From f7cdbddbd8e9bd1c67ce9a3b7b81b16af9c37ce6 Mon Sep 17 00:00:00 2001 From: Krukon Date: Tue, 4 Aug 2026 15:15:37 +0200 Subject: [PATCH 1/4] Use stepsecurity/mise-action for tool installation instead of per-language setup-X actions Replaces erlef/setup-beam with step-security/mise-action, per the org's mise migration. The test job's elixir/otp compatibility matrix (1.15/26 through 1.18/27) is preserved via MISE_ELIXIR_VERSION/ MISE_ERLANG_VERSION env overrides driven by the matrix values. The publish job's env.ELIXIR_VERSION/env.OTP_VERSION (1.18.3/27.3) exactly match mise.toml, so it's a plain swap. --- .github/workflows/ci.yaml | 16 +++++++--------- 1 file changed, 7 insertions(+), 9 deletions(-) diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index c92cb28..cec52a1 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -71,10 +71,11 @@ jobs: - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 - - uses: erlef/setup-beam@fc68ffb90438ef2936bbb3251622353b3dcb2f93 # v1 - with: - elixir-version: ${{ matrix.elixir }} - otp-version: ${{ matrix.otp }} + - name: Setup mise + uses: step-security/mise-action@2796166110dee826668caddd4bffedae5116e7cd # v4.2.0 + env: + MISE_ELIXIR_VERSION: ${{ matrix.elixir }} + MISE_ERLANG_VERSION: ${{ matrix.otp }} - uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4 with: @@ -143,11 +144,8 @@ jobs: - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 with: ref: ${{ env.SHA }} - - uses: erlef/setup-beam@fc68ffb90438ef2936bbb3251622353b3dcb2f93 # v1 - with: - elixir-version: ${{ env.ELIXIR_VERSION }} - otp-version: ${{ env.OTP_VERSION }} - version-type: strict + - name: Setup mise + uses: step-security/mise-action@2796166110dee826668caddd4bffedae5116e7cd # v4.2.0 - name: Get dependencies run: mix deps.get - name: Publish package From c2f96c9fd28900f23ccc1710a389e2c1517ef982 Mon Sep 17 00:00:00 2001 From: Krukon Date: Tue, 4 Aug 2026 15:15:44 +0200 Subject: [PATCH 2/4] Bump internal GHAs Regenerates .github/actions.lock.yaml and bumps any internal freshaengineering/* action pins picked up by alflow. --- .github/actions.lock.yaml | 26 ++++++++++++++++++-------- 1 file changed, 18 insertions(+), 8 deletions(-) diff --git a/.github/actions.lock.yaml b/.github/actions.lock.yaml index c7ab75a..98540bd 100644 --- a/.github/actions.lock.yaml +++ b/.github/actions.lock.yaml @@ -1,5 +1,5 @@ version: 1 -generated_at: 2026-06-11T15:40:51Z +generated_at: 2026-08-04T13:15:44Z internal: [] trusted: - action: actions/cache @@ -8,25 +8,35 @@ trusted: occurrences: 0057852bfaa89a56745cba8c7296529d2fc39830: .github/workflows/ci.yaml: - - jobs.test.steps.[2].uses + - jobs.test.steps.[3].uses - action: actions/checkout refs: - 34e114876b0b11c390a56381ad16ebd13914f8d5 occurrences: 34e114876b0b11c390a56381ad16ebd13914f8d5: + .github/workflows/ci.yaml: + - jobs.test.steps.[1].uses + - jobs.permit.steps.[1].uses + - jobs.publish.steps.[1].uses +external: + - action: step-security/harden-runner + refs: + - 9af89fc71515a100421586dfdb3dc9c984fbf411 + occurrences: + 9af89fc71515a100421586dfdb3dc9c984fbf411: .github/workflows/ci.yaml: - jobs.test.steps.[0].uses - jobs.permit.steps.[0].uses - jobs.publish.steps.[0].uses -external: - - action: erlef/setup-beam + - action: step-security/mise-action refs: - - fc68ffb90438ef2936bbb3251622353b3dcb2f93 + - 2796166110dee826668caddd4bffedae5116e7cd occurrences: - fc68ffb90438ef2936bbb3251622353b3dcb2f93: + 2796166110dee826668caddd4bffedae5116e7cd: .github/workflows/ci.yaml: - - jobs.test.steps.[1].uses - - jobs.publish.steps.[1].uses + - jobs.test.steps.[2].uses + - jobs.publish.steps.[2].uses local: [] docker: [] dynamic: [] +nested_floating_deps: [] From 52620fac5c215eed57543b10dcc503f159ccc871 Mon Sep 17 00:00:00 2001 From: Krukon Date: Mon, 10 Aug 2026 13:18:23 +0200 Subject: [PATCH 3/4] Pin elixir with explicit -otp-N suffix to match declared erlang A bare "elixir = \"1.18\"" pin (or matrix override) makes mise fetch the newest OTP-linked precompiled build for that elixir line (e.g. 1.18.4-otp-28), ignoring any co-pinned/co-overridden erlang version entirely. When the actual OTP installed is older, the fetched elixir binary refuses to boot: Failed to load module 'elixir' because it requires a more recent Erlang/OTP version... Fix: suffix the elixir version with -otp- everywhere it's declared or overridden, so mise resolves a build actually compiled against the OTP version in use. Co-Authored-By: Claude Sonnet 5 --- .github/workflows/ci.yaml | 2 +- mise.toml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index 948a30f..7c74469 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -74,7 +74,7 @@ jobs: - name: Setup mise uses: step-security/mise-action@2796166110dee826668caddd4bffedae5116e7cd # v4.2.0 env: - MISE_ELIXIR_VERSION: ${{ matrix.elixir }} + MISE_ELIXIR_VERSION: ${{ matrix.elixir }}-otp-${{ matrix.otp }} MISE_ERLANG_VERSION: ${{ matrix.otp }} - uses: step-security/runs-on-cache@c5b0cba15d05488ebc630ad8d1e95b3d9b35ac73 # v5.0.7 diff --git a/mise.toml b/mise.toml index d59c439..0e58c51 100644 --- a/mise.toml +++ b/mise.toml @@ -1,3 +1,3 @@ [tools] -elixir = "1.18.3" +elixir = "1.18.3-otp-27" erlang = "27.3" From e5aac3d52741e7e28c9c4a6c9bc1a1df26a905ce Mon Sep 17 00:00:00 2001 From: Krukon Date: Mon, 10 Aug 2026 19:37:07 +0200 Subject: [PATCH 4/4] Fix CI: promote matrix env vars to job-level so they persist to later steps --- .github/workflows/ci.yaml | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index 7c74469..96b6e01 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -61,6 +61,8 @@ jobs: POSTGRES_PORT: 5432 POSTGRES_USER: postgres POSTGRES_PASSWORD: postgres + MISE_ELIXIR_VERSION: ${{ matrix.elixir }}-otp-${{ matrix.otp }} + MISE_ERLANG_VERSION: ${{ matrix.otp }} steps: - name: Harden the runner @@ -73,9 +75,6 @@ jobs: - name: Setup mise uses: step-security/mise-action@2796166110dee826668caddd4bffedae5116e7cd # v4.2.0 - env: - MISE_ELIXIR_VERSION: ${{ matrix.elixir }}-otp-${{ matrix.otp }} - MISE_ERLANG_VERSION: ${{ matrix.otp }} - uses: step-security/runs-on-cache@c5b0cba15d05488ebc630ad8d1e95b3d9b35ac73 # v5.0.7 with: