fix(ci): replace fake erlef/setup-beam SHA pin in 3 workflows#39
Merged
Conversation
The pin `erlef/setup-beam@5a67e1a1dd86cae5e5bef84e2da5060406a66c07` was fabricated (`gh api repos/erlef/setup-beam/commits/5a67e1a... -> 422`). It propagated into this repo from the rsr-template-repo e2e.yml template where it lived as a comment stub that someone uncommented for the 4 active sites in this repo. Caught when wiring the equivalent CI in snifs (hyperpolymath/snifs#30); fixed upstream in hyperpolymath/rsr-template-repo#81. Replaced with the verified v1.24.0 pin `fc68ffb90438ef2936bbb3251622353b3dcb2f93` across: - .github/workflows/nif-build.yml - .github/workflows/e2e.yml (2 jobs) - .github/workflows/trust-pipeline-e2e.yml Before this fix the affected workflows would have 422'd at action resolution the moment they were triggered.
hyperpolymath
enabled auto-merge (squash)
May 30, 2026 13:37
hyperpolymath
added a commit
to hyperpolymath/standards
that referenced
this pull request
May 30, 2026
## Summary Standards had two distinct `erlef/setup-beam` SHAs and one wrong version comment across canonical workflows. Consolidated to `fc68ffb90438ef2936bbb3251622353b3dcb2f93` (v1.24.0, 2026-03-30) with correct annotations. ## Before / after | File | Before | After | |---|---|---| | `hypatia-scan.yml` | `fc68ffb...` ` # v1.18.2` (comment wrong; SHA is actually v1.24.0) | `fc68ffb...` ` # v1.24.0` | | `hypatia-scan-reusable.yml` | same as above | same fix | | `elixir-ci-reusable.yml` | `5304e04...` ` # v1.18.2` (stale pin from 2024-09-25) | `fc68ffb...` ` # v1.24.0` | Both SHAs verified real via `gh api repos/erlef/setup-beam/commits/<sha>`. Fragmentation likely from incremental updates that didn't sweep all three files together. ## Why this matters `elixir-ci-reusable.yml` is the load-bearing change: ~12 estate repos call it as a wrapper. This PR propagates the v1.18.2 → v1.24.0 upgrade across the fleet through that single dependency. ## Provenance Companion to: - `hyperpolymath/rsr-template-repo#81` (template fakes fixed, merged) - `hyperpolymath/odds-and-sods-package-manager#39` (downstream) - `hyperpolymath/proven#93` (downstream, merged) - `hyperpolymath/proven-servers#19` (downstream) All fan-out from the SNIFS CI gate work in `hyperpolymath/snifs#30`. ## Test plan - [ ] All 3 setup-beam pins resolve to `fc68ffb...` with comment `# v1.24.0` - [ ] `gh api repos/erlef/setup-beam/commits/fc68ffb90438ef2936bbb3251622353b3dcb2f93` returns 200 - [ ] `hypatia-scan` workflow runs green on this PR - [ ] No downstream repos using elixir-ci-reusable break under v1.24.0 (Elixir/OTP version inputs unchanged)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
The pin
erlef/setup-beam@5a67e1a1dd86cae5e5bef84e2da5060406a66c07(4 active sites across 3 workflows) is fabricated.gh api repos/erlef/setup-beam/commits/5a67e1a... → 422 "No commit found for SHA". These workflows would have failed at action resolution the moment they were triggered — they pass currently only because they haven't been re-run since the pin was applied.Replaced with the verified v1.24.0 pin
fc68ffb90438ef2936bbb3251622353b3dcb2f93(matches what standards/hypatia-scan-reusable.yml uses).Affected files:
.github/workflows/nif-build.yml.github/workflows/e2e.yml(2 jobs).github/workflows/trust-pipeline-e2e.ymlProvenance
The fake SHA propagated from
rsr-template-repo'se2e.ymltemplate, where it lived as a commented# - uses: ...stub that someone uncommented when concretising the workflow here.snifs(ci+test: wire build-mode invariant gate, harden crash_oob, remove stale wasm snifs#30)proven,proven-servers)Test plan
fc68ffb...(v1.24.0)grep -r 5a67e1a1dd86cae5e5bef84e2da5060406a66c07 .github/returns nothing)e2e,runtime-api,nif-build,trust-pipeline-e2e) actually run instead of 422'ing on action resolution