From 815b34c024ce4c457ef74832933e8b4a7334ec3c Mon Sep 17 00:00:00 2001 From: Claudio Ortolina Date: Fri, 24 Apr 2026 08:13:42 +0100 Subject: [PATCH] ML-9: add mix_audit for CVE scanning (warn-only) --- .github/workflows/test_and_deploy.yml | 3 +++ ...d-mix_audit-dependency-for-CVE-scanning.md | 23 ++++++++++++++++--- mix.exs | 1 + mix.lock | 3 +++ scripts/dev/lint | 3 +++ 5 files changed, 30 insertions(+), 3 deletions(-) diff --git a/.github/workflows/test_and_deploy.yml b/.github/workflows/test_and_deploy.yml index 6cbe3f66..a2e54c86 100644 --- a/.github/workflows/test_and_deploy.yml +++ b/.github/workflows/test_and_deploy.yml @@ -80,6 +80,9 @@ jobs: run: mix credo --strict - name: 👮 Run Sobelow run: mix sobelow + - name: 🛡️ Audit dependencies for CVEs + run: mix deps.audit + continue-on-error: true - name: 🐚 Run Shellcheck run: | fd . 'scripts/' --exclude '*.hurl' -t file --exec shellcheck --color diff --git a/backlog/tasks/ml-9 - Add-mix_audit-dependency-for-CVE-scanning.md b/backlog/tasks/ml-9 - Add-mix_audit-dependency-for-CVE-scanning.md index d85f7c83..1dc470b9 100644 --- a/backlog/tasks/ml-9 - Add-mix_audit-dependency-for-CVE-scanning.md +++ b/backlog/tasks/ml-9 - Add-mix_audit-dependency-for-CVE-scanning.md @@ -1,9 +1,10 @@ --- id: ML-9 title: Add mix_audit dependency for CVE scanning -status: To Do +status: Done assignee: [] created_date: '2026-04-20 08:49' +updated_date: '2026-04-24 07:13' labels: [] dependencies: [] references: @@ -43,6 +44,22 @@ And add a step in `.github/workflows/test_and_deploy.yml` lint job. - CI fails (or warns, TBD) on advisories -- [ ] #1 `mix deps.audit` runs in CI -- [ ] #2 CI fails (or warns, TBD) on advisories +- [x] #1 `mix deps.audit` runs in CI as a warn-only step (continue-on-error) +- [x] #2 `mix deps.audit` runs in `mise run dev:lint` as a warn-only step + +## Implementation Notes + + +Decision on fail-vs-warn: **warn-only** on both CI and local lint. Rationale: CVE databases evolve independently of the project, so a newly published advisory should surface quickly (annotation in CI) without blocking unrelated PRs or breaking `dev:lint` for devs who may not be able to remediate immediately (e.g. waiting on upstream fix). + +Changes: +- `mix.exs`: added `{:mix_audit, "~> 2.1", only: :dev, runtime: false}` alongside other dev-only quality tools (ex_slop, quokka, credo). +- `scripts/dev/lint`: added `mix deps.audit || true` between credo and gettext steps. +- `.github/workflows/test_and_deploy.yml`: added `🛡️ Audit dependencies for CVEs` step in the lint job with `continue-on-error: true`, placed after sobelow. + +Verification: +- `mix deps.get` resolved mix_audit 2.1.x plus yaml_elixir/yamerl transitive deps. +- `mix deps.audit` currently reports "No vulnerabilities found." — baseline clean. +- `shellcheck` passes on the updated `scripts/dev/lint`. + diff --git a/mix.exs b/mix.exs index 4aefbe7b..29a2fa7f 100644 --- a/mix.exs +++ b/mix.exs @@ -118,6 +118,7 @@ defmodule MusicLibrary.MixProject do {:benchee, "~> 1.3", only: :dev, runtime: false}, {:credo, "~> 1.7", only: [:dev, :test], runtime: false}, {:ex_slop, "~> 0.1", only: [:dev, :test], runtime: false}, + {:mix_audit, "~> 2.1", only: :dev, runtime: false}, {:quokka, "~> 2.6", only: [:dev, :test], runtime: false}, {:live_debugger, "~> 1.0", only: :dev}, {:usage_rules, "~> 1.1", only: [:dev]}, diff --git a/mix.lock b/mix.lock index 58bab1e7..a082a915 100644 --- a/mix.lock +++ b/mix.lock @@ -42,6 +42,7 @@ "mdex": {:hex, :mdex, "0.12.2", "e5f7a62543a7580f3ff55dc2f2953b0d0e74b4327d77d3710946eb1bc9a9b569", [:mix], [{:jason, "~> 1.0", [hex: :jason, repo: "hexpm", optional: false]}, {:lumis, "~> 0.1", [hex: :lumis, repo: "hexpm", optional: false]}, {:nimble_options, "~> 1.0", [hex: :nimble_options, repo: "hexpm", optional: false]}, {:nimble_parsec, "~> 1.0", [hex: :nimble_parsec, repo: "hexpm", optional: false]}, {:phoenix_live_view, "~> 1.0", [hex: :phoenix_live_view, repo: "hexpm", optional: true]}, {:rustler, "~> 0.32", [hex: :rustler, repo: "hexpm", optional: true]}, {:rustler_precompiled, "~> 0.7", [hex: :rustler_precompiled, repo: "hexpm", optional: false]}], "hexpm", "72cfea060dc9135d66149feb506c13db76da7d3303f3276493bb34482df8f340"}, "mime": {:hex, :mime, "2.0.7", "b8d739037be7cd402aee1ba0306edfdef982687ee7e9859bee6198c1e7e2f128", [:mix], [], "hexpm", "6171188e399ee16023ffc5b76ce445eb6d9672e2e241d2df6050f3c771e80ccd"}, "mint": {:hex, :mint, "1.7.1", "113fdb2b2f3b59e47c7955971854641c61f378549d73e829e1768de90fc1abf1", [:mix], [{:castore, "~> 0.1.0 or ~> 1.0", [hex: :castore, repo: "hexpm", optional: true]}, {:hpax, "~> 0.1.1 or ~> 0.2.0 or ~> 1.0", [hex: :hpax, repo: "hexpm", optional: false]}], "hexpm", "fceba0a4d0f24301ddee3024ae116df1c3f4bb7a563a731f45fdfeb9d39a231b"}, + "mix_audit": {:hex, :mix_audit, "2.1.5", "c0f77cee6b4ef9d97e37772359a187a166c7a1e0e08b50edf5bf6959dfe5a016", [:make, :mix], [{:jason, "~> 1.4", [hex: :jason, repo: "hexpm", optional: false]}, {:yaml_elixir, "~> 2.11", [hex: :yaml_elixir, repo: "hexpm", optional: false]}], "hexpm", "87f9298e21da32f697af535475860dc1d3617a010e0b418d2ec6142bc8b42d69"}, "multipart": {:hex, :multipart, "0.6.0", "73eae40ac88b67a8dd7cf6a2972762c1152470efeb0e18d68c7651f3f70c471b", [:mix], [{:mime, "~> 1.2 or ~> 2.0", [hex: :mime, repo: "hexpm", optional: false]}], "hexpm", "818366054b1ff7215b7c091b73859968aa16e9620ec4a8a79a3a7362960b72bf"}, "nimble_options": {:hex, :nimble_options, "1.1.1", "e3a492d54d85fc3fd7c5baf411d9d2852922f66e69476317787a7b2bb000a61b", [:mix], [], "hexpm", "821b2470ca9442c4b6984882fe9bb0389371b8ddec4d45a9504f00a66f650b44"}, "nimble_parsec": {:hex, :nimble_parsec, "1.4.2", "8efba0122db06df95bfaa78f791344a89352ba04baedd3849593bfce4d0dc1c6", [:mix], [], "hexpm", "4b21398942dda052b403bbe1da991ccd03a053668d147d53fb8c4e0efe09c973"}, @@ -85,4 +86,6 @@ "vix": {:hex, :vix, "0.38.0", "77529ee4f6ced339c3d5f90a9eacf306f5b7109d3d1b5e3ef391a984ad404f75", [:make, :mix], [{:cc_precompiler, "~> 0.1.4 or ~> 0.2", [hex: :cc_precompiler, repo: "hexpm", optional: false]}, {:elixir_make, "~> 0.7.3 or ~> 0.8", [hex: :elixir_make, repo: "hexpm", optional: false]}, {:kino, "~> 0.7", [hex: :kino, repo: "hexpm", optional: true]}], "hexpm", "dca58f654922fa678d5df8e028317483d9c0f8acb2e2714076a8468695687aa7"}, "websock": {:hex, :websock, "0.5.3", "2f69a6ebe810328555b6fe5c831a851f485e303a7c8ce6c5f675abeb20ebdadc", [:mix], [], "hexpm", "6105453d7fac22c712ad66fab1d45abdf049868f253cf719b625151460b8b453"}, "websock_adapter": {:hex, :websock_adapter, "0.5.9", "43dc3ba6d89ef5dec5b1d0a39698436a1e856d000d84bf31a3149862b01a287f", [:mix], [{:bandit, ">= 0.6.0", [hex: :bandit, repo: "hexpm", optional: true]}, {:plug, "~> 1.14", [hex: :plug, repo: "hexpm", optional: false]}, {:plug_cowboy, "~> 2.6", [hex: :plug_cowboy, repo: "hexpm", optional: true]}, {:websock, "~> 0.5", [hex: :websock, repo: "hexpm", optional: false]}], "hexpm", "5534d5c9adad3c18a0f58a9371220d75a803bf0b9a3d87e6fe072faaeed76a08"}, + "yamerl": {:hex, :yamerl, "0.10.0", "4ff81fee2f1f6a46f1700c0d880b24d193ddb74bd14ef42cb0bcf46e81ef2f8e", [:rebar3], [], "hexpm", "346adb2963f1051dc837a2364e4acf6eb7d80097c0f53cbdc3046ec8ec4b4e6e"}, + "yaml_elixir": {:hex, :yaml_elixir, "2.12.1", "d74f2d82294651b58dac849c45a82aaea639766797359baff834b64439f6b3f4", [:mix], [{:yamerl, "~> 0.10", [hex: :yamerl, repo: "hexpm", optional: false]}], "hexpm", "d9ac16563c737d55f9bfeed7627489156b91268a3a21cd55c54eb2e335207fed"}, } diff --git a/scripts/dev/lint b/scripts/dev/lint index 8ba360b8..81da6b7a 100755 --- a/scripts/dev/lint +++ b/scripts/dev/lint @@ -14,6 +14,9 @@ mix format debug_msg "Running credo..." mix credo +debug_msg "Auditing dependencies for CVEs (warn-only)..." +mix deps.audit || true + debug_msg "Extracting translations..." mix gettext.extract --merge