From 0d38ffa0a8fd77ad2cd9c5b77e2e9552475da19f Mon Sep 17 00:00:00 2001 From: Daniel Urumov Date: Tue, 11 Aug 2026 18:44:18 +0300 Subject: [PATCH] ci(scorecard): use erlef/setup-elixir in the publish job for Packaging detection OpenSSF Scorecard's Packaging check pattern-matches the literal action name "erlef/setup-elixir" to recognize an Elixir/Hex publishing workflow (checks/fileparser/github_workflow.go), but that action was renamed to erlef/setup-beam upstream after Scorecard's matcher was written. erlef/setup-elixir is the same repository under its old, GitHub-redirected name, so this is a no-op functionally, only the publish job's uses string changes, scoped there so the build job keeps the current name. Filing an upstream issue to add the current name so this workaround can be dropped later. --- .github/workflows/build-and-publish.yml | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/.github/workflows/build-and-publish.yml b/.github/workflows/build-and-publish.yml index 4e0b9ac..1340cd7 100644 --- a/.github/workflows/build-and-publish.yml +++ b/.github/workflows/build-and-publish.yml @@ -118,9 +118,15 @@ jobs: - name: Check out repository uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + # erlef/setup-elixir is the pre-rename name of erlef/setup-beam (same repo, + # GitHub redirects it) — kept here, only in this job, so OpenSSF Scorecard's + # Packaging check (which still pattern-matches the old name; see + # ossf/scorecard checks/fileparser/github_workflow.go) recognizes this as + # an Elixir/Hex publishing workflow. Upstream issue filed to add the + # current name so this workaround can go away. - name: Set up Erlang and Elixir id: beam - uses: erlef/setup-beam@54075bcc5e249e4758d363f27d099f55d843f124 # v1.24.1 + uses: erlef/setup-elixir@54075bcc5e249e4758d363f27d099f55d843f124 # v1.24.1 with: version-file: .tool-versions version-type: strict