ci: add Credo static analysis and mix_audit dep security (CRY-57) - #145
Merged
Conversation
Adds:
- {:credo, "~> 1.7"} for Elixir static analysis
- {:mix_audit, "~> 2.1"} for dependency security advisory scanning
- app/.credo.exs with baseline configuration:
- AliasUsage disabled (codebase uses full paths intentionally in Ash DSL)
- SpecWithStruct disabled (follow-up to migrate @specs to t() types)
- Nesting threshold raised to 3 (fn/case nesting is idiomatic here)
- elixirc_options: [warnings_as_errors: true] in test env to prevent
compiler-warning regressions
Part of CRY-57.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Fix all Credo findings in the existing codebase: - Replace escaped-quote strings with ~s[] sigils in favorites.ex, oban_repo.ex, and rollover.ex (StringSigils check) - Convert single-condition cond do blocks to if/else in profile_defaults_test.exs (CondStatements check) Part of CRY-57. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Extends the mix ci task (and the ci.yaml comment that documents it) with two new steps: - Step 3: mix deps.audit — checks Mix deps against the Elixir security advisory database (complementary to hex.audit's retirement checks) - Step 5: mix credo --strict — static analysis across all source files Steps run before mix test to fail fast on analysis before the slower test suite. Closes CRY-57. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
bougyman
force-pushed
the
CRY-57-static-analysis-and-dep-security
branch
from
August 18, 2026 17:04
b643186 to
060a10e
Compare
The rebase onto main pulled in CRY-58's normalization which collapsed a two-clause with into a single-clause with/else. Credo WithSingleClause flags single-clause with + else blocks; convert to case to satisfy it. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
credo ~> 1.7andmix_audit ~> 2.1toapp/mix.exsapp/.credo.exswith a project-appropriate baseline config:AliasUsagedisabled (codebase intentionally uses full paths in Ash DSL contexts)SpecWithStructdisabled (follow-up ticket to migrate @specs to propert()types)Nestingthreshold raised to 3 (anonymous-function/case nesting is idiomatic Elixir here)elixirc_options: [warnings_as_errors: Mix.env() == :test]to prevent new compiler-warning regressions in CImix deps.audit(step 3) andmix credo --strict(step 5) into themix ciquality gate, beforemix testfor fail-fast behaviour"..."strings with 4+ escaped quotes converted to~s[...]sigilscond doblocks in tests converted toif/elseTest plan
mix ciruns all 7 steps andmix credo --strictexits 0mix deps.auditexits 0 (no known vulnerabilities)Closes CRY-57.
🤖 Generated with Claude Code