise-lock.html + +[[tools.elixir]] +version = "1.13.0" +backend = "core:elixir" + +[tools.elixir."platforms.linux-arm64"] +checksum = "sha256:9b07613dec0fc57a9efb8c50e9141def77ba4029e6b1d012a2132c70485894af" +url = "https://builds.hex.pm/builds/elixir/v1.13.0.zip" + +[tools.elixir."platforms.linux-arm64-musl"] +checksum = "sha256:9b07613dec0fc57a9efb8c50e9141def77ba4029e6b1d012a2132c70485894af" +url = "https://builds.hex.pm/builds/elixir/v1.13.0.zip" + +[tools.elixir."platforms.linux-x64"] +checksum = "sha256:9b07613dec0fc57a9efb8c50e9141def77ba4029e6b1d012a2132c70485894af" +url = "https://builds.hex.pm/builds/elixir/v1.13.0.zip" + +[tools.elixir."platforms.linux-x64-musl"] +checksum = "sha256:9b07613dec0fc57a9efb8c50e9141def77ba4029e6b1d012a2132c70485894af" +url = "https://builds.hex.pm/builds/elixir/v1.13.0.zip" + +[tools.elixir."platforms.macos-arm64"] +checksum = "sha256:9b07613dec0fc57a9efb8c50e9141def77ba4029e6b1d012a2132c70485894af" +url = "https://builds.hex.pm/builds/elixir/v1.13.0.zip" + +[tools.elixir."platforms.macos-x64"] +checksum = "sha256:9b07613dec0fc57a9efb8c50e9141def77ba4029e6b1d012a2132c70485894af" +url = "https://builds.hex.pm/builds/elixir/v1.13.0.zip" + +[tools.elixir."platforms.windows-x64"] +checksum = "sha256:9b07613dec0fc57a9efb8c50e9141def77ba4029e6b1d012a2132c70485894af" +url = "https://builds.hex.pm/builds/elixir/v1.13.0.zip" + +[[tools.erlang]] +version = "22.3.4.7" +backend = "core:erlang" + +[tools.erlang.options] +precompiled_os = "ubuntu-22.04" + +[tools.erlang."platforms.linux-arm64"] +url = "https://github.com/erlang/otp/releases/download/OTP-22.3.4.7/otp_src_22.3.4.7.tar.gz" +url_api = "https://api.github.com/repos/erlang/otp/releases/assets/26783277" +install = "source" + +[tools.erlang."platforms.linux-x64"] +url = "https://github.com/erlang/otp/releases/download/OTP-22.3.4.7/otp_src_22.3.4.7.tar.gz" +url_api = "https://api.github.com/repos/erlang/otp/releases/assets/26783277" +install = "source" + +[[tools.erlang]] +version = "22.3.4.7" +backend = "core:erlang" + +[tools.erlang."platforms.linux-arm64-musl"] +url = "https://github.com/erlang/otp/releases/download/OTP-22.3.4.7/otp_src_22.3.4.7.tar.gz" +url_api = "https://api.github.com/repos/erlang/otp/releases/assets/26783277" +install = "source" + +[tools.erlang."platforms.linux-x64-musl"] +url = "https://github.com/erlang/otp/releases/download/OTP-22.3.4.7/otp_src_22.3.4.7.tar.gz" +url_api = "https://api.github.com/repos/erlang/otp/releases/assets/26783277" +install = "source" + +[tools.erlang."platforms.macos-arm64"] +url = "https://github.com/erlang/otp/releases/download/OTP-22.3.4.7/otp_src_22.3.4.7.tar.gz" +url_api = "https://api.github.com/repos/erlang/otp/releases/assets/26783277" +install = "source" + +[tools.erlang."platforms.macos-x64"] +url = "https://github.com/erlang/otp/releases/download/OTP-22.3.4.7/otp_src_22.3.4.7.tar.gz" +url_api = "https://api.github.com/repos/erlang/otp/releases/assets/26783277" +install = "source" + +[tools.erlang."platforms.windows-x64"] +url = "https://github.com/erlang/otp/releases/download/OTP-22.3.4.7/otp_src_22.3.4.7.tar.gz" +url_api = "https://api.github.com/repos/erlang/otp/releases/assets/26783277" +install = "source" diff --git a/mise.toml b/mise.toml new file mode 100644 index 0000000..13fa760 --- /dev/null +++ b/mise.toml @@ -0,0 +1,3 @@ +[tools] +elixir = "1.13.0" +erlang = "22.3.4.7" From 620be1c4785e3d4538f7f35f8a2bc724044bf66d Mon Sep 17 00:00:00 2001 From: Krukon Date: Wed, 26 Aug 2026 11:12:25 +0200 Subject: [PATCH 2/5] fix: bump Erlang to 24.3.4.17, OTP 22.3.4.7 can't build on ubuntu-24.04 mise install --locked failed in CI ("erlang@22.3.4.7 is not in the lockfile"). Root cause: OTP 22.3.4.7 has no ubuntu-24.04 hex.pm precompiled build and mise's core:erlang backend only ever builds it from source for this version -- that source build fails compiling the crypto app's OpenSSL engine against ubuntu-24.04's OpenSSL 3.x (pkey.o link error), reproduced directly on an ubuntu:24.04 container. Bumped erlang to 24.3.4.17 (latest OTP 24 patch, still within Elixir 1.13's supported OTP 22-24 range and mix.exs's `elixir: "~> 1.13"` constraint) and regenerated mise.lock. Elixir stays at 1.13.0. Updated the CI/dev-publish workflows' OTP_VERSION/matrix values to match (dev-publish.yaml's OTP_VERSION was also separately out of sync at 23.3.4.7 -- aligned to the same pin). Verified in a real ubuntu:24.04 container: mise install --locked, mix format --check-formatted, mix compile --warnings-as-errors, and mix test --cover (38/38 passing) all succeed against the new pin. Claude Code fix, part of the chore/add-mise-lock fleet rollout. Co-Authored-By: Claude Sonnet 5 --- .github/workflows/ci.yaml | 6 ++--- .github/workflows/dev-publish.yaml | 2 +- mise.lock | 38 +++++++++++++++--------------- mise.toml | 2 +- 4 files changed, 24 insertions(+), 24 deletions(-) diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index f8f3ae4..3631241 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -4,7 +4,7 @@ env: DEPENDENCY_FILE: mix.lock ELIXIR_VERSION: 1.13.0 # Elixir version used during package publishing JOB_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }} - OTP_VERSION: 22.3.4.7 # OTP version used during package publishing + OTP_VERSION: 24.3.4.17 # OTP version used during package publishing RELEVANT_FILES: "config lib test mix.exs mix.lock" # Important, this controls the caching, make sure to keep this right REPOSITORY: libcluster RUNNER_OS: ubuntu20 # Must match Elixir/OTP version in described in action erlef/setup-beam@fc68ffb90438ef2936bbb3251622353b3dcb2f93 # v1 @@ -30,7 +30,7 @@ jobs: strategy: fail-fast: false matrix: - otp: [22.3.4.7] + otp: [24.3.4.17] elixir: [1.13.0] runner-os: [ubuntu20] steps: @@ -99,7 +99,7 @@ jobs: strategy: fail-fast: false matrix: - otp: [22.3.4.7] + otp: [24.3.4.17] elixir: [1.13.0] runner-os: [ubuntu20] steps: diff --git a/.github/workflows/dev-publish.yaml b/.github/workflows/dev-publish.yaml index e91d263..d5061ba 100644 --- a/.github/workflows/dev-publish.yaml +++ b/.github/workflows/dev-publish.yaml @@ -4,7 +4,7 @@ env: DEPENDENCY_FILE: mix.lock ELIXIR_VERSION: 1.13.0 # Elixir version used during package publishing JOB_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }} - OTP_VERSION: 23.3.4.7 # OTP version used during package publishing + OTP_VERSION: 24.3.4.17 # OTP version used during package publishing RELEVANT_FILES: "config lib test mix.exs mix.lock" # Important, this controls the caching, make sure to keep this right REPOSITORY: libcluster RUNNER_OS: ubuntu20 # Must match Elixir/OTP version in described in action erlef/setup-beam@fc68ffb90438ef2936bbb3251622353b3dcb2f93 # v1 diff --git a/mise.lock b/mise.lock index f357302..a2db00c 100644 --- a/mise.lock +++ b/mise.lock @@ -13,7 +13,7 @@ checksum = "sha256:9b07613dec0fc57a9efb8c50e9141def77ba4029e6b1d012a2132c7048589 url = "https://builds.hex.pm/builds/elixir/v1.13.0.zip" [tools.elixir."platforms.linux-x64"] -checksum = "sha256:9b07613dec0fc57a9efb8c50e9141def77ba4029e6b1d012a2132c70485894af" +checksum = "blake3:66bfd093f63b9e826f144d8c4e81afd59c302e96cc2779ad4aaee00067870228" url = "https://builds.hex.pm/builds/elixir/v1.13.0.zip" [tools.elixir."platforms.linux-x64-musl"] @@ -33,47 +33,47 @@ checksum = "sha256:9b07613dec0fc57a9efb8c50e9141def77ba4029e6b1d012a2132c7048589 url = "https://builds.hex.pm/builds/elixir/v1.13.0.zip" [[tools.erlang]] -version = "22.3.4.7" +version = "24.3.4.17" backend = "core:erlang" [tools.erlang.options] -precompiled_os = "ubuntu-22.04" +precompiled_os = "ubuntu-24.04" [tools.erlang."platforms.linux-arm64"] -url = "https://github.com/erlang/otp/releases/download/OTP-22.3.4.7/otp_src_22.3.4.7.tar.gz" -url_api = "https://api.github.com/repos/erlang/otp/releases/assets/26783277" +url = "https://github.com/erlang/otp/releases/download/OTP-24.3.4.17/otp_src_24.3.4.17.tar.gz" +url_api = "https://api.github.com/repos/erlang/otp/releases/assets/167108697" install = "source" [tools.erlang."platforms.linux-x64"] -url = "https://github.com/erlang/otp/releases/download/OTP-22.3.4.7/otp_src_22.3.4.7.tar.gz" -url_api = "https://api.github.com/repos/erlang/otp/releases/assets/26783277" +checksum = "blake3:2d9fc91eebc66b0f649551215cad0a413662262d360ad86ab2a51634343a4c66" +url = "https://github.com/erlang/otp/releases/download/OTP-24.3.4.17/otp_src_24.3.4.17.tar.gz" +url_api = "https://api.github.com/repos/erlang/otp/releases/assets/167108697" install = "source" [[tools.erlang]] -version = "22.3.4.7" +version = "24.3.4.17" backend = "core:erlang" [tools.erlang."platforms.linux-arm64-musl"] -url = "https://github.com/erlang/otp/releases/download/OTP-22.3.4.7/otp_src_22.3.4.7.tar.gz" -url_api = "https://api.github.com/repos/erlang/otp/releases/assets/26783277" +url = "https://github.com/erlang/otp/releases/download/OTP-24.3.4.17/otp_src_24.3.4.17.tar.gz" +url_api = "https://api.github.com/repos/erlang/otp/releases/assets/167108697" install = "source" [tools.erlang."platforms.linux-x64-musl"] -url = "https://github.com/erlang/otp/releases/download/OTP-22.3.4.7/otp_src_22.3.4.7.tar.gz" -url_api = "https://api.github.com/repos/erlang/otp/releases/assets/26783277" +url = "https://github.com/erlang/otp/releases/download/OTP-24.3.4.17/otp_src_24.3.4.17.tar.gz" +url_api = "https://api.github.com/repos/erlang/otp/releases/assets/167108697" install = "source" [tools.erlang."platforms.macos-arm64"] -url = "https://github.com/erlang/otp/releases/download/OTP-22.3.4.7/otp_src_22.3.4.7.tar.gz" -url_api = "https://api.github.com/repos/erlang/otp/releases/assets/26783277" +url = "https://github.com/erlang/otp/releases/download/OTP-24.3.4.17/otp_src_24.3.4.17.tar.gz" +url_api = "https://api.github.com/repos/erlang/otp/releases/assets/167108697" install = "source" [tools.erlang."platforms.macos-x64"] -url = "https://github.com/erlang/otp/releases/download/OTP-22.3.4.7/otp_src_22.3.4.7.tar.gz" -url_api = "https://api.github.com/repos/erlang/otp/releases/assets/26783277" +url = "https://github.com/erlang/otp/releases/download/OTP-24.3.4.17/otp_src_24.3.4.17.tar.gz" +url_api = "https://api.github.com/repos/erlang/otp/releases/assets/167108697" install = "source" [tools.erlang."platforms.windows-x64"] -url = "https://github.com/erlang/otp/releases/download/OTP-22.3.4.7/otp_src_22.3.4.7.tar.gz" -url_api = "https://api.github.com/repos/erlang/otp/releases/assets/26783277" -install = "source" +url = "https://github.com/erlang/otp/releases/download/OTP-24.3.4.17/otp_win64_24.3.4.17.zip" +url_api = "https://api.github.com/repos/erlang/otp/releases/assets/192554761" diff --git a/mise.toml b/mise.toml index 13fa760..e4ee9e4 100644 --- a/mise.toml +++ b/mise.toml @@ -1,3 +1,3 @@ [tools] elixir = "1.13.0" -erlang = "22.3.4.7" +erlang = "24.3.4.17" From 67748b33a9c94b8e05d336d588a85ca1f4c1953a Mon Sep 17 00:00:00 2001 From: Krukon Date: Wed, 26 Aug 2026 11:22:40 +0200 Subject: [PATCH 3/5] chore: refresh mise.lock to lockfile_version=1, pin mise-action to 2026.8.12 Pins step-security/mise-action to v4.2.4 (mise CLI 2026.8.12) and regenerates mise.lock to the versioned lockfile format mise 2026.8.11+ requires. Co-Authored-By: Claude Sonnet 5 --- .github/workflows/ci.yaml | 12 +++++++++--- .github/workflows/dev-publish.yaml | 4 +++- mise.lock | 7 ++++++- 3 files changed, 18 insertions(+), 5 deletions(-) diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index 3631241..1fa5bc2 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -47,7 +47,9 @@ jobs: clean: false persist-credentials: true - name: Setup mise - uses: step-security/mise-action@2796166110dee826668caddd4bffedae5116e7cd # v4.2.0 + uses: step-security/mise-action@6e96d2ffbc65c037f23c78818f2a339d6cf830f7 # v4.2.4 + with: + version: '2026.8.12' - name: Get SHA sum (HASH) of relevant files id: hash run: | @@ -116,7 +118,9 @@ jobs: clean: false persist-credentials: true - name: Setup mise - uses: step-security/mise-action@2796166110dee826668caddd4bffedae5116e7cd # v4.2.0 + uses: step-security/mise-action@6e96d2ffbc65c037f23c78818f2a339d6cf830f7 # v4.2.4 + with: + version: '2026.8.12' - name: Get SHA sum (HASH) of relevant files id: hash run: | @@ -232,7 +236,9 @@ jobs: clean: false persist-credentials: true - name: Setup mise - uses: step-security/mise-action@2796166110dee826668caddd4bffedae5116e7cd # v4.2.0 + uses: step-security/mise-action@6e96d2ffbc65c037f23c78818f2a339d6cf830f7 # v4.2.4 + with: + version: '2026.8.12' - name: Hex auth run: mix hex.organization auth fresha --key ${{ secrets.HEX_ORGANIZATION_WRITE_KEY }} shell: bash diff --git a/.github/workflows/dev-publish.yaml b/.github/workflows/dev-publish.yaml index d5061ba..5d4cd9c 100644 --- a/.github/workflows/dev-publish.yaml +++ b/.github/workflows/dev-publish.yaml @@ -50,7 +50,9 @@ jobs: path: approval.txt fail-on-cache-miss: true - name: Setup mise - uses: step-security/mise-action@2796166110dee826668caddd4bffedae5116e7cd # v4.2.0 + uses: step-security/mise-action@6e96d2ffbc65c037f23c78818f2a339d6cf830f7 # v4.2.4 + with: + version: '2026.8.12' - name: Hex auth run: mix hex.organization auth fresha --key ${{ secrets.HEX_ORGANIZATION_WRITE_KEY }} shell: bash diff --git a/mise.lock b/mise.lock index a2db00c..d5d6494 100644 --- a/mise.lock +++ b/mise.lock @@ -1,8 +1,11 @@ # @generated - this file is auto-generated by `mise lock` https://mise.jdx.dev/dev-tools/mise-lock.html +lockfile_version = 1 + [[tools.elixir]] version = "1.13.0" backend = "core:elixir" +specifiers = ["1.13.0"] [tools.elixir."platforms.linux-arm64"] checksum = "sha256:9b07613dec0fc57a9efb8c50e9141def77ba4029e6b1d012a2132c70485894af" @@ -13,7 +16,7 @@ checksum = "sha256:9b07613dec0fc57a9efb8c50e9141def77ba4029e6b1d012a2132c7048589 url = "https://builds.hex.pm/builds/elixir/v1.13.0.zip" [tools.elixir."platforms.linux-x64"] -checksum = "blake3:66bfd093f63b9e826f144d8c4e81afd59c302e96cc2779ad4aaee00067870228" +checksum = "sha256:9b07613dec0fc57a9efb8c50e9141def77ba4029e6b1d012a2132c70485894af" url = "https://builds.hex.pm/builds/elixir/v1.13.0.zip" [tools.elixir."platforms.linux-x64-musl"] @@ -35,6 +38,7 @@ url = "https://builds.hex.pm/builds/elixir/v1.13.0.zip" [[tools.erlang]] version = "24.3.4.17" backend = "core:erlang" +specifiers = ["24.3.4.17"] [tools.erlang.options] precompiled_os = "ubuntu-24.04" @@ -53,6 +57,7 @@ install = "source" [[tools.erlang]] version = "24.3.4.17" backend = "core:erlang" +specifiers = ["24.3.4.17"] [tools.erlang."platforms.linux-arm64-musl"] url = "https://github.com/erlang/otp/releases/download/OTP-24.3.4.17/otp_src_24.3.4.17.tar.gz" From b3d9bf5461997e564686a160a2da20f0c6cbbe12 Mon Sep 17 00:00:00 2001 From: Krukon Date: Wed, 26 Aug 2026 12:40:26 +0200 Subject: [PATCH 4/5] fix(ci): remove pointless hex.pm org auth from static/test jobs HEX_ORGANIZATION_WRITE_KEY was removed and won't be restored. The `mix hex.organization auth fresha` step only exists to let `mix deps.get` fetch private packages, but every dependency in mix.exs (ex_doc, dialyxir, exvcr, jason, telemetry) is a public hex.pm package, so the auth step is unnecessary and was failing CI with an empty key. --- .github/workflows/ci.yaml | 4 ---- 1 file changed, 4 deletions(-) diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index 1fa5bc2..ce81b37 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -58,8 +58,6 @@ jobs: HASH="$(git ls-tree ${{ env.SHA }} -- ${{ env.RELEVANT_FILES }} | sha1sum | cut -d' ' -f1)" echo "BUILD HASH FOR THE CODEBASE IS: $HASH" echo "HASH=$HASH" >> $GITHUB_OUTPUT - - name: Hex auth - run: mix hex.organization auth fresha --key ${{ secrets.HEX_ORGANIZATION_WRITE_KEY }} - uses: step-security/runs-on-cache@c5b0cba15d05488ebc630ad8d1e95b3d9b35ac73 # v5.0.7 id: deps-cache with: @@ -129,8 +127,6 @@ jobs: HASH="$(git ls-tree ${{ env.SHA }} -- ${{ env.RELEVANT_FILES }} | sha1sum | cut -d' ' -f1)" echo "BUILD HASH FOR THE CODEBASE IS: $HASH" echo "HASH=$HASH" >> $GITHUB_OUTPUT - - name: Hex auth - run: mix hex.organization auth fresha --key ${{ secrets.HEX_ORGANIZATION_WRITE_KEY }} - uses: step-security/runs-on-cache@c5b0cba15d05488ebc630ad8d1e95b3d9b35ac73 # v5.0.7 id: deps-cache with: From a79d7dd30b2206188b06cb01ec8f936637984b37 Mon Sep 17 00:00:00 2001 From: Krukon Date: Wed, 26 Aug 2026 15:58:06 +0200 Subject: [PATCH 5/5] fix: bootstrap Hex + Rebar after Setup mise step-security/mise-action doesn't bootstrap Hex/rebar the way the old erlef/setup-beam action did, so mix deps.get fails immediately with "Could not find Hex, which is needed to build dependency :ex_doc" in the static and test jobs. Add mix local.hex --force / mix local.rebar --force after Setup mise in static, test, and publish (which has the same gap and would hit it too once triggered on a push to master). Addresses review feedback from dyl-sv on PR #13. --- .github/workflows/ci.yaml | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index ce81b37..83c6df9 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -50,6 +50,10 @@ jobs: uses: step-security/mise-action@6e96d2ffbc65c037f23c78818f2a339d6cf830f7 # v4.2.4 with: version: '2026.8.12' + - name: Install Hex + Rebar + run: | + mix local.hex --force + mix local.rebar --force - name: Get SHA sum (HASH) of relevant files id: hash run: | @@ -119,6 +123,10 @@ jobs: uses: step-security/mise-action@6e96d2ffbc65c037f23c78818f2a339d6cf830f7 # v4.2.4 with: version: '2026.8.12' + - name: Install Hex + Rebar + run: | + mix local.hex --force + mix local.rebar --force - name: Get SHA sum (HASH) of relevant files id: hash run: | @@ -235,6 +243,10 @@ jobs: uses: step-security/mise-action@6e96d2ffbc65c037f23c78818f2a339d6cf830f7 # v4.2.4 with: version: '2026.8.12' + - name: Install Hex + Rebar + run: | + mix local.hex --force + mix local.rebar --force - name: Hex auth run: mix hex.organization auth fresha --key ${{ secrets.HEX_ORGANIZATION_WRITE_KEY }} shell: bash