🕵️‍♂️ go_over

A tool to audit Erlang & Elixir dependencies, to make sure your ✨ gleam projects really sparkle!

🚨 NOTE: security advisories are NOT currently monitored for gleam dependencies. The language, while excellent, is far too new and niche

🔽 Install

gleam add --dev go_over

📣 Also!

• add .go-over/ to your .gitignore
• make sure git & curl are installed

🌸 Javascript

If running with Javascript install

{
  "devDependencies": {
    "yaml": "^2.4.3"
  }
}

Bun, Deno & Nodejs are all supported!

▶️ Usage

gleam run -m go_over

🎥 Obligatory Asciinema

🏴 Flags

Override config values if set

• --force: will force pulling new data even if the cached data is still valid
• --format=<format>: specify the output format of any warnings. ["minimal", "detailed", "json"]
• --outdated: will additionally check if newer versions of dependencies exist
• --ignore-indirect: will ignore all warnings for indirect dependencies

⚙️ Config

Optional settings that can be added to your project's gleam.toml

[go-over]
# disables caching if false
# default: true
cache = true
# sets output format for warnings ["minimal", "detailed", "json"]
# default: "minimal"
format = "minimal"
# will additionally check if newer versions of dependencies exist
# default: false
outdated = false
# will ignore all warnings for indirect dependencies
# default: false
# DEPRECATED use go-over.ignore.indirect instead
ignore_indirect = false

[go-over.ignore]
# will ignore all warnings for indirect dependencies
# default: false
indirect = false
# will ignore all warnings for dev-dependencies. Note: to ignore indirect dependencies regardless of source see go-over.ignore.indirect
# default: false
dev_dependencies = false
# list of package names to skip when auditing dependencies
# default: []
packages = ["example_package"]
# list of warning severities to skip when auditing dependencies
# default: []
# (case insensitive)
severity = ["example_moderate"]
# list of advisory IDs to skip when auditing dependencies
# default: []
ids = ["GHSA-xxxx-yyyy-zzzz"]

⌛ Caching

• Security advisory data is cached for six hours
• hex.pm retired package data is cached for one hour

🪝 pre-commit hooks

You can add go_over to you're pre-commit hooks by installing 🌵cactus & then adding this to your gleam.toml

[cactus.pre-commit]
actions = [
    { command = "go_over", kind = "module", args=["--outdated"] },
]

⚙️ CI

You can also schedule daily runs to keep your deps up to date and open issues when necessary! Example ▶️

🖌️ Other Art

• As I'm sure is no surprise this tool is inspired by (and all around worse than) mirego/mix_audit. Please check it out!
• It also draws inspiration from mix hex.audit

⚖️ License

• This tool uses mirego/elixir-security-advisories which is it self licensed with

  • BSD-3-Clause license
  • CC-BY 4.0 open source license.
  • See their #license section

• Code original to this repo is Licensed under MIT