Skip to content

fix(ci): correct the rebar3 guidance — a pin cannot bypass the builds.hex.pm cert error #853

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
hyperpolymath merged 1 commit into from
Sep 19, 2026
Merged

fix(ci): correct the rebar3 guidance — a pin cannot bypass the builds.hex.pm cert error #853

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
16 changes: 7 additions & 9 deletions .github/workflows/elixir-ci-reusable.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -76,15 +76,13 @@ on:
default: "1.17"
rebar3-version:
description: >-
rebar3 version for erlef/setup-beam. ONLY set this when a dependency
is rebar-based; `mix` installs the rebar3 it needs on demand, so most
Elixir repos should leave this empty. Setting it makes setup-beam
resolve the version against api.github.com and download the binary
from GitHub releases instead of using `mix local.rebar` — so it
REQUIRES `github-token`, because those API calls are unauthenticated
otherwise and are rate-limited on the shared GitHub-hosted runner
ranges (observed: the setup step fails within ~5s, before any
dependency work). Empty = do not install rebar3 explicitly.
rebar3 version for erlef/setup-beam. ONLY set this when a dependency is
rebar-based; `mix` installs the rebar it needs on demand, so most Elixir
repos should leave this empty. Setting it installs rebar3 from GitHub
releases, resolved through api.github.com — pass `github-token` as well
so those lookups are authenticated. NOTE: this does NOT replace the
`mix local.rebar` call setup-beam makes when `install-rebar` is true
(the default); that runs first and is gated only by that input.
type: string
required: false
default: ""
Expand Down
29 changes: 20 additions & 9 deletions CICD-WORKFLOW-CATALOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -122,15 +122,26 @@ These workflows only run when manually triggered.
| `elixir-ci-reusable.yml` | Reusable Elixir CI | standards | Yes |
| `echidna-verify.yml` | ECHIDNA trust-pipeline proof verification (Agda/Idris2). NOT the smart-contract fuzzer. Corpora are evicted to their own repos; surviving jobs (`agda-lol`, `idris2-avow`) open with a presence Guard and pass green-but-honest ("Nothing to type-check") until a corpus returns (#748/#828). The `idris2-a2ml` job is EVICTED as of 2026-09-17: the a2ml project is officially retired (owner ruling), so dormancy was moot — no ruleset pinned its check context (verified live: org ruleset Optimus-Branch #23359343). | standards | Yes |

**Elixir note — `rebar3-version` is a trap unless you need it.** Leave it empty: `mix`
installs the rebar3 it needs on demand, and only a rebar-based dependency justifies pinning it.
Setting it makes `erlef/setup-beam` resolve the version through **unauthenticated** `api.github.com`
calls, which are rate-limited on the shared GitHub-hosted runner ranges — the setup step then fails
within seconds, before any dependency work (bofig's Elixir CI sat red from 2026-06-24 to 2026-09 for
exactly this). If you genuinely need the pin, pass `github-token` too (the caller's
`secrets.GITHUB_TOKEN`); the reusable now warns when you set one without the other. The original
motivation for this input — a builds.hex.pm TLS `key_usage_mismatch` — **no longer applies**: that
host's chain was verified clean on 2026-09-18.
**Elixir note — `mix local.rebar` fails against builds.hex.pm on older OTP builds.** Erlang/OTP
rejects that host's current Let's Encrypt chain (`key_usage_mismatch` on the `YR1` intermediate), so
`erlef/setup-beam` dies in the setup step within seconds:

** (Mix) httpc request failed with: {:failed_connect, [{:to_address, {~c"builds.hex.pm", 443}},
{:inet, [:inet], {:tls_alert, {:unsupported_certificate, ... {key_usage_mismatch, ...}}}}}]}
Could not install Rebar because Mix could not download metadata at
https://builds.hex.pm/installs/rebar3-1.x.csv.

It is **version-specific and fixed upstream**: on the same day, against the same host and the same
action pin, OTP 27.3.4.17 (erts-15.2.7.13) succeeds where 27.2.1 (erts-15.2.1) fails — measured
2026-09-19 (chimichanga passing, bofig failing). **Bump `otp-version` to a current patch release**;
the pinned OTP build is the cause, not the environment.

Passing `rebar3-version` does **not** avoid this: setup-beam runs `mix local.rebar` *before* it
considers that input, gated only by `install-rebar` (default true) — so a rebar3 pin cannot bypass the
cert error, and bofig spent three months red because it assumed otherwise. To skip the call itself,
set `install-rebar: false` (and `install-hex: false` if Hex is not needed from hex.pm). If you do set
`rebar3-version`, pass `github-token` too — the version lookup otherwise hits api.github.com
unauthenticated.

### Julia
| Workflow | Description | Source | Reusable? |
Expand Down
Loading