From f94e829e9bc118fa831136288550a5b3c69db3b5 Mon Sep 17 00:00:00 2001 From: Claude Date: Mon, 9 Nov 2026 15:18:01 +0000 Subject: [PATCH] ci: move the oracle default and elixir-compile to OTP 28.5.0.8 Hypatia be98f74 segfaults deterministically when compiled and run on OTP 28.1, 28.2 or 28.3 (5/5 rc 139 per version; #1032). It is clean on OTP 27.3, 28.0 and 28.5.0.8. The likely cause is the compiler bug fixed in OTP 28.4 (OTP-19951, erlang/otp#10588). rsr-oracle.yml now defaults to 28.5.0.8, and the elixir-compile jobs in ci.yml match it. Those jobs exist to compile the tree under the gate's exact toolchain. The Mix cache key and restore prefix now carry the OTP version, so a _build compiled under one release is never restored under another. The consumer docs and the changelog say the same. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01E294yTkKk127qgKEXFFDBE --- .github/workflows/ci.yml | 12 ++++++------ .github/workflows/rsr-oracle.yml | 2 +- CHANGELOG.adoc | 17 +++++++++++++++++ docs/consumers/rsr-oracle.adoc | 4 ++-- docs/consumers/standards-governance.adoc | 2 +- 5 files changed, 27 insertions(+), 10 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index b9115f0c..e4fcdfeb 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -330,7 +330,7 @@ jobs: uses: erlef/setup-beam@v1.24.1 with: elixir-version: '1.19.4' - otp-version: '28.3' + otp-version: '28.5.0.8' - name: Restore Mix cache uses: actions/cache@v6.1.0 @@ -338,9 +338,9 @@ jobs: path: | deps _build - key: mix-dogfood-${{ runner.os }}-${{ hashFiles('mix.lock') }} + key: mix-dogfood-${{ runner.os }}-otp28.5.0.8-${{ hashFiles('mix.lock') }} restore-keys: | - mix-dogfood-${{ runner.os }}- + mix-dogfood-${{ runner.os }}-otp28.5.0.8- - name: Fetch dependencies run: mix deps.get @@ -457,7 +457,7 @@ jobs: uses: erlef/setup-beam@v1.24.1 with: elixir-version: '1.19.4' - otp-version: '28.3' + otp-version: '28.5.0.8' - name: Restore Mix cache uses: actions/cache@v6.1.0 @@ -465,9 +465,9 @@ jobs: path: | deps _build - key: mix-dogfood-${{ runner.os }}-${{ hashFiles('mix.lock') }} + key: mix-dogfood-${{ runner.os }}-otp28.5.0.8-${{ hashFiles('mix.lock') }} restore-keys: | - mix-dogfood-${{ runner.os }}- + mix-dogfood-${{ runner.os }}-otp28.5.0.8- - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0 diff --git a/.github/workflows/rsr-oracle.yml b/.github/workflows/rsr-oracle.yml index 61a90f98..5afc712d 100644 --- a/.github/workflows/rsr-oracle.yml +++ b/.github/workflows/rsr-oracle.yml @@ -105,7 +105,7 @@ on: description: Erlang/OTP version for the oracle. type: string required: false - default: '28.3' + default: '28.5.0.8' outputs: tier: description: Tier reported by the oracle (none|bronze|silver|gold|rhodium). diff --git a/CHANGELOG.adoc b/CHANGELOG.adoc index 2a32f694..4265a4cc 100644 --- a/CHANGELOG.adoc +++ b/CHANGELOG.adoc @@ -12,6 +12,23 @@ https://semver.org/[Semantic Versioning]. === Changed +==== The oracle and CI toolchain move to OTP 28.5.0.8 (2026-11-09) + +`rsr-oracle.yml` now defaults to OTP `28.5.0.8`, and the `elixir-compile` +jobs in `ci.yml` use it as well. An OTP version matrix (#1032) found the +following: + +* Commit `be98f74` crashes with a segfault on every run when it is compiled + and run on OTP 28.1, 28.2 or 28.3. The crash is in `sweep_off_heap` + under `beam_jit_bs_init_bits`. +* The same tree is clean on OTP 27.3, 28.0 and 28.5.0.8. + +The likely cause is the compiler bug that OTP 28.4 fixed (OTP-19951, +erlang/otp#10588). This is inferred, not proven. + +The Mix cache key now carries the OTP version. A `_build` compiled under one +OTP release is therefore never restored under another. + ==== WH013 reads steps with RE001's workflow reader (2026-11-04) RE001's reader is now its own module, `Hypatia.WorkflowYaml`, and WH013 reads diff --git a/docs/consumers/rsr-oracle.adoc b/docs/consumers/rsr-oracle.adoc index ef542fc8..0b4585e7 100644 --- a/docs/consumers/rsr-oracle.adoc +++ b/docs/consumers/rsr-oracle.adoc @@ -38,7 +38,7 @@ paid for that on 2026-10-25: fix was written, because the ref in use was `main`. The fix (this repository's `elixir-compile` job) now compiles the tree on every -PR using the exact toolchain the gate uses — Elixir `1.19.4` / OTP `28.3` — so +PR using the exact toolchain the gate uses — Elixir `1.19.4` / OTP `28.5.0.8` — so the same defect cannot reach `main` again. The pin is what keeps a *consumer* safe when something else slips through anyway. @@ -120,7 +120,7 @@ product; the tier gate is a policy each repository adopts when it is ready. A == Local use The oracle is a mix task; there is nothing to install beyond Elixir 1.19.4 / -OTP 28.3: +OTP 28.5.0.8: [source,bash] ---- diff --git a/docs/consumers/standards-governance.adoc b/docs/consumers/standards-governance.adoc index 40bd4f50..abb46349 100644 --- a/docs/consumers/standards-governance.adoc +++ b/docs/consumers/standards-governance.adoc @@ -228,7 +228,7 @@ bash scripts/standards-integration/check-standards-integration.sh \ == Runtime prerequisites (explicit) * Runner: `ubuntu-latest` only. The reusables install their own - toolchain (Elixir 1.19.4 / OTP 28.3 via `erlef/setup-beam`) — no + toolchain (Elixir 1.19.4 / OTP 28.5.0.8 via `erlef/setup-beam`) — no consumer-side Elixir, Rust or Zig setup is required for the scan or governance lanes. * Repository Actions policy must allow