From 7a6595eead876548997d2b37af30349edffdd340 Mon Sep 17 00:00:00 2001 From: Ayla Croft Date: Tue, 20 Oct 2026 12:05:12 -0400 Subject: [PATCH] Print the OpenSSL each gate leg's :crypto linked The box leg moved to ubuntu-26.04-arm so that it runs the OpenSSL 3.5 line a fielded box runs, but its log never said which OpenSSL its OTP linked: the toolchain step printed the OTP release, elixir --version and .tool-versions only. The 3.5 line was inferred from another run on the same image, not read from this one. - gate.yml: the toolchain step prints "crypto linked to " from crypto:info_lib() on every leg. It loads the crypto application first; without that, OTP 28.5 prints a warning report beside the line. - governance_test.exs: the step must call crypto:info_lib(). Measured locally: the test fails on main's gate.yml and passes after the change. The line prints "OpenSSL 3.0.13 30 Jan 2024" on OTP 28 over the system library and "OpenSSL 3.5.9 29 Sep 2026" on 28.5.0.8 built over 3.5.9, exit 0, one line each. Signed-off-by: Ayla Croft --- .github/workflows/gate.yml | 3 +++ test/beam_mcp/governance_test.exs | 12 ++++++++++++ 2 files changed, 15 insertions(+) diff --git a/.github/workflows/gate.yml b/.github/workflows/gate.yml index c300367..d8eaee5 100644 --- a/.github/workflows/gate.yml +++ b/.github/workflows/gate.yml @@ -66,9 +66,12 @@ jobs: otp-version: ${{ matrix.otp }} elixir-version: ${{ matrix.elixir }} version-type: ${{ matrix.version-type }} + # The OpenSSL `:crypto` linked is part of the pair: builds.hex.pm's OTP links the runner + # image's own, so the image decides it (3.0.13 on 24.04, 3.5.5 on 26.04), and the log says it. - name: the pair setup-beam installed (observed, quoted in the slice record) run: | erl -noshell -eval 'io:format("OTP ~s~n", [erlang:system_info(otp_release)]), halt().' + erl -noshell -eval 'ok = application:load(crypto), [{_, _, V}] = crypto:info_lib(), io:format("crypto linked to ~s~n", [V]), halt().' elixir --version cat .tool-versions - run: mix deps.get diff --git a/test/beam_mcp/governance_test.exs b/test/beam_mcp/governance_test.exs index 96c34a1..ce0f2ee 100644 --- a/test/beam_mcp/governance_test.exs +++ b/test/beam_mcp/governance_test.exs @@ -91,6 +91,18 @@ defmodule BeamMCP.GovernanceTest do end end + # A named image fixes the OpenSSL a leg's `:crypto` links only if the log says which one it + # was: the box leg's "OpenSSL 3.5" is a reading of its own run, not an inference from another + # repository's run on the same image. + test "the gate's toolchain step prints the OpenSSL :crypto linked, on every leg" do + text = File.read!(".github/workflows/gate.yml") + [_, step] = String.split(text, "- name: the pair setup-beam installed", parts: 2) + [step | _] = String.split(step, ~r/^\s+- /m, parts: 2) + + assert step =~ "crypto:info_lib()", + "gate.yml's toolchain step does not print crypto:info_lib()" + end + test "every workflow declares top-level permissions, and write permissions live on the job that needs them" do for wf <- @workflows do text = File.read!(wf)