From 5cc712df16bc29ae88ade5b21a726fbcca139dd6 Mon Sep 17 00:00:00 2001 From: bougyman's bot Date: Fri, 4 Sep 2026 10:59:51 -0400 Subject: [PATCH 1/2] chore: only do burrito regression builds when burrito-related things change, not every PR --- .github/workflows/ci.yaml | 46 ++++++++++++++++++++++++++++++++++++--- 1 file changed, 43 insertions(+), 3 deletions(-) diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index 1540ad0..7d14fe6 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -14,6 +14,10 @@ on: # yamllint disable-line rule:truthy default: false pull_request: +permissions: + contents: read + pull-requests: read + jobs: test: name: Test @@ -52,11 +56,47 @@ jobs: run: mix ci working-directory: . + burrito_changes: + # Building Burrito is deliberately reserved for changes that affect its + # dependency graph or packaging path. The release workflow still builds + # every target before publishing. + if: github.event_name == 'pull_request' && github.event.action != 'closed' + name: Detect Burrito-impacting changes + runs-on: ubuntu-latest + outputs: + burrito_changed: ${{ steps.changes.outputs.burrito_changed }} + steps: + - + uses: actions/checkout@v7 + with: + fetch-depth: 0 + - + id: changes + name: Check whether Burrito-impacting files changed + env: + BASE_SHA: ${{ github.event.pull_request.base.sha }} + HEAD_SHA: ${{ github.event.pull_request.head.sha }} + run: | + if git diff --quiet "$BASE_SHA" "$HEAD_SHA" -- \ + app/mix.exs \ + app/mix.lock \ + app/release/ \ + ci/prepare_musl_nifs.sh \ + ci/test_burrito_shared_loader.sh \ + .github/workflows/ci.yaml \ + .github/workflows/main.yaml + then + printf 'burrito_changed=false\n' >> "$GITHUB_OUTPUT" + else + printf 'burrito_changed=true\n' >> "$GITHUB_OUTPUT" + fi + burrito_linux_regression: # ci.yaml is also called by main.yaml after pushes and closed release PRs. - # Keep this expensive native build as a pre-merge pull-request gate; the - # release workflow builds every target after the release PR merges. - if: github.event_name == 'pull_request' && github.event.action != 'closed' + # Keep this expensive native build as a pre-merge dependency-change gate; + # the release workflow builds every target after the release PR merges. + needs: [burrito_changes] + if: needs.burrito_changes.outputs.burrito_changed == 'true' name: Burrito Linux shared-loader regression runs-on: ubuntu-latest timeout-minutes: 20 From c683ee34bed4ca2ef073340853110a0644cb02e3 Mon Sep 17 00:00:00 2001 From: bougyman's bot Date: Fri, 4 Sep 2026 11:04:08 -0400 Subject: [PATCH 2/2] chore(deps): update mint dependency for https://osv.dev/vulnerability/EEF-CVE-2026-82729 --- app/mix.lock | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/app/mix.lock b/app/mix.lock index e0a21db..3f6f6db 100644 --- a/app/mix.lock +++ b/app/mix.lock @@ -30,7 +30,7 @@ "mdex": {:hex, :mdex, "0.13.5", "c1c94d230ccaab01ad0c68090d3b31613c10ece1844f32b55895da4ce0c63029", [:mix], [{:jason, "~> 1.0", [hex: :jason, repo: "hexpm", optional: false]}, {:lumis, "~> 0.1", [hex: :lumis, repo: "hexpm", optional: true]}, {:mdex_native, ">= 0.2.6", [hex: :mdex_native, repo: "hexpm", optional: false]}, {:nimble_options, "~> 1.0", [hex: :nimble_options, repo: "hexpm", optional: false]}, {:nimble_parsec, "~> 1.0", [hex: :nimble_parsec, repo: "hexpm", optional: false]}, {:phoenix_live_view, "~> 0.20.0 or ~> 1.0", [hex: :phoenix_live_view, repo: "hexpm", optional: true]}], "hexpm", "c57409fb6b34fbc58fbce0a6da670c9a4b5a2e94f86abdc56e9e213ed74620f2"}, "mdex_native": {:hex, :mdex_native, "0.2.7", "46203ee9c4fe2c94feef26e4d976235ad022b4770d3d307fa6b445d293b2571f", [:mix], [{:rustler, "~> 0.32", [hex: :rustler, repo: "hexpm", optional: true]}, {:rustler_precompiled, "~> 0.8", [hex: :rustler_precompiled, repo: "hexpm", optional: false]}], "hexpm", "05efa68775644ef6be6109f76c1f5f8778ff7e7ed9fe4a03541758158172bc77"}, "mime": {:hex, :mime, "2.0.7", "b8d739037be7cd402aee1ba0306edfdef982687ee7e9859bee6198c1e7e2f128", [:mix], [], "hexpm", "6171188e399ee16023ffc5b76ce445eb6d9672e2e241d2df6050f3c771e80ccd"}, - "mint": {:hex, :mint, "1.9.3", "3337184d69179695c7a9f1714d92c11e629d36c8c037a21cf490131d3d150554", [:mix], [{:castore, "~> 0.1.0 or ~> 1.0", [hex: :castore, repo: "hexpm", optional: true]}, {:hpax, "~> 0.1.1 or ~> 0.2.0 or ~> 1.0", [hex: :hpax, repo: "hexpm", optional: false]}], "hexpm", "5f7c9342480c069dbbc4eeac3490303c9e01870ff01a7f1d29b6107054fc1e74"}, + "mint": {:hex, :mint, "1.10.0", "85af3353bfc504f5bdfe494bd92b8490f87a306dc659ee1ad0af435107e898dc", [:mix], [{:castore, "~> 0.1.0 or ~> 1.0", [hex: :castore, repo: "hexpm", optional: true]}, {:hpax, "~> 0.1.1 or ~> 0.2.0 or ~> 1.0", [hex: :hpax, repo: "hexpm", optional: false]}], "hexpm", "8b16fb72aaa7531d206a1f05e4cc85509ba531ccec7a17a22736c9c95cbb24d1"}, "mix_audit": {:hex, :mix_audit, "2.1.5", "c0f77cee6b4ef9d97e37772359a187a166c7a1e0e08b50edf5bf6959dfe5a016", [:make, :mix], [{:jason, "~> 1.4", [hex: :jason, repo: "hexpm", optional: false]}, {:yaml_elixir, "~> 2.11", [hex: :yaml_elixir, repo: "hexpm", optional: false]}], "hexpm", "87f9298e21da32f697af535475860dc1d3617a010e0b418d2ec6142bc8b42d69"}, "multigraph": {:hex, :multigraph, "0.16.1-mg.4", "2bbe149f5411b0e3bf0624c7bf2e3da2738efeac2f9a67bbbcb807ab171f0a76", [:mix], [], "hexpm", "b9f3e2577cef4658eeedf97c76d22a86d33a7aab702a93c1da9c122e849e9037"}, "nimble_options": {:hex, :nimble_options, "1.1.1", "e3a492d54d85fc3fd7c5baf411d9d2852922f66e69476317787a7b2bb000a61b", [:mix], [], "hexpm", "821b2470ca9442c4b6984882fe9bb0389371b8ddec4d45a9504f00a66f650b44"},