Repository navigation
fix(ci): pin rebar3-version (bypass builds.hex.pm cert error) - #107
Merged
Merged
Conversation
…ass builds.hex.pm cert key_usage_mismatch)
hyperpolymath
added a commit
that referenced
this pull request
Sep 19, 2026
#197) ## Why Both Elixir workflows pass `rebar3-version: '3.24.0'` to `erlef/setup-beam`. From the action's source, that input is the **only** thing that makes it call `api.github.com` (three pages of `erlang/rebar3` releases) and download a binary from GitHub releases — with no input, that code path never runs. The action leaves those calls **unauthenticated**, which is why the setup step has failed in **4–7 s** on every run since the pin landed on 2026-06-24, never reaching dependency installation. This holds for both the reusable wrapper and the legacy local copy. ## Timeline (from the workflow's own run history) | When | Setup step | Where runs failed | |---|---|---| | to 2026-06-05 | passes | later, at `Run tests` | | 2026-06-24 — PR #107 adds the pin | — | — | | 2026-06-27 → today | **fails in 5 s** | `Set up Elixir` | ## Nothing here needs rebar3 `mix` installs the rebar it needs on demand. No dependency is rebar-based and `mix.exs` declares no rebar manager. Removing the input restores exactly the shape both workflows had while they were passing. The pin was a workaround for a builds.hex.pm TLS `key_usage_mismatch`; that host's chain is clean today (verified 2026-09-18, valid to 2026-11-08), so the workaround is stale. ## Verified - `actionlint` clean on both files; YAML re-parsed. - No `rebar3-version` occurrence remains in `.github/workflows/`. ## Companion change `hyperpolymath/standards` now accepts a `github-token` input for the reusable and warns when the pin is set without one (landed separately), so a consumer that genuinely needs the pin has a working path. ## Expectation after landing Setup goes green and the pipeline advances — it may then stop at `Run tests`, a separate pre-existing failure that this unblocks the visibility of.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The 'Build and test' failures are an OTP TLS key_usage_mismatch fetching rebar from builds.hex.pm (not transient — re-run still fails). Pinning rebar3-version makes setup-beam install rebar3 from GitHub releases instead, bypassing the bad cert. Clears all 6 open dependabot PRs once rebased.