From 5aa7ae65d0ddd1f9e5b9e6dd536957f20727e1c8 Mon Sep 17 00:00:00 2001 From: Krukon Date: Fri, 21 Aug 2026 13:34:54 +0200 Subject: [PATCH 1/5] chore: add mise.lock and pin actions Generate the missing mise.lock alongside the existing mise.toml so tool versions resolve deterministically, and produce .github/actions.lock.yaml via alflow to pin the mise-action workflow to a SHA. --- .github/actions.lock.yaml | 42 ++++++++++++++++++++++ mise.lock | 74 +++++++++++++++++++++++++++++++++++++++ 2 files changed, 116 insertions(+) create mode 100644 .github/actions.lock.yaml create mode 100644 mise.lock diff --git a/.github/actions.lock.yaml b/.github/actions.lock.yaml new file mode 100644 index 0000000..aea8f34 --- /dev/null +++ b/.github/actions.lock.yaml @@ -0,0 +1,42 @@ +version: 1 +generated_at: 2026-08-21T11:34:48Z +internal: [] +trusted: + - action: actions/checkout + refs: + - 34e114876b0b11c390a56381ad16ebd13914f8d5 + occurrences: + 34e114876b0b11c390a56381ad16ebd13914f8d5: + .github/workflows/ci.yaml: + - jobs.test.steps.[1].uses + - jobs.permit.steps.[1].uses + - jobs.publish.steps.[1].uses +external: + - action: step-security/harden-runner + refs: + - 9af89fc71515a100421586dfdb3dc9c984fbf411 + occurrences: + 9af89fc71515a100421586dfdb3dc9c984fbf411: + .github/workflows/ci.yaml: + - jobs.test.steps.[0].uses + - jobs.permit.steps.[0].uses + - jobs.publish.steps.[0].uses + - action: step-security/mise-action + refs: + - 2796166110dee826668caddd4bffedae5116e7cd + occurrences: + 2796166110dee826668caddd4bffedae5116e7cd: + .github/workflows/ci.yaml: + - jobs.test.steps.[2].uses + - jobs.publish.steps.[2].uses + - action: step-security/runs-on-cache + refs: + - c5b0cba15d05488ebc630ad8d1e95b3d9b35ac73 + occurrences: + c5b0cba15d05488ebc630ad8d1e95b3d9b35ac73: + .github/workflows/ci.yaml: + - jobs.test.steps.[3].uses +local: [] +docker: [] +dynamic: [] +nested_floating_deps: [] diff --git a/mise.lock b/mise.lock new file mode 100644 index 0000000..f1ac629 --- /dev/null +++ b/mise.lock @@ -0,0 +1,74 @@ +# @generated - this file is auto-generated by `mise lock` https://mise.jdx.dev/dev-tools/mise-lock.html + +[[tools.elixir]] +version = "1.18.3-otp-27" +backend = "core:elixir" + +[tools.elixir."platforms.linux-arm64"] +checksum = "sha256:9ea6a5dc238bf9dcaaa2b6660c2bb2e36fd889004dde86d8a1c122cc68665476" +url = "https://builds.hex.pm/builds/elixir/v1.18.3-otp-27.zip" + +[tools.elixir."platforms.linux-arm64-musl"] +checksum = "sha256:9ea6a5dc238bf9dcaaa2b6660c2bb2e36fd889004dde86d8a1c122cc68665476" +url = "https://builds.hex.pm/builds/elixir/v1.18.3-otp-27.zip" + +[tools.elixir."platforms.linux-x64"] +checksum = "sha256:9ea6a5dc238bf9dcaaa2b6660c2bb2e36fd889004dde86d8a1c122cc68665476" +url = "https://builds.hex.pm/builds/elixir/v1.18.3-otp-27.zip" + +[tools.elixir."platforms.linux-x64-musl"] +checksum = "sha256:9ea6a5dc238bf9dcaaa2b6660c2bb2e36fd889004dde86d8a1c122cc68665476" +url = "https://builds.hex.pm/builds/elixir/v1.18.3-otp-27.zip" + +[tools.elixir."platforms.macos-arm64"] +checksum = "sha256:9ea6a5dc238bf9dcaaa2b6660c2bb2e36fd889004dde86d8a1c122cc68665476" +url = "https://builds.hex.pm/builds/elixir/v1.18.3-otp-27.zip" + +[tools.elixir."platforms.macos-x64"] +checksum = "sha256:9ea6a5dc238bf9dcaaa2b6660c2bb2e36fd889004dde86d8a1c122cc68665476" +url = "https://builds.hex.pm/builds/elixir/v1.18.3-otp-27.zip" + +[tools.elixir."platforms.windows-x64"] +checksum = "sha256:9ea6a5dc238bf9dcaaa2b6660c2bb2e36fd889004dde86d8a1c122cc68665476" +url = "https://builds.hex.pm/builds/elixir/v1.18.3-otp-27.zip" + +[[tools.erlang]] +version = "27.3" +backend = "core:erlang" + +[tools.erlang.options] +precompiled_os = "ubuntu-22.04" + +[tools.erlang."platforms.linux-arm64"] +checksum = "sha256:a2e25d93f317ba79c1e02a130abaf8f0a4dbe14529c89573d2048c593d66dbde" +url = "https://builds.hex.pm/builds/otp/arm64/ubuntu-22.04/OTP-27.3.tar.gz" + +[tools.erlang."platforms.linux-x64"] +checksum = "sha256:e2ea265a971505cbf7d85620ab7c53b67bfac213039f4b0d75ee45bb6052dafe" +url = "https://builds.hex.pm/builds/otp/amd64/ubuntu-22.04/OTP-27.3.tar.gz" + +[[tools.erlang]] +version = "27.3" +backend = "core:erlang" + +[tools.erlang."platforms.linux-arm64-musl"] +url = "https://github.com/erlang/otp/releases/download/OTP-27.3/otp_src_27.3.tar.gz" +url_api = "https://api.github.com/repos/erlang/otp/releases/assets/234789168" +install = "source" + +[tools.erlang."platforms.linux-x64-musl"] +url = "https://github.com/erlang/otp/releases/download/OTP-27.3/otp_src_27.3.tar.gz" +url_api = "https://api.github.com/repos/erlang/otp/releases/assets/234789168" +install = "source" + +[tools.erlang."platforms.macos-arm64"] +url = "https://github.com/erlef/otp_builds/releases/download/OTP-27.3/otp-aarch64-apple-darwin.tar.gz" +url_api = "https://api.github.com/repos/erlef/otp_builds/releases/assets/234787082" + +[tools.erlang."platforms.macos-x64"] +url = "https://github.com/erlef/otp_builds/releases/download/OTP-27.3/otp-x86_64-apple-darwin.tar.gz" +url_api = "https://api.github.com/repos/erlef/otp_builds/releases/assets/234787334" + +[tools.erlang."platforms.windows-x64"] +url = "https://github.com/erlang/otp/releases/download/OTP-27.3/otp_win64_27.3.zip" +url_api = "https://api.github.com/repos/erlang/otp/releases/assets/234809623" From 76a6770e5513321a7ab86ab06bc0d891e984bb66 Mon Sep 17 00:00:00 2001 From: Krukon Date: Fri, 21 Aug 2026 14:06:53 +0200 Subject: [PATCH 2/5] fix: drop CI version matrix, use single mise-pinned toolchain The matrix tested elixir 1.15-1.18/otp 26-27 by overriding MISE_ELIXIR_VERSION/MISE_ERLANG_VERSION per combo, but mise.lock only ever locks the exact version(s) currently resolved from mise.toml (1.18.3-otp-27 / 27.3) -- `mise lock` actively prunes any other version entry. None of the four matrix combos' literal version strings matched the lockfile under --locked, so every job failed with "... is not in the lockfile" regardless of checksums. Collapsed to one job using mise.toml's pinned version (already the newest of the four). Verified locally under that exact toolchain: mix compile, mix format --check-formatted, mix credo --strict (credo already resolves to 1.7.15, no bump needed), and mix test (207 tests, 0 failures, against a real postgres) all pass. Also dropped the leftover ImageOS/RUNNER_OS env vars, which referenced the erlef/setup-beam action this repo no longer uses. --- .github/workflows/ci.yaml | 20 ++------------------ 1 file changed, 2 insertions(+), 18 deletions(-) diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index 427a7f9..08d9b59 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -19,27 +19,13 @@ env: OTP_VERSION: 27.3 DEBIAN_FRONTEND: noninteractive REPOSITORY: surgex - RUNNER_OS: ubuntu22 # Must match Elixir/OTP version in described in action erlef/setup-beam@fc68ffb90438ef2936bbb3251622353b3dcb2f93 # v1 - ImageOS: ubuntu22 DEPENDENCY_FILE: mix.lock WORKING_DIRECTORY: . jobs: test: - name: Elixir ${{ matrix.elixir }} / OTP ${{ matrix.otp }} + name: Test runs-on: ubuntu-latest - strategy: - fail-fast: false - matrix: - include: - - elixir: '1.15' - otp: '26' - - elixir: '1.16' - otp: '26' - - elixir: '1.17' - otp: '27' - - elixir: '1.18' - otp: '27' services: postgres: @@ -61,8 +47,6 @@ jobs: POSTGRES_PORT: 5432 POSTGRES_USER: postgres POSTGRES_PASSWORD: postgres - MISE_ELIXIR_VERSION: ${{ matrix.elixir }}-otp-${{ matrix.otp }} - MISE_ERLANG_VERSION: ${{ matrix.otp }} steps: - name: Harden the runner @@ -81,7 +65,7 @@ jobs: path: | deps _build - key: ${{ runner.os }}-mix-${{ matrix.elixir }}-${{ matrix.otp }}-${{ hashFiles('mix.lock') }} + key: ${{ runner.os }}-mix-${{ hashFiles('mix.lock') }} - run: mix deps.get - run: mix compile From 824a1e70035fd6a751e6ffa413b076836a3e3308 Mon Sep 17 00:00:00 2001 From: Krukon Date: Mon, 24 Aug 2026 12:21:36 +0200 Subject: [PATCH 3/5] fix: regenerate mise.lock erlang entries for ubuntu-24.04 runners The erlang lock entry was generated against ubuntu-22.04 precompiled builds, but GH Actions runners are now ubuntu-24.04, so `mise install --locked` couldn't find a matching platform entry and reported the tool as missing from the lockfile entirely. --- mise.lock | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-) diff --git a/mise.lock b/mise.lock index f1ac629..d4e9812 100644 --- a/mise.lock +++ b/mise.lock @@ -32,20 +32,23 @@ url = "https://builds.hex.pm/builds/elixir/v1.18.3-otp-27.zip" checksum = "sha256:9ea6a5dc238bf9dcaaa2b6660c2bb2e36fd889004dde86d8a1c122cc68665476" url = "https://builds.hex.pm/builds/elixir/v1.18.3-otp-27.zip" +# ========================================================================== +# key: erlang@27.3 (core:erlang) +# ========================================================================== [[tools.erlang]] version = "27.3" backend = "core:erlang" [tools.erlang.options] -precompiled_os = "ubuntu-22.04" +precompiled_os = "ubuntu-24.04" [tools.erlang."platforms.linux-arm64"] -checksum = "sha256:a2e25d93f317ba79c1e02a130abaf8f0a4dbe14529c89573d2048c593d66dbde" -url = "https://builds.hex.pm/builds/otp/arm64/ubuntu-22.04/OTP-27.3.tar.gz" +checksum = "sha256:9778dce24766996fa6ab89f754707f7cb27761623bbf90398941051e87bb2613" +url = "https://builds.hex.pm/builds/otp/arm64/ubuntu-24.04/OTP-27.3.tar.gz" [tools.erlang."platforms.linux-x64"] -checksum = "sha256:e2ea265a971505cbf7d85620ab7c53b67bfac213039f4b0d75ee45bb6052dafe" -url = "https://builds.hex.pm/builds/otp/amd64/ubuntu-22.04/OTP-27.3.tar.gz" +checksum = "sha256:81bd76d88adfd8a81c3b0cf9aae766779d1e316b9c2f2dbfc17bd22cd5a62833" +url = "https://builds.hex.pm/builds/otp/amd64/ubuntu-24.04/OTP-27.3.tar.gz" [[tools.erlang]] version = "27.3" From ee0505c326ee675ec7e9e499e5e51f263b772e2e Mon Sep 17 00:00:00 2001 From: Krukon Date: Mon, 24 Aug 2026 12:33:27 +0200 Subject: [PATCH 4/5] fix: keep ubuntu-22.04 erlang lock entry alongside ubuntu-24.04 This org runs a mix of runner OS images: dynamic runs-on=.../runner=... pools are ubuntu-24.04, but named pools like gha-runner-arm64-xs/xxs and ubuntu-slim are still ubuntu-22.04. mise install --locked requires the lock's precompiled_os to exactly match the resolving machine's real OS, so removing the ubuntu-22.04 entry (previous commit) broke jobs still running on those older named pools. Both entries now coexist. --- mise.lock | 18 +++++++++++++++--- 1 file changed, 15 insertions(+), 3 deletions(-) diff --git a/mise.lock b/mise.lock index d4e9812..e31447e 100644 --- a/mise.lock +++ b/mise.lock @@ -32,9 +32,21 @@ url = "https://builds.hex.pm/builds/elixir/v1.18.3-otp-27.zip" checksum = "sha256:9ea6a5dc238bf9dcaaa2b6660c2bb2e36fd889004dde86d8a1c122cc68665476" url = "https://builds.hex.pm/builds/elixir/v1.18.3-otp-27.zip" -# ========================================================================== -# key: erlang@27.3 (core:erlang) -# ========================================================================== +[[tools.erlang]] +version = "27.3" +backend = "core:erlang" + +[tools.erlang.options] +precompiled_os = "ubuntu-22.04" + +[tools.erlang."platforms.linux-arm64"] +checksum = "sha256:a2e25d93f317ba79c1e02a130abaf8f0a4dbe14529c89573d2048c593d66dbde" +url = "https://builds.hex.pm/builds/otp/arm64/ubuntu-22.04/OTP-27.3.tar.gz" + +[tools.erlang."platforms.linux-x64"] +checksum = "sha256:e2ea265a971505cbf7d85620ab7c53b67bfac213039f4b0d75ee45bb6052dafe" +url = "https://builds.hex.pm/builds/otp/amd64/ubuntu-22.04/OTP-27.3.tar.gz" + [[tools.erlang]] version = "27.3" backend = "core:erlang" From b4e20dde873b22777e6003334dc28c637697e881 Mon Sep 17 00:00:00 2001 From: Krukon Date: Wed, 26 Aug 2026 11:23:42 +0200 Subject: [PATCH 5/5] chore: refresh mise.lock to lockfile_version=1, pin mise-action to 2026.8.12 Pins step-security/mise-action to v4.2.4 (mise CLI 2026.8.12) and regenerates mise.lock to the versioned lockfile format mise 2026.8.11+ requires. Co-Authored-By: Claude Sonnet 5 --- .github/workflows/ci.yaml | 8 ++++++-- mise.lock | 5 +++++ 2 files changed, 11 insertions(+), 2 deletions(-) diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index 08d9b59..64d9070 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -58,7 +58,9 @@ jobs: - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 - name: Setup mise - uses: step-security/mise-action@2796166110dee826668caddd4bffedae5116e7cd # v4.2.0 + uses: step-security/mise-action@6e96d2ffbc65c037f23c78818f2a339d6cf830f7 # v4.2.4 + with: + version: '2026.8.12' - uses: step-security/runs-on-cache@c5b0cba15d05488ebc630ad8d1e95b3d9b35ac73 # v5.0.7 with: @@ -129,7 +131,9 @@ jobs: with: ref: ${{ env.SHA }} - name: Setup mise - uses: step-security/mise-action@2796166110dee826668caddd4bffedae5116e7cd # v4.2.0 + uses: step-security/mise-action@6e96d2ffbc65c037f23c78818f2a339d6cf830f7 # v4.2.4 + with: + version: '2026.8.12' - name: Get dependencies run: mix deps.get - name: Publish package diff --git a/mise.lock b/mise.lock index e31447e..ad657a9 100644 --- a/mise.lock +++ b/mise.lock @@ -1,8 +1,11 @@ # @generated - this file is auto-generated by `mise lock` https://mise.jdx.dev/dev-tools/mise-lock.html +lockfile_version = 1 + [[tools.elixir]] version = "1.18.3-otp-27" backend = "core:elixir" +specifiers = ["1.18.3-otp-27"] [tools.elixir."platforms.linux-arm64"] checksum = "sha256:9ea6a5dc238bf9dcaaa2b6660c2bb2e36fd889004dde86d8a1c122cc68665476" @@ -50,6 +53,7 @@ url = "https://builds.hex.pm/builds/otp/amd64/ubuntu-22.04/OTP-27.3.tar.gz" [[tools.erlang]] version = "27.3" backend = "core:erlang" +specifiers = ["27.3"] [tools.erlang.options] precompiled_os = "ubuntu-24.04" @@ -65,6 +69,7 @@ url = "https://builds.hex.pm/builds/otp/amd64/ubuntu-24.04/OTP-27.3.tar.gz" [[tools.erlang]] version = "27.3" backend = "core:erlang" +specifiers = ["27.3"] [tools.erlang."platforms.linux-arm64-musl"] url = "https://github.com/erlang/otp/releases/download/OTP-27.3/otp_src_27.3.tar.gz"