Hey everyone!

If your Elixir project lives on GitHub (public or private), there’s a new GitHub Action that might be worth adding to your CI setup:
erlef/mix-dependency-submission

This Action extracts your dependencies from your mix.exs / mix.lock and submits them to GitHub’s Dependency Submission API. That unlocks several useful GitHub features:

• Dependabot alerts and security updates — including transitive deps
• Full dependency graph visibility — even without lockfiles
• Dependency Review — see what changed in PRs
• Helps with auditing and compliance for third-party packages

Quick Example

Add this to your GitHub Actions workflow:

on:
  push:
    branches:
      - "main"

jobs:
  report_mix_deps:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: erlef/mix-dependency-submission@v1

OS Support

It works out-of-the-box on GitHub-hosted runners for:

• Linux (x64, ARM64)
• macOS (x64, ARM64)
• Windows (x64)

Check the README for full compatibility details.

The Action was built as part of the Erlang Ecosystem Foundation’s ongoing efforts to support the BEAM community’s tooling and security story. Feedback and adoption are super appreciated — especially if you’re managing multiple projects or teams.

Let me know if you try it out or run into any issues!