Claudio Ortolina
49 lines
1.2 KiB
Markdown
49 lines
1.2 KiB
Markdown
---
|
|
id: ML-9
|
|
title: Add mix_audit dependency for CVE scanning
|
|
status: To Do
|
|
assignee: []
|
|
created_date: '2026-04-20 08:49'
|
|
labels: []
|
|
dependencies: []
|
|
references:
|
|
- 'https://github.com/cloud8421/music_library/issues/174'
|
|
priority: low
|
|
---
|
|
|
|
## Description
|
|
|
|
<!-- SECTION:DESCRIPTION:BEGIN -->
|
|
_GitHub: created 2026-04-16 · updated 2026-04-16_
|
|
|
|
## Summary
|
|
|
|
The project has Sobelow (SAST) and `mix hex.audit` (retirement-only check) but no CVE database scan against the installed dep tree.
|
|
|
|
## Evidence
|
|
|
|
- `mix.exs` does not list `mix_audit`
|
|
- `mise run dev:lint` pipeline does not include a CVE step
|
|
- `.github/workflows/test_and_deploy.yml` lint job does not run any CVE scanner
|
|
|
|
## Fix
|
|
|
|
Add `{:mix_audit, "~> 2.1", only: :dev, runtime: false}` to `mix.exs` and wire into the lint pipeline:
|
|
|
|
```toml
|
|
# in mise.toml, under [tasks."dev:lint"] or as a new task
|
|
mix deps.audit
|
|
```
|
|
|
|
And add a step in `.github/workflows/test_and_deploy.yml` lint job.
|
|
|
|
## Acceptance Criteria
|
|
<!-- AC:BEGIN -->
|
|
- `mix deps.audit` runs in CI
|
|
- CI fails (or warns, TBD) on advisories
|
|
<!-- SECTION:DESCRIPTION:END -->
|
|
|
|
- [ ] #1 `mix deps.audit` runs in CI
|
|
- [ ] #2 CI fails (or warns, TBD) on advisories
|
|
<!-- AC:END -->
|