Commit Graph
150 Commits
Author SHA1 Message Date
Jean Klingler 9a8794183e Warn on boot for OTP28.0 (#14732) 2025-09-18 19:08:39 +09:00
Jonatan Männchen 2e7ee76ac2 Correct builds.hex.pm Publish Condition in CI (#14772) 2025-09-15 23:13:08 +02:00
dependabot[bot] 0dd3985f16 Bump actions/attest-sbom from 2.4.0 to 3.0.0 (#14752)
Bumps [actions/attest-sbom](https://github.com/actions/attest-sbom) from 2.4.0 to 3.0.0.
- [Release notes](https://github.com/actions/attest-sbom/releases)
- [Changelog](https://github.com/actions/attest-sbom/blob/main/RELEASE.md)
- [Commits](https://github.com/actions/attest-sbom/compare/bd218ad0dbcb3e146bd073d1d9c6d78e08aa8a0b...4651f806c01d8637787e274ac3bdf724ef169f34)

---
updated-dependencies:
- dependency-name: actions/attest-sbom
  dependency-version: 3.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-09-09 20:05:09 +02:00
Jonatan Männchen 56333d451e tighten CI secret scope and move AWS config to environment vars (#14627)
* Add `environment: release` to the "publish-to-hex" job so that only
  workflows explicitly targeting the release environment can read
  sensitive values.
* Gate the job behind `if: ${{ vars.HEX_AWS_REGION }}` to avoid noisy
  failures in forks where the variable is not configured.
* Replace `${{ secrets.HEX_AWS_REGION }}` / `${{ secrets.HEX_AWS_S3_BUCKET }}`
  references with `${{ vars.* }}`.  These are not credentials, so
  environment-level *variables* are a better fit and keep them readable
  only by jobs that declare the environment.
* Remove Fastly secrets from the job-wide `env:` block and inject them
  only into the Fastly purge step, following the principle of least
  privilege.  Other steps no longer see these tokens.

Restricting secret visibility to an environment and to the exact step
that needs them reduces the blast radius of a compromised workflow run,
blocks accidental exposure in logs of unrelated steps, and stops forks
from obtaining privileged data.
2025-09-03 22:14:09 +02:00
dependabot[bot] eee42e4448 Bump actions/checkout from 4.2.2 to 5.0.0 (#14710)
Bumps [actions/checkout](https://github.com/actions/checkout) from 4.2.2 to 5.0.0.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](https://github.com/actions/checkout/compare/11bd71901bbe5b1630ceea73d27597364c9af683...08c6903cd8c0fde910a37f88322edcfb5dd907a8)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: 5.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-08-30 10:58:44 +02:00
dependabot[bot] 03522aaeb2 Bump actions/download-artifact from 4.3.0 to 5.0.0 (#14708)
Bumps [actions/download-artifact](https://github.com/actions/download-artifact) from 4.3.0 to 5.0.0.
- [Release notes](https://github.com/actions/download-artifact/releases)
- [Commits](https://github.com/actions/download-artifact/compare/d3f86a106a0bac45b974a628896c90dbdf5c8093...634f93cb2916e3fdff6788551b99b062d0335ce0)

---
updated-dependencies:
- dependency-name: actions/download-artifact
  dependency-version: 5.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-08-12 09:34:43 +02:00
Jonatan Männchen 374f6e342a Update ORT Scanner (#14594) 2025-07-31 15:46:09 +02:00
dependabot[bot] a4f40f7622 Bump azure/trusted-signing-action from 0.5.1 to 0.5.9 (#14653)
Bumps [azure/trusted-signing-action](https://github.com/azure/trusted-signing-action) from 0.5.1 to 0.5.9.
- [Release notes](https://github.com/azure/trusted-signing-action/releases)
- [Commits](https://github.com/azure/trusted-signing-action/compare/0d74250c661747df006298d0fb49944c10f16e03...bb15ca63eb5548cc306f4f335c5617bb414abcad)

---
updated-dependencies:
- dependency-name: azure/trusted-signing-action
  dependency-version: 0.5.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-07-15 12:45:34 +02:00
dependabot[bot] 79a6a57234 Bump erlef/setup-beam from 1.20.3 to 1.20.4 (#14652)
Bumps [erlef/setup-beam](https://github.com/erlef/setup-beam) from 1.20.3 to 1.20.4.
- [Release notes](https://github.com/erlef/setup-beam/releases)
- [Commits](https://github.com/erlef/setup-beam/compare/8e7fdef09ffa3ea54328b5000c170a3b9b20ca96...e6d7c94229049569db56a7ad5a540c051a010af9)

---
updated-dependencies:
- dependency-name: erlef/setup-beam
  dependency-version: 1.20.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-07-15 11:47:21 +02:00
dependabot[bot] 29ee3a2ad8 Bump erlef/setup-beam from 1.20.1 to 1.20.3 (#14631)
Bumps [erlef/setup-beam](https://github.com/erlef/setup-beam) from 1.20.1 to 1.20.3.
- [Release notes](https://github.com/erlef/setup-beam/releases)
- [Commits](https://github.com/erlef/setup-beam/compare/75edbb82877ab10edeb12a99c3cf2f0909f3dc87...8e7fdef09ffa3ea54328b5000c170a3b9b20ca96)

---
updated-dependencies:
- dependency-name: erlef/setup-beam
  dependency-version: 1.20.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-07-08 13:10:44 +02:00
dependabot[bot] dc1890b879 Bump erlef/setup-beam from 1.19.0 to 1.20.1 (#14612)
---
updated-dependencies:
- dependency-name: erlef/setup-beam
  dependency-version: 1.20.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-07-01 10:20:33 +02:00
Jonatan Männchen 1753c81f9e Use Workload Identity Federation for Windows Trusted Signing (#14604) 2025-06-25 19:29:47 +02:00
dependabot[bot] dc4c1cf402 Bump actions/attest-sbom from 2.2.0 to 2.4.0 (#14582)
Bumps [actions/attest-sbom](https://github.com/actions/attest-sbom) from 2.2.0 to 2.4.0.
- [Release notes](https://github.com/actions/attest-sbom/releases)
- [Changelog](https://github.com/actions/attest-sbom/blob/main/RELEASE.md)
- [Commits](https://github.com/actions/attest-sbom/compare/115c3be05ff3974bcbd596578934b3f9ce39bf68...bd218ad0dbcb3e146bd073d1d9c6d78e08aa8a0b)

---
updated-dependencies:
- dependency-name: actions/attest-sbom
  dependency-version: 2.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-06-16 16:14:39 -07:00
dependabot[bot] 1a8d13c12a Bump erlef/setup-beam from 1.18.2 to 1.19.0 (#14537)
Bumps [erlef/setup-beam](https://github.com/erlef/setup-beam) from 1.18.2 to 1.19.0.
- [Release notes](https://github.com/erlef/setup-beam/releases)
- [Commits](https://github.com/erlef/setup-beam/compare/5304e04ea2b355f03681464e683d92e3b2f18451...8aa8a857c6be0daae6e97272bb299d5b942675a4)

---
updated-dependencies:
- dependency-name: erlef/setup-beam
  dependency-version: 1.19.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-05-27 09:02:41 +02:00
José Valim 050f9e28b4 Run Erlang/OTP 28 on Windows CI (#14513) 2025-05-22 10:21:24 +02:00
José Valim 51e160e6f8 Add OTP 28 to CI (#14510) 2025-05-21 13:48:13 +02:00
dependabot[bot] ca069f7ab6 Bump DavidAnson/markdownlint-cli2-action from 19.1.0 to 20.0.0 (#14507)
Bumps [DavidAnson/markdownlint-cli2-action](https://github.com/davidanson/markdownlint-cli2-action) from 19.1.0 to 20.0.0.
- [Release notes](https://github.com/davidanson/markdownlint-cli2-action/releases)
- [Commits](https://github.com/davidanson/markdownlint-cli2-action/compare/05f32210e84442804257b2a6f20b273450ec8265...992badcdf24e3b8eb7e87ff9287fe931bcb00c6e)

---
updated-dependencies:
- dependency-name: DavidAnson/markdownlint-cli2-action
  dependency-version: 20.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-05-19 23:52:01 +02:00
Eksperimental eef6c3cb2a CI: build does using --warnings-as-error ExDoc flag (#14485) 2025-05-10 11:30:41 +02:00
José Valim 670cc0954f Update CI 2025-05-09 13:25:10 +02:00
dependabot[bot] ef11da961d Bump actions/download-artifact from 4.2.1 to 4.3.0 (#14457)
Bumps [actions/download-artifact](https://github.com/actions/download-artifact) from 4.2.1 to 4.3.0.
- [Release notes](https://github.com/actions/download-artifact/releases)
- [Commits](https://github.com/actions/download-artifact/compare/95815c38cf2ff2164869cbab79da8d1f422bc89e...d3f86a106a0bac45b974a628896c90dbdf5c8093)

---
updated-dependencies:
- dependency-name: actions/download-artifact
  dependency-version: 4.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-04-29 22:33:35 +02:00
dependabot[bot] 396382cef7 Bump actions/upload-artifact from 4.6.1 to 4.6.2 (#14411)
Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact) from 4.6.1 to 4.6.2.
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](https://github.com/actions/upload-artifact/compare/v4.6.1...ea165f8d65b6e75b540449e92b4886f43607fa02)

---
updated-dependencies:
- dependency-name: actions/upload-artifact
  dependency-version: 4.6.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-04-08 08:22:05 +02:00
Jonatan Männchen f3e8ceb5aa Implement Test Coverage Reporting (#14343) 2025-04-07 22:37:01 +02:00
dependabot[bot] 5c63c8d94d Bump actions/download-artifact from 4.1.9 to 4.2.1 (#14361)
Bumps [actions/download-artifact](https://github.com/actions/download-artifact) from 4.1.9 to 4.2.1.
- [Release notes](https://github.com/actions/download-artifact/releases)
- [Commits](https://github.com/actions/download-artifact/compare/cc203385981b70ca67e1cc392babf9cc229d5806...95815c38cf2ff2164869cbab79da8d1f422bc89e)

---
updated-dependencies:
- dependency-name: actions/download-artifact
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-03-25 10:06:25 +01:00
dependabot[bot] 95b63d74dc Bump actions/upload-artifact from 4.6.1 to 4.6.2 (#14360)
Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact) from 4.6.1 to 4.6.2.
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](https://github.com/actions/upload-artifact/compare/4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1...ea165f8d65b6e75b540449e92b4886f43607fa02)

---
updated-dependencies:
- dependency-name: actions/upload-artifact
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-03-25 09:57:06 +01:00
Jonatan MännchenandJosé Valim f55498e7e5 Enable warnings_as_errors for Erlang only on latest (#14339)
Co-authored-by: José Valim <jose.valim@dashbit.co>
2025-03-18 14:27:59 +01:00
José Valim cb8b73598b Update Erlang/OTP on Windows CI (#14334) 2025-03-17 15:34:50 +01:00
Jonatan Männchen 37faa6761f Limit GH Actions Token Permissions (#14333) 2025-03-17 14:25:44 +01:00
Jonatan Männchen 6cd8082494 Pin GitHub Actions (#14332) 2025-03-17 14:25:22 +01:00
Jonatan Männchen 4db62c8d59 Update ORT Action & Executable (#14331) 2025-03-17 14:23:11 +01:00
Jonatan Männchen a58382fe5b Update ORT Action (#14296) 2025-02-24 15:41:54 +01:00
Art Kay 73893ee5c2 Fix typo in action.yml (#14286)
desctiption -> description
2025-02-20 05:56:53 +01:00
Wojtek Mach cd6fcc41a6 Add instructions for updating AZURE_CLIENT_SECRET (#14284) 2025-02-19 11:26:22 +01:00
José Valim b65570e194 Remove --keep-going and reduce concurrency for CI on Windows (#14283) 2025-02-19 11:09:39 +01:00
Jonatan Männchen 4b50edce3e Expose Packages in SBoM (#14264) 2025-02-14 09:20:16 +01:00
Jonatan Männchen e45a1f2593 Improve SBoM Details (#14258) 2025-02-09 17:35:07 +01:00
Jonatan Männchen 980500551c Inline Licence Info & Copyright for non-test files (#14256) 2025-02-07 21:11:09 +01:00
Jonatan Männchen d12286c490 Setup OSS Review Toolkit SBoM generation (#14241) 2025-02-05 13:09:56 +01:00
José Valim cb0f8d9791 Fetch all tags before generating docs (#14206) 2025-01-21 08:29:42 +01:00
dependabot[bot] 0df1ff54b1 Bump DavidAnson/markdownlint-cli2-action from 19.0.0 to 19.1.0 (#14204)
Bumps [DavidAnson/markdownlint-cli2-action](https://github.com/davidanson/markdownlint-cli2-action) from 19.0.0 to 19.1.0.
- [Release notes](https://github.com/davidanson/markdownlint-cli2-action/releases)
- [Commits](https://github.com/davidanson/markdownlint-cli2-action/compare/v19.0.0...v19.1.0)

---
updated-dependencies:
- dependency-name: DavidAnson/markdownlint-cli2-action
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-01-21 08:20:19 +01:00
dependabot[bot] ffbe286320 Bump azure/trusted-signing-action from 0.5.0 to 0.5.1 (#14185)
Bumps [azure/trusted-signing-action](https://github.com/azure/trusted-signing-action) from 0.5.0 to 0.5.1.
- [Release notes](https://github.com/azure/trusted-signing-action/releases)
- [Commits](https://github.com/azure/trusted-signing-action/compare/v0.5.0...v0.5.1)

---
updated-dependencies:
- dependency-name: azure/trusted-signing-action
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-01-14 08:20:24 +01:00
dependabot[bot] 78720e50d8 Bump DavidAnson/markdownlint-cli2-action from 18.0.0 to 19.0.0 (#14132)
Bumps [DavidAnson/markdownlint-cli2-action](https://github.com/davidanson/markdownlint-cli2-action) from 18.0.0 to 19.0.0.
- [Release notes](https://github.com/davidanson/markdownlint-cli2-action/releases)
- [Commits](https://github.com/davidanson/markdownlint-cli2-action/compare/v18.0.0...v19.0.0)

---
updated-dependencies:
- dependency-name: DavidAnson/markdownlint-cli2-action
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-12-30 23:43:10 +01:00
José Valim af4cb1d6a6 Simplify release matrix 2024-12-28 09:21:00 +01:00
José Valim 62f49cd756 Conditionally run steps 2024-12-25 10:22:20 +01:00
José Valim e0eb19a933 Take two 2024-12-25 10:08:58 +01:00
José Valim 1ec5af94fe No need for == 2024-12-25 10:01:15 +01:00
José Valim 45e348b1f5 Run Erlang/OTP 25 release builds
Closes #14113.
2024-12-25 09:57:59 +01:00
Jonatan Männchen 91527e3753 Fix Release Signing Again (#14099) (#14102)
This time, fix the Docs publishing.
2024-12-21 17:59:53 +01:00
Jonatan Männchen 70bd74e0e0 Fix Release Signing (#14099) (#14100) 2024-12-21 16:17:38 +01:00
Jonatan Männchen 7cbc44d6bf Hash release files after signing (#14085) 2024-12-20 11:30:07 +01:00
José Valim ef7c11814f Require Erlang/OTP 26+ (#14045) 2024-12-10 15:38:02 +01:00