fix(ci): authenticate setup-beam's api.github.com lookups and correct the rebar3 rationale

[hyperpolymath]

What this fixes

elixir-ci-reusable.yml offers a rebar3-version input that cannot work reliably as shipped,
and documents it with a rationale that no longer applies. Consumers that set that input are pushed
onto unauthenticated api.github.com calls (setup-beam resolves the rebar3 version by listing
erlang/rebar3 releases) which are rate-limited on shared GitHub-hosted runner ranges. The visible
symptom is a setup-step failure within seconds, before any dependency work.

This is the cause of bofig's Elixir CI outage: the pin was added on 2026-06-24 and every run
since has died at Set up BEAM (OTP + Elixir) in 4–7 s, across both its wrapper and its legacy
local copy. bofig is fixed separately by removing the pin (rebar3 is not needed there).

The other half of the problem is the documentation: the input is described as "a workaround for the
OTP TLS key_usage_mismatch cert error on that host" (builds.hex.pm). That host's chain is clean
today — verified 2026-09-18: Let's Encrypt YR1 → Root YR → Root X1, correct Certificate Sign
key usage, valid to 2026-11-08. So the estate is steering consumers into a trap with a stale reason.

Changes

.github/workflows/elixir-ci-reusable.yml

• adds an optional github-token input (default "") forwarded to erlef/setup-beam, so a consumer
  with a genuine rebar-based dependency can authenticate the lookup;
• adds a guard step that raises ::warning:: when rebar3-version is set without github-token —
  warning, not failure, because whether the unauthenticated call is rate-limited depends on runner
  IP reputation, so hard-failing could break a consumer that is currently passing;
• rewrites both input descriptions to state what the input actually does (only rebar-based deps need
  it; it makes setup-beam use GitHub instead of mix local.rebar; it therefore requires the token),
  and records the 2026-09-18 verification date so the stale workaround is not re-added from memory.

CICD-WORKFLOW-CATALOG.md

• adds an Elixir note next to the workflow table, since this file is where a repo author decides what
  to adopt. Without it, the next repo re-adopts the same trap from documentation alone.

Compatibility and verification

• Additive: new optional input, default empty; no existing consumer is affected. Consumers pinned
  to older SHAs see no change at all.
• No permissions: change — a reusable must never widen the caller's permissions; an un-granted
  permission aborts the run as startup_failure with zero jobs (as the file's own comments record).
• No uses: change, so actions.lock needs no regeneration. Verified: the lock entry for this
  workflow and the file's real action refs are identical before and after.
• actionlint v1.7.7: clean on the modified file. (It did catch one real error during
  development — a secrets expression in an input description — which is fixed.)
• scripts/check-workflow-duplicate-keys.sh: 52 workflows clean.

I did not add an estate gate or a KNOWN_BAD_BEFORE entry: this defect only bites consumers that
set the input (one repo today), and the staleness checker's own header documents why fleet-wide reds
for conditional defects are a false-positive treadmill. The runtime warning is the proportionate guard.

[coderabbitai]

Note

Currently processing new changes in this PR. This may take a few minutes, please wait...

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 27b34ef3-68d7-42c2-8b27-5ea8ca127261

📥 Commits

Reviewing files that changed from the base of the PR and between a8a2bde and c36e246.

📒 Files selected for processing (2)

• .github/workflows/elixir-ci-reusable.yml
• CICD-WORKFLOW-CATALOG.md

 ______________________________________________________________________
< You used `any` like it's a life jacket. Spoiler: it's a pool noodle. >
 ----------------------------------------------------------------------
  \
   \   \
        \ /\
        ( )
      .( o ).

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud