ci: support latest platoforms

.github/workflows/codeql.yml

@@ -24,22 +24,22 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4.1.6
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@v2
+        uses: github/codeql-action/init@7e187e1c529d80bac7b87a16e7a792427f65cf02 # v2.15.5
         with:
           languages: ${{ matrix.language }}
           queries: +security-and-quality
 
-      - uses: erlef/setup-beam@v1
+      - uses: erlef/setup-beam@2f0cc07b4b9bea248ae098aba9e1a8a1de5ec24c # v1.17.5
         with:
           otp-version: 24.3.4
 
       - name: Build cpp
         run: make build-nif
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@v2
+        uses: github/codeql-action/analyze@7e187e1c529d80bac7b87a16e7a792427f65cf02 # v2.15.5
         with:
           category: "/language:${{ matrix.language }}"

.github/workflows/cover.yaml

@@ -6,7 +6,7 @@ jobs:
 
   build:
     name: Build
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-latest
     strategy:
       matrix:
         otp:
@@ -21,9 +21,9 @@ jobs:
           - x86_64
     steps:
     - name: Checkout
-      uses: actions/checkout@v3
+      uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4.1.6
 
-    - uses: erlef/setup-beam@v1
+    - uses: erlef/setup-beam@2f0cc07b4b9bea248ae098aba9e1a8a1de5ec24c # v1.17.5
       with:
         otp-version: ${{ matrix.otp }}
         rebar3-version: ${{ matrix.rebar3 }}
@@ -34,7 +34,7 @@ jobs:
         make cover
 
     - name: Coveralls C
-      uses: coverallsapp/github-action@v2
+      uses: coverallsapp/github-action@643bc377ffa44ace6394b2b5d0d3950076de9f63 # v2.3.0
       with:
         github-token: ${{ secrets.GITHUB_TOKEN }}
         flag-name: run-c-lcov
@@ -50,7 +50,7 @@ jobs:
         make cover
 
     - name: Coveralls C
-      uses: coverallsapp/github-action@v2
+      uses: coverallsapp/github-action@643bc377ffa44ace6394b2b5d0d3950076de9f63 # v2.3.0
       with:
         github-token: ${{ secrets.GITHUB_TOKEN }}
         flag-name: run-c-lcov-feature
@@ -65,7 +65,7 @@ jobs:
       run: rebar3 as test coveralls send
 
     - name: Coveralls Finished
-      uses: coverallsapp/github-action@v2
+      uses: coverallsapp/github-action@643bc377ffa44ace6394b2b5d0d3950076de9f63 # v2.3.0
       with:
         github-token: ${{ secrets.GITHUB_TOKEN }}
         parallel-finished: true

.github/workflows/hex_pub.yml

@@ -5,12 +5,12 @@ on:
 
 jobs:
   publish:
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-latest
     steps:
       - name: Check out
-        uses: actions/checkout@v3
+        uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4.1.6
 
       - name: Publish to Hex.pm
-        uses: erlangpack/github-action@v3
+        uses: erlangpack/github-action@09d8fc9cc3563f04a128311d627c60dfadc75493 # v3
         env:
           HEX_API_KEY: ${{ secrets.HEX_API_KEY }}

.github/workflows/lux.yml

@@ -3,20 +3,21 @@ on: [push, pull_request]
 
 jobs:
   run-lux-tests:
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-latest
     strategy:
       matrix:
         otp:
-          - 24.3.4
           - 25.3.2
+          - 26.2.1
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4.1.6
         with:
           submodules: recursive
-      - uses: erlef/setup-beam@v1
+      - uses: erlef/setup-beam@2f0cc07b4b9bea248ae098aba9e1a8a1de5ec24c # v1.17.5
         with:
           otp-version: ${{ matrix.otp }}
+          rebar3-version: 3.23.0
 
       - name: build lux
         run: |

.github/workflows/main.yml

@@ -6,14 +6,14 @@ jobs:
     name: Formatting Check
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4.1.6
     - name: Run clang-format style check for C/C++/Protobuf programs.
-      uses: jidicula/clang-format-action@v4.11.0
+      uses: jidicula/clang-format-action@c74383674bf5f7c69f60ce562019c1c94bc1421a # v4.13.0
       with:
         clang-format-version: '13'
         check-path: 'c_src'
     - name: Prepare OTP and rebar3
-      uses: erlef/setup-beam@v1
+      uses: erlef/setup-beam@2f0cc07b4b9bea248ae098aba9e1a8a1de5ec24c # v1.17.5
       with:
         otp-version: 26
         rebar3-version: 3.20.0
@@ -28,18 +28,18 @@ jobs:
       fail-fast: false
       matrix:
         os:
-          - macos-12
+          - macos-14
         otp:
           - 25
           - 26
     runs-on: ${{ matrix.os }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4.1.6
         with:
           submodules: recursive
       - name: Configure Homebrew cache
-        uses: actions/cache@v3
+        uses: actions/cache@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 # v4.0.2
         with:
           path: |
             ~/Library/Caches/Homebrew/
@@ -49,10 +49,11 @@ jobs:
         run: |
           export HOMEBREW_NO_INSTALLED_DEPENDENTS_CHECK=1
           brew install erlang@${{ matrix.otp }}
+          echo "$(brew --prefix erlang@${{ matrix.otp }})/bin" >> $GITHUB_PATH
       - name: release build
         run: |
-          wget https://s3.amazonaws.com/rebar3/rebar3 && chmod +x rebar3
-          export PATH="$PWD:/usr/local/opt/erlang@${{ matrix.otp }}/bin:$PATH"
+          wget https://s3.amazonaws.com/rebar3/rebar3
+          sudo mv rebar3 /usr/local/bin/ && sudo chmod +x /usr/local/bin/rebar3
           erl -eval 'erlang:display(erlang:system_info(system_version)),halt()'
           ulimit -c unlimited
           # run sudo for getting coredump
@@ -69,7 +70,7 @@ jobs:
           fi
 
       - name: Archive CT Logs
-        uses: actions/upload-artifact@v2
+        uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # v4.3.3
         if: failure()
         with:
           name: mac-ct-logs
@@ -79,14 +80,14 @@ jobs:
 
   linux:
     needs: formatting-check
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-latest
     timeout-minutes: 25
     strategy:
       fail-fast: false
       matrix:
         otp:
           - 25.3.2
-          - 26.1.2
+          - 26.2.1
           - OTP-27.0-rc3
         openssl:
           - openssl3
@@ -103,10 +104,10 @@ jobs:
           - x86_64
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4.1.6
         with:
           submodules: recursive
-      - uses: erlef/setup-beam@v1
+      - uses: erlef/setup-beam@2f0cc07b4b9bea248ae098aba9e1a8a1de5ec24c # v1.17.5
         with:
           otp-version: ${{ matrix.otp }}
           rebar3-version: ${{ matrix.rebar3 }}
@@ -159,7 +160,7 @@ jobs:
           fi
 
       - name: Archive CT Logs
-        uses: actions/upload-artifact@v3
+        uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # v4.3.3
         if: failure()
         with:
           name: linux-ct-logs

.github/workflows/release.yaml

@@ -24,13 +24,15 @@ jobs:
           - openssl3
           - openssl
         os:
+          - macos-14
+          - macos-13
           - macos-12
           - macos-12-arm64
     runs-on: ${{ matrix.os }}
     steps:
 
       - name: Configure Homebrew cache
-        uses: actions/cache@v3
+        uses: actions/cache@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 # v4.0.2
         with:
           path: |
             ~/Library/Caches/Homebrew/
@@ -40,7 +42,7 @@ jobs:
         run: |
           export HOMEBREW_NO_INSTALLED_DEPENDENTS_CHECK=1
           brew install erlang@${{ matrix.otp }}
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4.1.6
         with:
           fetch-depth: 0
           ref: ${{ github.event.inputs.ref }}
@@ -56,10 +58,10 @@ jobs:
           export QUIC_TLS
           BUILD_RELEASE=1 make
 
-      - uses: actions/upload-artifact@v3
+      - uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # v4.3.3
         if: startsWith(github.ref, 'refs/tags/')
         with:
-          name: packages
+          name: quicer-${{ matrix.os }}-${{ matrix.otp }}-${{ matrix.openssl }}
           path: |
             _packages/*.gz
             _packages/*.gz.sha256
@@ -68,30 +70,32 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        builder:
-          - 5.2-7:1.15.7-25.3.2-2
-          - 5.2-7:1.15.7-26.1.2-1
+        otp:
+          - 25.3.2-2
+          - 26.2.1-2
         openssl:
           - openssl3
           - openssl
         arch:
           - amd64
           - arm64
         os:
+          - ubuntu24.04
           - ubuntu22.04
           - ubuntu20.04
           - ubuntu18.04
           - debian12
           - debian11
           - debian10
           - amzn2023
+          - amzn2
           - el9
           - el8
           - el7
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4.1.6
         with:
           fetch-depth: 0
 
@@ -100,24 +104,24 @@ jobs:
           wget https://s3.amazonaws.com/rebar3/rebar3 && chmod +x rebar3
           cp ./rebar3 /usr/local/bin/rebar3
 
-      - uses: docker/setup-buildx-action@v2
+      - uses: docker/setup-buildx-action@d70bba72b1f3fd22344832f00baa16ece964efeb # v3.3.0
 
-      - uses: docker/setup-qemu-action@v2
+      - uses: docker/setup-qemu-action@68827325e0b33c7199eb31dd4e31fbe9023e06e3 # v3.0.0
         with:
           platforms: ${{ matrix.arch }}
 
       - name: build release
         if: startsWith(github.ref, 'refs/tags/')
         run: |
-          IMAGE=ghcr.io/emqx/emqx-builder/${{ matrix.builder }}-${{ matrix.os }}
+          IMAGE=ghcr.io/emqx/emqx-builder/5.3-5:1.15.7-${{ matrix.otp }}-${{ matrix.os }}
           docker run -i --rm -v $(pwd):/wd --workdir /wd --platform=linux/${{ matrix.arch }} \
           -e BUILD_RELEASE=1 -e QUIC_TLS=${{ matrix.openssl }} \
           $IMAGE bash -euc 'git config --global --add safe.directory /wd; make'
 
-      - uses: actions/upload-artifact@v3
+      - uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # v4.3.3
         if: startsWith(github.ref, 'refs/tags/')
         with:
-          name: packages
+          name: quicer-${{ matrix.os }}-${{ matrix.arch }}-${{ matrix.otp }}-${{ matrix.openssl }}
           path: |
             _packages/*.gz
             _packages/*.gz.sha256
@@ -129,12 +133,13 @@ jobs:
       - linux
     if: startsWith(github.ref, 'refs/tags/')
     steps:
-      - uses: actions/download-artifact@v3
+      - uses: actions/download-artifact@65a9edc5881444af0b9093a5e628f2fe47ea3b2e # v4.1.7
         with:
-          name: packages
+          pattern: 'quicer-*'
           path: packages
+          merge-multiple: true
       - name: Create Release
-        uses: softprops/action-gh-release@v1
+        uses: softprops/action-gh-release@69320dbe05506a9a39fc8ae11030b214ec2d1f87 # v2.0.5
         with:
           name: quicer ${{ github.ref_name }} Released
           body: quicer ${{ github.ref_name }} Released