Ecosyste.ms: Awesome
An open API service indexing awesome lists of open source software.
https://github.com/bwireman/go-over
A tool to audit Erlang & Elixir dependencies, to make sure your ✨ gleam projects really sparkle!
https://github.com/bwireman/go-over
audit beam cli dependencies dependency elixir erlang ghsa gleam javascript security security-audit security-tools tools vulnerable
Last synced: 2 months ago
JSON representation
A tool to audit Erlang & Elixir dependencies, to make sure your ✨ gleam projects really sparkle!
- Host: GitHub
- URL: https://github.com/bwireman/go-over
- Owner: bwireman
- License: mit
- Created: 2024-05-18T22:58:19.000Z (7 months ago)
- Default Branch: main
- Last Pushed: 2024-09-25T00:39:13.000Z (3 months ago)
- Last Synced: 2024-09-30T03:41:41.445Z (2 months ago)
- Topics: audit, beam, cli, dependencies, dependency, elixir, erlang, ghsa, gleam, javascript, security, security-audit, security-tools, tools, vulnerable
- Language: Gleam
- Homepage: https://hex.pm/packages/go_over
- Size: 2.74 MB
- Stars: 5
- Watchers: 1
- Forks: 0
- Open Issues: 0
-
Metadata Files:
- Readme: README.md
- License: LICENSE
Awesome Lists containing this project
- awesome-gleam - go_over - [📚](https://hexdocs.pm/go_over/) - A tool to audit Erlang & Elixir dependencies, to make sure your gleam projects really sparkle! ✨ (Packages / Project Tooling)
- awesome-ccamel - bwireman/go-over - A tool to audit Erlang & Elixir dependencies, to make sure your ✨ gleam projects really sparkle! (Gleam)
README
# 🕵️♂️ go_over
[](https://hex.pm/packages/go_over)
[](https://hexdocs.pm/go_over/)
[](https://github.com/bwireman/over/blob/main/LICENSE)
[](https://gleam.run/news/v0.16-gleam-compiles-to-javascript/)
[](https://gleam.run)
A tool to audit Erlang & Elixir dependencies, to make sure your ✨ gleam projects really sparkle!
🚨 _**NOTE**_: security advisories are _NOT_ currently monitored for gleam dependencies. The language, while excellent, is far too new and niche
# 🔽 Install
```sh
gleam add --dev go_over
```
## 📣 Also!
- add `.go-over/` to your `.gitignore`
- make sure `git` & `curl` are installed
#### 🌸 Javascript
If running with Javascript install
```json
{
"devDependencies": {
"yaml": "^2.4.3"
}
}
```
Bun, Deno & Nodejs are _all_ supported!
# ▶️ Usage
```sh
gleam run -m go_over
```
### 🎥 Obligatory Asciinema
### 🏴 Flags
Override config values if set
- `--force`: will force pulling new data even if the cached data is still valid
- `--format=`: specify the output format of any warnings. `["minimal", "detailed", "json"]`
- `--outdated`: will _additionally_ check if newer versions of dependencies exist
- `--ignore-indirect`: will ignore all warnings for indirect dependencies
### ⚙️ Config
Optional settings that can be added to your project's `gleam.toml`
```toml
[go-over]
# disables caching if false
# default: true
cache = true
# sets output format for warnings ["minimal", "detailed", "json"]
# default: "minimal"
format = "minimal"
# will additionally check if newer versions of dependencies exist
# default: false
outdated = false
# will ignore all warnings for indirect dependencies
# default: false
ignore_indirect = false
[go-over.ignore]
# list of package names to skip when auditing dependencies
# default: []
packages = ["example_package"]
# list of warning severities to skip when auditing dependencies
# default: []
# (case insensitive)
severity = ["example_moderate"]
# list of advisory IDs to skip when auditing dependencies
# default: []
ids = ["GHSA-xxxx-yyyy-zzzz"]
```
### ⌛ Caching
- Security advisory data is cached for **_six_** hours
- hex.pm retired package data is cached for **_one_** hour
## 🪝 pre-commit hooks
You can add go_over to you're pre-commit hooks by installing [🌵cactus](https://hex.pm/packages/cactus) & then adding this to your `gleam.toml`
```toml
[cactus.pre-commit]
actions = [
{ command = "go_over", kind = "module", args=["--outdated"] ,
]
```
## ⚙️ CI
You can also schedule daily runs to keep your deps up to date and open issues when necessary! [Example ▶️](https://github.com/bwireman/go-over/blob/main/.github/workflows/deps.yml)
# 🖌️ Other Art
- As I'm sure is no surprise this tool is inspired by (and all around worse than) [mirego/mix_audit](https://github.com/mirego/mix_audit). Please check it out!
- It also draws inspiration from [mix hex.audit](https://hexdocs.pm/hex/Mix.Tasks.Hex.Audit.html)
# ⚖️ License
- This tool uses [mirego/elixir-security-advisories](https://github.com/mirego/elixir-security-advisories) which is it self licensed with
- `BSD-3-Clause license`
- `CC-BY 4.0 open source license`.
- See their [#license section](https://github.com/mirego/elixir-security-advisories?tab=readme-ov-file#license)
- Code original to this repo is Licensed under `MIT`