From 87cc3a5ea954a508d2658401ad40500ac070c768 Mon Sep 17 00:00:00 2001 From: James Harton Date: Wed, 30 Sep 2026 14:18:33 +0200 Subject: [PATCH] ci: drop `mix deps.audit` from the audit job `mix hex.audit` now reports CVEs straight from hex.pm, and mix_audit's advisory database is a git checkout that drifts out of sync and fails spuriously. --- .github/workflows/elixir-ci.yml | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-) diff --git a/.github/workflows/elixir-ci.yml b/.github/workflows/elixir-ci.yml index 7a89b69..e90eff3 100644 --- a/.github/workflows/elixir-ci.yml +++ b/.github/workflows/elixir-ci.yml @@ -283,7 +283,7 @@ jobs: mix-env: test audit: - name: mix deps.audit + hex.audit + name: mix hex.audit runs-on: ubuntu-latest needs: build-test steps: @@ -294,10 +294,6 @@ jobs: sudo apt-get update sudo apt-get install -y ${{ inputs.os-packages }} - uses: team-alembic/staple-actions/actions/mix-hex-audit@eb07547a6626ccf508fb4b293b821fde0253ed4f # main - - uses: team-alembic/staple-actions/actions/mix-task@eb07547a6626ccf508fb4b293b821fde0253ed4f # main - with: - mix-env: test - task: deps.audit unused-deps: name: mix deps.unlock --check-unused