From 361dcbe29097b2ba02c6e5baf0c3e148b6e64aac Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Sat, 19 Sep 2026 08:36:44 +0000 Subject: [PATCH] fix(ci): bump OTP past the cert regression that breaks mix local.rebar MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Both Elixir workflows fail in the setup step because `erlef/setup-beam` runs `mix local.rebar --force`, which fetches its metadata from builds.hex.pm, and the Erlang/OTP build they pin (27.2.1, erts-15.2.1) rejects that host's current Let's Encrypt chain: {:tls_alert, {:unsupported_certificate, {key_usage_mismatch, ...}}} Could not install Rebar because Mix could not download metadata at https://builds.hex.pm/installs/rebar3-1.x.csv. This is not a rate limit, a proxy problem or a flake. The identical error appears in every failed run from 2026-06-22 onward — always in 4-7s, always before any dependency work — including runs from BEFORE the rebar3 pin existed, so that pin neither caused nor could fix it. It is OTP-build-specific. chimichanga runs the same action pin against the same host on Erlang/OTP 27.3.4.17 (erts-15.2.7.13) and the identical step succeeds today. OTP corrected this certificate validation in a later 27.x patch; bofig is pinned to an older one. - otp-version: '27.2.1' -> '27.3.4.17' in both workflows (the build proven working against this host today) - drop `rebar3-version`, which cannot do what it was added for: setup-beam runs `mix local.rebar` BEFORE it considers that input, gated only by `install-rebar` (default true), so the pin never bypassed the cert error. Leaving it in only adds an unauthenticated api.github.com lookup with nothing to show for it. No dependency here is rebar-based and mix.exs declares no rebar manager. --- .github/workflows/elixir-ci.yml | 3 +-- .github/workflows/elixir.yml | 3 +-- 2 files changed, 2 insertions(+), 4 deletions(-) diff --git a/.github/workflows/elixir-ci.yml b/.github/workflows/elixir-ci.yml index dae1197..b1d8d94 100644 --- a/.github/workflows/elixir-ci.yml +++ b/.github/workflows/elixir-ci.yml @@ -22,6 +22,5 @@ jobs: elixir-ci: uses: hyperpolymath/standards/.github/workflows/elixir-ci-reusable.yml@8f2ee50841e216cd8c192eeb68953118190f105c with: - otp-version: "27.2.1" + otp-version: "27.3.4.17" elixir-version: "1.18.2" - rebar3-version: '3.24.0' diff --git a/.github/workflows/elixir.yml b/.github/workflows/elixir.yml index c03d53f..0f65c44 100644 --- a/.github/workflows/elixir.yml +++ b/.github/workflows/elixir.yml @@ -54,8 +54,7 @@ jobs: uses: erlef/setup-beam@54075bcc5e249e4758d363f27d099f55d843f124 # v1.24.1 with: elixir-version: '1.18.2' - rebar3-version: '3.24.0' - otp-version: '27.2.1' + otp-version: '27.3.4.17' - name: Restore dependencies cache uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v5 with: