set up workload identity publish job for hex

.github/verify-release-versions.sh

@@ -0,0 +1,38 @@
+#!/usr/bin/env bash
+#
+# Verify that all package versions match a release tag
+#
+# Usage: ./verify-release-versions.sh <tag>
+# Example: ./verify-release-versions.sh v1.8.9
+
+set -euo pipefail
+
+TAG="${1:-}"
+
+if [[ -z "$TAG" ]]; then
+    echo "Usage: $0 <tag>" >&2
+    echo "Example: $0 v1.8.9" >&2
+    exit 1
+fi
+
+cd "$(dirname "$0")/.."
+
+TAG_VERSION="${TAG#v}"
+FAILED=0
+
+check_version() {
+    if [[ "$2" != "$TAG_VERSION" ]]; then
+        echo "::error file=$1::$1 has version '$2', but tag $TAG requires '$TAG_VERSION'."
+        FAILED=1
+    fi
+}
+
+mix_version() {
+    sed -n 's/^ *@version "\(.*\)"$/\1/p' "$1"
+}
+
+check_version mix.exs "$(mix_version mix.exs)"
+check_version installer/mix.exs "$(mix_version installer/mix.exs)"
+check_version package.json "$(jq -r .version package.json)"
+
+exit "$FAILED"

.github/workflows/assets.yml

@@ -18,8 +18,8 @@ jobs:
     runs-on: ubuntu-24.04
     timeout-minutes: 15
     env:
-      elixir: "1.20.4"
-      otp: "29.0.5"
+      elixir: "1.20.5"
+      otp: "29.1.2"
     permissions:
       contents: write # for stefanzweifel/git-auto-commit-action to push code in repo
     steps:

.github/workflows/ci.yml

@@ -24,8 +24,8 @@ jobs:
           - elixir: "1.18.4"
             otp: "27.3.4.13"
 
-          - elixir: "1.20.4"
-            otp: "29.0.5"
+          - elixir: "1.20.5"
+            otp: "29.1.2"
             lint: true
 
     runs-on: ubuntu-24.04
@@ -84,8 +84,8 @@ jobs:
           - elixir: "1.18.4"
             otp: "27.3.4.3"
 
-          - elixir: "1.20.4"
-            otp: "29.0.5"
+          - elixir: "1.20.5"
+            otp: "29.1.2"
 
     runs-on: ubuntu-24.04
     timeout-minutes: 20
@@ -155,8 +155,8 @@ jobs:
 
     env:
       MIX_ENV: docs
-      elixir: "1.20.4"
-      otp: "29.0.5"
+      elixir: "1.20.5"
+      otp: "29.1.2"
 
     runs-on: ubuntu-24.04
     timeout-minutes: 15
@@ -211,8 +211,8 @@ jobs:
             otp: "27.3.4.3"
 
           # keep version in sync with integration_test/.env
-          - elixir: "1.20.4"
-            otp: "29.0.5"
+          - elixir: "1.20.5"
+            otp: "29.1.2"
 
     env:
       ELIXIR_ASSERT_TIMEOUT: 10000
@@ -320,8 +320,8 @@ jobs:
       - name: Set up Elixir
         uses: erlef/setup-beam@54075bcc5e249e4758d363f27d099f55d843f124 # v1.24.1
         with:
-          elixir-version: "1.20.4"
-          otp-version: "29.0.5"
+          elixir-version: "1.20.5"
+          otp-version: "29.1.2"
 
       - name: Download summary artifacts
         uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2

.github/workflows/docs.yml

@@ -19,8 +19,8 @@ jobs:
     runs-on: ubuntu-24.04
     timeout-minutes: 15
     env:
-      elixir: "1.20.4"
-      otp: "29.0.5"
+      elixir: "1.20.5"
+      otp: "29.1.2"
     steps:
       - name: Checkout
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

.github/workflows/github_release.yml

@@ -22,6 +22,9 @@ jobs:
         with:
           persist-credentials: false
 
+      - name: Verify versions match the tag
+        run: bash .github/verify-release-versions.sh "$GITHUB_REF_NAME"
+
       - name: Extract changelog for version
         run: bash .github/extract-changelog.sh "$GITHUB_REF_NAME" > release_notes.md
 

.github/workflows/npm-publish.yml

@@ -22,6 +22,9 @@ jobs:
         with:
           persist-credentials: false
 
+      - name: Verify versions match the tag
+        run: bash .github/verify-release-versions.sh "$GITHUB_REF_NAME"
+
       # no cache: input is set, so nothing is restored into the publishing job
       - name: Set up Node.js # zizmor: ignore[cache-poisoning]
         uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
@@ -38,7 +41,7 @@ jobs:
         run: |
           TAG=${GITHUB_REF#refs/tags/}
           # Update this condition when bumping the major version!
-          if [[ $TAG == v1.7.* ]]; then
+          if [[ $TAG == v1.8.* ]]; then
             echo "tag=old-version" >> $GITHUB_OUTPUT
           elif [[ $TAG == *-rc* ]]; then
             echo "tag=rc" >> $GITHUB_OUTPUT

.github/workflows/publish.yml

@@ -0,0 +1,54 @@
+# https://hex.pm/blog/announcing-workload-identity-and-staged-publishing
+name: Release
+
+on:
+  push:
+    tags:
+      - "v*"
+
+permissions:
+  contents: read
+
+jobs:
+  publish:
+    runs-on: ubuntu-24.04
+    # mix hex.publish --wait has no deadline and waits for a person to approve
+    # each staged release, so this uses the GitHub-hosted job limit
+    timeout-minutes: 360
+    permissions:
+      contents: read
+      id-token: write # required for Hex workload identity
+    # The GitHub environment the workload identity names
+    environment: release
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Verify versions match the tag
+        run: bash .github/verify-release-versions.sh "$GITHUB_REF_NAME"
+
+      - name: Set up Elixir
+        uses: erlef/setup-beam@54075bcc5e249e4758d363f27d099f55d843f124 # v1.24.1
+        with:
+          elixir-version: "1.20.5"
+          otp-version: "29.1.2"
+
+      # the docs alias also builds the JavaScript documentation with npm
+      # no cache: input is set, so nothing is restored into the publishing job
+      - name: Set up Node.js # zizmor: ignore[cache-poisoning]
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
+        with:
+          node-version: "24.x"
+
+      - name: Publish phoenix
+        run: |
+          mix deps.get
+          MIX_ENV=docs mix hex.publish --yes --wait
+
+      - name: Publish phx_new
+        working-directory: installer
+        run: |
+          mix deps.get
+          MIX_ENV=docs mix hex.publish --yes --wait

integration_test/.env

@@ -4,4 +4,4 @@
 # Find Ubuntu image tags on Bob:
 # - Web UI: https://bob.hex.pm/docker?repo=hexpm/elixir&os=ubuntu&os_version=noble-&sort=elixir_version,erlang_version,os_version
 # - API: https://bob.hex.pm/api/docker?repo=hexpm/elixir&os=ubuntu&os_version=noble-&sort=elixir_version,erlang_version,os_version
-ELIXIR_IMAGE_TAG=1.20.4-erlang-29.0.5-ubuntu-noble-20260810
+ELIXIR_IMAGE_TAG=1.20.5-erlang-29.1.2-ubuntu-noble-20261024.1