fix(docker): restore OTP crypto ABI compatibility

[plural-copilot]

Production signature

Unable to load crypto library. Failed with error:
"load_failed, Failed to load NIF library: 'Error loading shared library libcrypto.so.1.1: No such file or directory (needed by /opt/app/lib/crypto-5.0.5/priv/lib/crypto.so)'"
OpenSSL might not be installed on this system.
reason: {on_load_function_failed,crypto}

Root cause

v0.12.48 moved the root final runtime from an OTP/OpenSSL-1.1-era image to erlang:24.3.4.17-alpine while retaining the legacy bitwalker/alpine-elixir:1.13.4 builder. That builder packaged an OTP crypto NIF with an OpenSSL 1.1 dependency into a final runtime that provides OpenSSL 3, producing the startup failure above.

Fix and scope

• Applies to the shared root Dockerfile used by plural, cron, worker, and rtc.
• Pins both builder and final runtime to the verified amd64 digest for erlang:24.3.4.17-alpine.
• No exact hexpm/elixir tag exists for Elixir 1.13.4 with OTP 24.3.4.17, so the builder compiles the unchanged Elixir 1.13.4 source archive (SHA-256 verified) on that exact OTP/Alpine base.
• This preserves the low-risk Elixir 1.13 / OTP 24 / Distillery release model and causes the packaged OTP crypto NIF and final runtime to share the same OpenSSL ABI.
• Does not add OpenSSL 1.1, use a libcrypto SONAME symlink, alter app/Hex dependencies, touch Dockerfile.test, cherry-pick upgrade-elixir, or change live infrastructure.

Smoke gate and publication ordering

Added bin/smoke-image, which runs the actual final image with POD_IP and ERLANG_COOKIE and invokes a lightweight Distillery release eval:

Application.ensure_all_started(:crypto)

It does not foreground-start the application. Root publication paths now build one local artifact, smoke that same artifact, then push it:

• .github/workflows/publish.yaml release matrix
• .github/workflows/test.yaml backend root-image matrix (before its test-image push)
• Makefile root push path
• legacy .gitlab-ci.yml root image jobs

Trivy continues to scan the locally loaded root image in the test workflow.

Validation

• Verified that no exact hexpm/elixir Elixir 1.13.4 / OTP 24.3.4.17 tag is available.
• Built and crypto-smoked plural:abi-smoke for linux/amd64.
• Built and crypto-smoked cron:abi-smoke for linux/amd64.
• Inspected the final cron crypto NIF: it requires libcrypto.so.3 and does not require libcrypto.so.1.1.
• git diff --check, sh -n bin/smoke-image, and make -n push APP_NAME=plural APP_VSN=test passed.

Compatibility and rollback

This is an image-build and CI-publication ordering change only. It is ABI-safe because build and final OTP crypto artifacts originate from the same pinned runtime base. Roll back by reverting this single commit or republishing the prior working image; no infrastructure state is involved.

Limitations

A worker build attempt reached the deliberate five-minute sandbox timeout, and rtc was not run after that timeout. The sandbox did not provide Ruby for YAML parser validation. CI will execute the new smoke gate for all four root services before any publication.

[plural-copilot]

This PR was generated by the codex Plural Agent Runtime. Here's some useful information you might want to know to evaluate the ai's perfomance:

Name	Details
💬 Prompt	Create a single focused production-hotfix PR for the confirmed v0.12.48 Docker ABI regression. Do not touch live infrastructure, do not downgrade app/Hex dependencies, do not pin/downgrade merely to a release tag, and do not cherry-pick the broad upgrade-elixir branch....
🔗 Run history	View run history

[greptile-apps]

Greptile Summary

The PR aligns the Elixir builder and final runtime on the same pinned OTP/Alpine image to restore OpenSSL ABI compatibility. It also adds a final-image crypto smoke test and changes publication workflows to smoke locally loaded images before pushing their tags.

• Builds and SHA-256-verifies Elixir 1.13.4 from source on the pinned Erlang runtime.
• Adds a reusable Distillery crypto initialization smoke command.
• Applies build-smoke-push ordering across GitHub Actions, GitLab CI, and Make targets.

Confidence Score: 5/5

The PR appears safe to merge, with no concrete changed-code defect identified in the ABI alignment or smoke-before-push paths.

The builder and runtime use the same pinned OTP image, the release receives its application name before packaging, and each workflow smokes the same single-platform local image whose aliases are subsequently pushed.

Important Files Changed

Filename	Overview
Dockerfile	Pins matching builder/runtime images and compiles Elixir 1.13.4 from verified source so packaged OTP NIFs use the runtime OpenSSL ABI.
bin/smoke-image	Runs the final image with required VM environment and verifies that the packaged release can initialize the crypto application.
.github/workflows/publish.yaml	Loads each release image locally, smokes the loaded artifact, and then pushes all metadata-generated aliases.
.github/workflows/test.yaml	Moves backend image publication after the crypto smoke gate while retaining Trivy scanning of the locally loaded image.
Makefile	Adds a reusable smoke target and gates pushes for the four root application images.
.gitlab-ci.yml	Adds the crypto smoke gate to each legacy root-image build job before publication.

_{Reviews (1): Last reviewed commit: "fix(docker): pair OTP runtime and crypto..." | Re-trigger Greptile}