From 7e28c7e31c9e84178a8aea84512b975dfbfaaaab Mon Sep 17 00:00:00 2001
From: hyperpolymath <6759885+hyperpolymath@users.noreply.github.com>
Date: Wed, 24 Jun 2026 14:16:09 +0100
Subject: [PATCH] feat(ci): add rebar3-version input to elixir-ci-reusable
 (bypass builds.hex.pm cert)

setup-beam's mix local.rebar fetches rebar from builds.hex.pm, which fails
under OTP with a TLS key_usage_mismatch on that host's cert. An optional
rebar3-version input (wired to setup-beam) makes it install rebar3 from
GitHub releases instead. Empty default = unchanged for existing callers.
Required: bofig's elixir-ci.yml already passes rebar3-version (PR #107).
---
 .github/workflows/elixir-ci-reusable.yml | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/.github/workflows/elixir-ci-reusable.yml b/.github/workflows/elixir-ci-reusable.yml
index d4387aed..3af1968a 100644
--- a/.github/workflows/elixir-ci-reusable.yml
+++ b/.github/workflows/elixir-ci-reusable.yml
@@ -73,6 +73,15 @@ on:
         type: string
         required: false
         default: "1.17"
+      rebar3-version:
+        description: >-
+          rebar3 version for erlef/setup-beam. When set, setup-beam installs
+          rebar3 from GitHub releases instead of letting `mix local.rebar`
+          fetch it from builds.hex.pm — a workaround for the OTP TLS
+          `key_usage_mismatch` cert error on that host. Empty = unchanged.
+        type: string
+        required: false
+        default: ""
       enable_dialyzer:
         description: Run `mix dialyzer` (slow cold-cache; off by default)
         type: boolean
@@ -152,6 +161,7 @@ jobs:
         with:
           otp-version: ${{ inputs.otp-version }}
           elixir-version: ${{ inputs.elixir-version }}
+          rebar3-version: ${{ inputs.rebar3-version }}
 
       - name: Cache deps
         uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5