From 326bb2e935495c81f3ded5fcaa1da5cd483a6b8d Mon Sep 17 00:00:00 2001 From: Andreas Schultz Date: Wed, 1 Apr 2026 08:50:56 +0200 Subject: [PATCH 1/3] Pin GitHub Actions to commit SHAs for security hardening MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Update actions/checkout v3 → v6.0.2 and 8398a7/action-slack v3 → v3.19.0, pinning both to their exact commit SHAs to prevent supply chain attacks. Co-Authored-By: Claude Sonnet 4.6 --- .github/workflows/hex.yaml | 2 +- .github/workflows/main.yml | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/hex.yaml b/.github/workflows/hex.yaml index 85107a68..a525f23a 100644 --- a/.github/workflows/hex.yaml +++ b/.github/workflows/hex.yaml @@ -17,7 +17,7 @@ jobs: apk --no-cache upgrade apk --no-cache add gcc git libc-dev libc-utils libgcc linux-headers make bash \ musl-dev musl-utils ncurses-dev pcre2 pkgconf scanelf wget zlib - - uses: actions/checkout@v3 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: work around for permission issue run: | git config --global --add safe.directory /__w/eradius/eradius diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml index 7fd1e840..2a3f5bc6 100644 --- a/.github/workflows/main.yml +++ b/.github/workflows/main.yml @@ -13,7 +13,7 @@ jobs: image: erlang:${{ matrix.otp }}-alpine steps: - name: Checkout - uses: actions/checkout@v3 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: Build run: rebar3 compile - name: Run tests @@ -26,7 +26,7 @@ jobs: if: always() steps: - name: Slack notification - uses: 8398a7/action-slack@v3 + uses: 8398a7/action-slack@77eaa4f1c608a7d68b38af4e3f739dcd8cba273e # v3.19.0 with: author_name: "GitHub Actions" username: ${{ github.event.repository.name }} From cdb42d441668f44ab680c268f5d20ac3eb39da1d Mon Sep 17 00:00:00 2001 From: Andreas Schultz Date: Wed, 1 Apr 2026 08:53:39 +0200 Subject: [PATCH 2/3] Update runner images from ubuntu-20.04 to ubuntu-latest ubuntu-20.04 is EOL; switch slack and hex publish jobs to ubuntu-latest (currently ubuntu-24.04) to stay on a supported runner. Co-Authored-By: Claude Sonnet 4.6 --- .github/workflows/hex.yaml | 2 +- .github/workflows/main.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/hex.yaml b/.github/workflows/hex.yaml index a525f23a..e783eff7 100644 --- a/.github/workflows/hex.yaml +++ b/.github/workflows/hex.yaml @@ -7,7 +7,7 @@ on: jobs: publish: - runs-on: ubuntu-20.04 + runs-on: ubuntu-latest container: image: erlang:23.2.5.0-alpine steps: diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml index 2a3f5bc6..b44b1b8d 100644 --- a/.github/workflows/main.yml +++ b/.github/workflows/main.yml @@ -22,7 +22,7 @@ jobs: slack: needs: test - runs-on: ubuntu-20.04 + runs-on: ubuntu-latest if: always() steps: - name: Slack notification From ade0575b834d2cec0517678bb9c58b60eb8752b2 Mon Sep 17 00:00:00 2001 From: Andreas Schultz Date: Wed, 1 Apr 2026 08:57:57 +0200 Subject: [PATCH 3/3] =?UTF-8?q?Expand=20OTP=20matrix=20to=2022=E2=80=9328?= =?UTF-8?q?=20and=20update=20Erlang=20container=20versions?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - CI matrix: add OTP 26, 27, 28 (latest stable; OTP 29 is still RC) - hex publish: update pinned image from erlang:23.2.5.0-alpine to erlang:27-alpine Current latest patch per major (as of 2026-04): 22 → 22.3.4.27, 23 → 23.3.4.20, 24 → 24.3.4.16 25 → 25.3.2.11, 26 → 26.2.5, 27 → 27.3.4, 28 → 28.4.1 OTP 27 is used for hex publish as the latest proven-stable series; OTP 28 can be promoted once the ecosystem has wider adoption. Co-Authored-By: Claude Sonnet 4.6 --- .github/workflows/hex.yaml | 2 +- .github/workflows/main.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/hex.yaml b/.github/workflows/hex.yaml index e783eff7..04363db1 100644 --- a/.github/workflows/hex.yaml +++ b/.github/workflows/hex.yaml @@ -9,7 +9,7 @@ jobs: publish: runs-on: ubuntu-latest container: - image: erlang:23.2.5.0-alpine + image: erlang:27-alpine steps: - name: Prepare run: | diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml index b44b1b8d..00b5c0d0 100644 --- a/.github/workflows/main.yml +++ b/.github/workflows/main.yml @@ -8,7 +8,7 @@ jobs: runs-on: ubuntu-latest strategy: matrix: - otp: [22, 23, 24, 25] + otp: [22, 23, 24, 25, 26, 27, 28] container: image: erlang:${{ matrix.otp }}-alpine steps: