From c36e246d44c6e6089154eceec1d483378d4cfd65 Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Sat, 19 Sep 2026 08:34:51 +0000 Subject: [PATCH] fix(ci): authenticate setup-beam's api.github.com lookups and correct the rebar3 rationale MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit `elixir-ci-reusable.yml` exposes a `rebar3-version` input that cannot work reliably as shipped. Setting it makes `erlef/setup-beam` resolve the version by listing `erlang/rebar3` releases on api.github.com and downloading the binary from GitHub releases — calls the action leaves unauthenticated unless it receives its own `github-token` input, which this reusable never forwarded and exposed no way to supply. Consumers that set the input therefore fail in the setup step within seconds, before any dependency work. bofig's Elixir CI has been red from 2026-06-24 (the day its pin landed) through 2026-09 for exactly this, across both its reusable wrapper and its legacy local copy. The rationale in the input's description was also stale: builds.hex.pm's chain was verified clean on 2026-09-18 (Let's Encrypt YR1 -> Root YR -> Root X1, with correct Certificate Sign key usage, valid to 2026-11-08), so the `key_usage_mismatch` workaround it documents no longer applies. - add an optional `github-token` input, forwarded to setup-beam - warn (not fail) when `rebar3-version` is set without it: the rate limit is conditional on runner IP reputation, so a hard failure could break a consumer that currently passes - rewrite both input descriptions to state what the input does and what it requires, recording the verification date so the workaround is not re-added from memory - add an Elixir note to CICD-WORKFLOW-CATALOG.md, where authors decide what to adopt No `uses:` change, so actions.lock needs no regeneration. actionlint-clean. --- .github/workflows/elixir-ci-reusable.yml | 28 ++++++++++++++++++++---- CICD-WORKFLOW-CATALOG.md | 10 +++++++++ 2 files changed, 34 insertions(+), 4 deletions(-) diff --git a/.github/workflows/elixir-ci-reusable.yml b/.github/workflows/elixir-ci-reusable.yml index 287417dfa..71191d7ed 100644 --- a/.github/workflows/elixir-ci-reusable.yml +++ b/.github/workflows/elixir-ci-reusable.yml @@ -76,10 +76,24 @@ on: default: "1.17" rebar3-version: description: >- - rebar3 version for erlef/setup-beam. When set, setup-beam installs - rebar3 from GitHub releases instead of letting `mix local.rebar` - fetch it from builds.hex.pm — a workaround for the OTP TLS - `key_usage_mismatch` cert error on that host. Empty = unchanged. + rebar3 version for erlef/setup-beam. ONLY set this when a dependency + is rebar-based; `mix` installs the rebar3 it needs on demand, so most + Elixir repos should leave this empty. Setting it makes setup-beam + resolve the version against api.github.com and download the binary + from GitHub releases instead of using `mix local.rebar` — so it + REQUIRES `github-token`, because those API calls are unauthenticated + otherwise and are rate-limited on the shared GitHub-hosted runner + ranges (observed: the setup step fails within ~5s, before any + dependency work). Empty = do not install rebar3 explicitly. + type: string + required: false + default: "" + github-token: + description: >- + Optional token forwarded to erlef/setup-beam, used solely to + authenticate its api.github.com lookups. Pass the caller's + `secrets.GITHUB_TOKEN`. Required in practice when + `rebar3-version` is set; harmless when it is empty. type: string required: false default: "" @@ -163,12 +177,18 @@ jobs: repository: ${{ github.repository }} ref: ${{ github.ref }} + - name: Guard — rebar3 pinning needs an authenticated lookup + if: ${{ inputs.rebar3-version != '' && inputs.github-token == '' }} + run: | + echo "::warning title=rebar3-version set without github-token::setup-beam resolves rebar3-version through unauthenticated api.github.com calls, which are rate-limited on the shared GitHub-hosted runner ranges and can fail this step within seconds. Pass the github-token input (secrets.GITHUB_TOKEN) or drop rebar3-version unless a dependency is rebar-based." + - name: Set up BEAM (OTP + Elixir) uses: erlef/setup-beam@54075bcc5e249e4758d363f27d099f55d843f124 # v1.24.1 with: otp-version: ${{ inputs.otp-version }} elixir-version: ${{ inputs.elixir-version }} rebar3-version: ${{ inputs.rebar3-version }} + github-token: ${{ inputs.github-token }} - name: Cache deps uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 diff --git a/CICD-WORKFLOW-CATALOG.md b/CICD-WORKFLOW-CATALOG.md index 1577da770..7fd3b34b7 100644 --- a/CICD-WORKFLOW-CATALOG.md +++ b/CICD-WORKFLOW-CATALOG.md @@ -122,6 +122,16 @@ These workflows only run when manually triggered. | `elixir-ci-reusable.yml` | Reusable Elixir CI | standards | Yes | | `echidna-verify.yml` | ECHIDNA trust-pipeline proof verification (Agda/Idris2). NOT the smart-contract fuzzer. Corpora are evicted to their own repos; surviving jobs (`agda-lol`, `idris2-avow`) open with a presence Guard and pass green-but-honest ("Nothing to type-check") until a corpus returns (#748/#828). The `idris2-a2ml` job is EVICTED as of 2026-09-17: the a2ml project is officially retired (owner ruling), so dormancy was moot — no ruleset pinned its check context (verified live: org ruleset Optimus-Branch #23359343). | standards | Yes | +**Elixir note — `rebar3-version` is a trap unless you need it.** Leave it empty: `mix` +installs the rebar3 it needs on demand, and only a rebar-based dependency justifies pinning it. +Setting it makes `erlef/setup-beam` resolve the version through **unauthenticated** `api.github.com` +calls, which are rate-limited on the shared GitHub-hosted runner ranges — the setup step then fails +within seconds, before any dependency work (bofig's Elixir CI sat red from 2026-06-24 to 2026-09 for +exactly this). If you genuinely need the pin, pass `github-token` too (the caller's +`secrets.GITHUB_TOKEN`); the reusable now warns when you set one without the other. The original +motivation for this input — a builds.hex.pm TLS `key_usage_mismatch` — **no longer applies**: that +host's chain was verified clean on 2026-09-18. + ### Julia | Workflow | Description | Source | Reusable? | |----------|-------------|--------|----------|