Add a shared OTP/Elixir toolchain preparation job

[nelsonkopliku]

Description

Adding shared composite actions that web and wanda can use to:

• define otp/elixir toolchain with the possibility to add backward compatibility (actions/elixir-toolchain)
• setup otp/elixir and restore the deps cache (actions/setup-elixir)
• build otp/elixir deps on a cache miss (actions/setup-elixir with build-deps: "true")

Callers define their own toolchain and deps jobs.

See usages in:

• Use shared OTP toolchain matrix web#4850
• Use shared OTP toolchain matrix wanda#799

[Copilot]

Copilot review overview

🟡 Changes recommended

The dependency workflow references a mutable feature branch, and valid multiline environment values currently break export processing.

Review effort: Balanced
Findings: 2 · 2

Open (4)

• Support multiline values when writing GITHUB_ENV · New
• Pin the reusable workflow to the first release commit SHA · New
• Correct the actions/cache version annotation · New
• Set MIX_ENV and check out the repository before caching · New

What changed in this PR

Adds shared OTP/Elixir workflows and caching for Trento repositories.

Changes:

• Computes development and backward-compatible toolchain matrices.
• Builds and caches dependencies across MIX_ENV values.
• Documents usage and release pinning.

File	Description
.github/​workflows/​elixir-toolchain.yaml	Computes shared toolchain outputs.
.github/​workflows/​elixir-deps.yaml	Builds matrix dependencies and caches.
actions/​setup-elixir/​action.yaml	Sets up BEAM and restores caches.
docs/​elixir-toolchain.md	Documents integration and releases.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Copilot review overview

🔵 Needs a closer look

Extra environment keys require validation to prevent malformed or incorrectly exported variables.

Review effort: Balanced
Findings: None

Resolved since last review (4)

• Pin the reusable workflow to the first release commit SHA
• Support multiline values when writing GITHUB_ENV
• Set MIX_ENV and check out the repository before caching
• Correct the actions/cache version annotation

Previously missed (1)

In code that hasn't changed since last review

Validate environment variable keys before serialization

.github/​workflows/​elixir-deps.yaml:55

The env contract accepts arbitrary JSON object keys, but the KEY=VALUE environment-file format cannot represent them safely. For example, {"A=B":"x"} is parsed as variable A with value B=x, while an empty key makes the runner reject the file. Validate keys as environment-variable names before serializing them so invalid input fails explicitly instead of exporting the wrong environment.

[Copilot]

Copilot review overview

🟡 Changes recommended

The acknowledged feature-branch action references still need replacement before merge.

Review effort: Balanced
Findings: None

[antgamdia]

Thank you! LGTM, seems like a great way to extract the complexity to a shared place. Good to see some tests as well!

+1-ing, but please hold unitl more ppl more familiar with this stack chime in.

[arbulu89]

Looks nice @nelsonkopliku !

Didn't expect to see tests for CI, but well, they are welcomed hehe

PD: Are the all @shared-elixir-otp-toolchain-matrix suffixes to be removed? I guess they are there to enable testing

[nelsonkopliku]

PD: Are the all @shared-elixir-otp-toolchain-matrix suffixes to be removed? I guess they are there to enable testing

Yes, they will go away.
I will follow these steps https://github.com/trento-project/.github/pull/49/changes#diff-86f180fff528bfe8728c351b08dba09b082bcd56a8e1516dbfe50238e8e2e394R76

• merge
• make a release
• pin to the new sha
• make another release
• update web and wanda with the reference to the latest release

[anmazzotti]

Awesome work! Thank you for including the documentation and the tests as well.

suggestion (non-blocking): The drawback of having a workflow layer is as documented that it requires a 2-releases process. Since elixir-deps and elixir-toolchain seem to always be invoked together, I was wondering if it's possible to release one (big) action only containing all the steps.

[nelsonkopliku]

Great feedback @anmazzotti, thanks!

This way we don't need the double release, which is waaay better.

So next steps would be

• merge
• make a release
• update web and wanda with the reference to the latest release

[Copilot]

Copilot review overview

🟡 Changes recommended

Toolchain computation can incorrectly use inherited version variables when .tool-versions omits an entry.

Review effort: Balanced
Findings: 1

Open (1)

• Prevent inherited tool versions from bypassing missing .tool-versions validation · New

[anmazzotti]

Thank you for addressing the release remark and also for implementing the one action flavor, I needed to see it to figure out it wouldn't work as well.

[Copilot]

Copilot review overview

🔵 Needs a closer look

The cache can remain stale when project manifests change, and the usage example omits its documented credential safeguards.

Review effort: Balanced
Findings: None

Resolved since last review (1)

• Prevent inherited tool versions from bypassing missing .tool-versions validation

Previously missed (2)

In code that hasn't changed since last review

Cache key omits mix.exs dependency declarations

actions/​setup-elixir/​action.yaml:60

The cache key ignores dependency declarations in mix.exs. Changes such as adding a path dependency can leave mix.lock unchanged, so this remains an exact hit and the build-deps steps are skipped, leaving the restored dependency tree incomplete. Hash the project manifests (including umbrella children) as well as lockfiles.

Test job lacks read-only permissions and credential persistence safeguards

docs/​elixir-toolchain.md:82

The test example drops both safeguards used for the dependency-build job. A typical following mix test executes dependency code while checkout's credential remains available in the local Git configuration; with writable default token permissions, that code can use the token. Add read-only permissions and disable credential persistence here as well.