Harden CI workflow and modernize OTP/runner matrix#15
Merged
Conversation
Addresses findings from a security scan of .github/workflows/main.yml: - Pin every GitHub Action to a full commit SHA (with version comment) to mitigate mutable-tag supply-chain risk - Upgrade outdated/vulnerable actions: * actions/checkout v2 -> v6.0.2 * actions/cache v2 -> v5.0.5 * codecov/codecov-action v2 -> v6.0.1 (was subject to CVE-2022-1681) * actions/setup-go v4 -> v6.4.0 * erlef/setup-beam v1 -> v1.24.0 - Add top-level permissions: contents: read for least-privilege GITHUB_TOKEN - Rename Codecov input file: -> files: (required by codecov-action v4+) - Add .github/dependabot.yml for weekly github-actions updates so SHA pins stay current Unrelated modernization in the same workflow: - Switch runner from ubuntu-20.04 (removed from GitHub-hosted runners in April 2025) to ubuntu-24.04 - Update OTP matrix to currently supported majors (26, 27, 28); drops EOL 23.3, 24.1.2, 25.2.3 - Bump rebar3 to 3.27.0 in both jobs - Drop version-type: strict on the dialyzer setup-beam step (no longer compatible with loose major-only version spec)
The refresh_interval and idle_interval record fields in #data{} are
declared but never assigned, so they default to undefined. Allow
undefined in the type spec to match the runtime reality, consistent
with other optional fields in the same records.
wmnsk
approved these changes
Jun 2, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Hardens
.github/workflows/main.ymlbased on a security scan and modernizes the OTP / runner matrix.Security changes (address scanner findings)
actions/checkout@v2codecov/codecov-action@v2(CVE-2022-1681 era)file:->files:input rename# vX.Y.ZcommentAdditional security hardening (not in the report but related):
permissions: contents: readfor least-privilegeGITHUB_TOKEN.actions/cache@v2(also deprecated) bumped to v5.0.5, SHA-pinned.actions/setup-go@v4bumped to v6.4.0, SHA-pinned.erlef/setup-beam@v1bumped to v1.24.0, SHA-pinned..github/dependabot.ymlenables weeklygithub-actionsupdates so SHA pins don't bit-rot. Dependabot understands the# vX.Y.Ztrailing comment convention and updates both the SHA and the comment.Modernization (unrelated to the scan, requested in the same change)
ubuntu-20.04->ubuntu-24.04. GitHub removed theubuntu-20.04hosted runner in April 2025, so the workflow would currently fail to schedule.['26.0', '25.2.3', '24.1.2', '23.3']->['28', '27', '26']. OTP 23 / 24 / 25 are EOL upstream; the remaining majors are the currently supported ones. Loose version specs now resolve to the latest patch of each major.'26.0'->'28'. Droppedversion-type: 'strict'since it requires an exact patch version.rebar3bumped to3.27.0in both jobs (was3.20.0/3.22.1).Caveats / things to watch on this PR
README.mdorrebar.config.codecov-action@v6works tokenless on public repos. NoCODECOV_TOKENis needed for this repo.Files changed
.github/workflows/main.yml— all of the above.github/dependabot.yml— new, weeklygithub-actionsupdatesCo-authored by Augment Code