maennchen
Hey everyone!
If your Elixir project lives on GitHub (public or private), there’s a new GitHub Action that might be worth adding to your CI setup:
erlef/mix-dependency-submission
This Action extracts your dependencies from your mix.exs / mix.lock and submits them to GitHub’s Dependency Submission API. That unlocks several useful GitHub features:
Dependabot alerts and security updates — including transitive deps
Full dependency graph visibility — even without lockfiles
Dependency Review — see what changed in PRs
Helps with auditing and compliance for third-party packages
Quick Example
Add this to your GitHub Actions workflow:
on:
push:
branches:
- "main"
jobs:
report_mix_deps:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: erlef/mix-dependency-submission@v1
OS Support
It works out-of-the-box on GitHub-hosted runners for:
- Linux (x64, ARM64)
- macOS (x64, ARM64)
- Windows (x64)
Check the README for full compatibility details.
The Action was built as part of the Erlang Ecosystem Foundation’s ongoing efforts to support the BEAM community’s tooling and security story. Feedback and adoption are super appreciated — especially if you’re managing multiple projects or teams.
Let me know if you try it out or run into any issues!
Where Next?
Trending in Discussions
Other Trending Topics
Latest on Elixir Forum
Sponsor Spotlight
Error tracking, logs, APM, uptime and cron monitoring in one dev-friendly platform. Find and fix problems before your users notice.
Categories:
Sub Categories:
Forums
Popular Tags
- #ecto
- #liveview
- #troubleshooting
- #learning-elixir
- #library
- #deployment
- #erlang
- #testing
- #genserver
- #mix
- #absinthe
- #remote-other
- #otp
- #plug
- #how-to-question
- #macros
- #postgres
- #elixirconf
- #channels
- #exunit
- #discussion
- #code-sync
- #podcasts
- #javascript
- #onsite
- #dialyzer
- #docker
- #authentication
- #umbrella
- #full-time-contract
- #podcasts-by-brainlid
- #ecto-query
- #elixirconf-us
- #ai
- #blog-post
- #elixir-ls
- #phoenix_html
- #iex
- #graphql
- #genstage
- #websockets
- #supervisor
- #advent-of-code
- #distillery
- #processes
- #api
- #forms
- #metaprogramming
- #hex
- #security
Our Sponsors
Supporting innovation across the BEAM ecosystem.
We build reliable cloud platforms for business-critical systems.
Catch errors, track performance, monitor hosts and more.
Error tracking, logs, uptime, and Just Enough APM. Built for developers.
Elixir, Erlang & BEAM conferences from Code Sync - join us in 2026!
Master modern tools, write cleaner code, and tackle real-world challenges.
Producing high quality Elixir screencasts since 2017.
**Building the future of software with AI, trust, and human connection.**
The team behind Membrane, Popcorn, LiveDebugger. Available for hire.
Courses that'll move you from confusion to "Aha, now I get it!"
Showing Posts 31 to 22- Show Best Posts
- Show All (oldest first)
- Show All (newest first)
maennchen
Unfortunately, no
SBoMs are doing this. We’re working on making this happen.
Benjamin-Philip
Is there a standard for tracking cross language dependencies? Like in the case of an NIF with Rust or C dependencies (leaving aside the lack of any uniformity with and C/C++ for now?
Benjamin-Philip
Wouldn’t the topmost lockfile of the root repo have the entire dependency tree? Then it is just a question of if the lockfile is included in the git repo or not.
Benjamin-Philip
This makes me feel like dependencies as code is both a blessing and a curse. It enables us to add/remove deps programmatically in ways that would be very difficult in other languages to do and at the same time makes a lot of basic and standard functionality so much harder to setup.
maennchen
Yes,
mix.exsfiles are arbitrary Elixir Code.mix.lockalways has the same format, but still is elixir code.Depending on the SCM (Git / Path, Hex, …), there will be an entry in the lockfile (optional) and it contains different content per SCM. For example, Hex saves the transitive dependencies, Git does not.
To get all the info out, I had to have mix running. (
Mix.in_project)dimitarvp
Oh, yeah, and in fact dependencies can, ahem, depend on the
Mix.env, true.Sigh. That really makes this whole ordeal more complex than it should have been.
EDIT: Though thinking of it, it still is not that bad. One can just grab their final
mix.lockand only work with that. That technically makes the whole thing automatable with any other programming language, no? Especially those that produce statically linked binaries like Golang and Rust.LostKobrakai
mix.exscan contain arbitrary elixir code. So you need an elixir compiler and runtime.dimitarvp
You are saying that it’s not enough to implement a parser for
mix.exsandmix.lockin another language because there is stuff from them that has to be ran / evaluated in the BEAM VM itself? And only through that to get all necessary info to do GitHub dependency submission?maennchen
Unfortunately the Mix Dependencies are not that simple. The files do not contain all the info and are written in Elixir.
I had to implement multiple strategies, one being an actual Mix Runtime that loads the project config:
https://github.com/erlef/mix-dependency-submission/tree/main/lib/mix_dependency_submission/fetcher
Benjamin-Philip
I wonder if they will have any concerns of introducing a new stack (Elixir + BEAM) into their build pipeline. I suspect they’d prefer a go binary or a ruby script both for CI and maintenance reasons. I guess we’ll know in time.