maennchen
Hey everyone!
If your Elixir project lives on GitHub (public or private), there’s a new GitHub Action that might be worth adding to your CI setup:
erlef/mix-dependency-submission
This Action extracts your dependencies from your mix.exs / mix.lock and submits them to GitHub’s Dependency Submission API. That unlocks several useful GitHub features:
Dependabot alerts and security updates — including transitive deps
Full dependency graph visibility — even without lockfiles
Dependency Review — see what changed in PRs
Helps with auditing and compliance for third-party packages
Quick Example
Add this to your GitHub Actions workflow:
on:
push:
branches:
- "main"
jobs:
report_mix_deps:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: erlef/mix-dependency-submission@v1
OS Support
It works out-of-the-box on GitHub-hosted runners for:
- Linux (x64, ARM64)
- macOS (x64, ARM64)
- Windows (x64)
Check the README for full compatibility details.
The Action was built as part of the Erlang Ecosystem Foundation’s ongoing efforts to support the BEAM community’s tooling and security story. Feedback and adoption are super appreciated — especially if you’re managing multiple projects or teams.
Let me know if you try it out or run into any issues!
Where Next?
Trending in Discussions
Other Trending Topics
Latest on Elixir Forum
Sponsor Spotlight
Bringing learning, work and compliance together since 1987.
Categories:
Sub Categories:
Forums
Popular Tags
- #ecto
- #liveview
- #troubleshooting
- #learning-elixir
- #deployment
- #library
- #erlang
- #testing
- #genserver
- #mix
- #absinthe
- #remote-other
- #otp
- #plug
- #how-to-question
- #macros
- #postgres
- #elixirconf
- #channels
- #exunit
- #discussion
- #code-sync
- #javascript
- #podcasts
- #onsite
- #dialyzer
- #docker
- #authentication
- #umbrella
- #full-time-contract
- #podcasts-by-brainlid
- #ecto-query
- #elixir-ls
- #blog-post
- #ai
- #phoenix_html
- #iex
- #elixirconf-us
- #graphql
- #genstage
- #websockets
- #supervisor
- #advent-of-code
- #distillery
- #processes
- #api
- #forms
- #hex
- #security
- #metaprogramming
Our Sponsors
Build Elixir applications with speed and confidence.
Supporting innovation across the BEAM ecosystem.
We build reliable cloud platforms for business-critical systems.
Catch errors, track performance, monitor hosts and more.
Error tracking, logs, uptime, and Just Enough APM. Built for developers.
Producing high quality Elixir screencasts since 2017.
Enabling companies to succeed by building software people love.
The deployment platform built for Elixir: PaaS ease, VPS control.
The team behind Membrane, Popcorn, LiveDebugger. Available for hire.
Courses that'll move you from confusion to "Aha, now I get it!"
Showing Posts 1 to 10- Show Best Posts
- Show All (oldest first)
- Show All (newest first)
Hermanverschooten
Could you maybe give some more info on how to use the result of this action?
I see the dependency tree output for example, but it is truncated.
maennchen
The interesting part is not in the action output, but rather in the GitHub Dependency Graph.
You can see that by going to the project / Insights / Dependency Graph.
As an example for
mix-dependency-submissionitself: Dependencies · erlef/mix-dependency-submission · Search for ecosystem:other · GitHubHere you can find the GitHub docs for the topic: Dependency graph - GitHub Docs
jhosteny
@maennchen this is awesome!
jjcarstens
@maennchen This is great and such perfect timing for us. We’ve been ramping up lots of security practices across all our repos and this helps get us one step closer to looking as shiny as the other natively support languages!
maennchen
Thanks everyone, I’m happy that this is received that well
Let me know if you have any issues, I’m happy to assist.
Hermanverschooten
It will be a default in all my apps in the future.
lud
Thank you
BartOtten
This is nice! Thank you so much.
Question: When a project is meant to augment Phoenix, it will have Phoenix as dependency. Does than mean it will receive dependabots alerts for transitive deps too?
I see I can not set or set install-deps to false, but then transitive deps (from other deps) are not checked too.
maennchen
Generally you will receive warnings for all your dependencies including transitive ones.
Depending on the project there will be no mix.lock file (like most libraries) checked in. Also some dependencies like git based ones do not record detailed information about their own deps in the mix.lock.
In those cases, the tool doesn’t know an exact picture about the dependency tree.
With install-deps you will fetch everything and therefore will have a perfect representation about all that.
jswanner
This is very cool!
I haven’t seen it explicitly specified anywhere, but if you use this GitHub Action to populate your dependency graph and you want to use that for Dependabot then you want to use
package-ecosystem: "github-actions"in yourdependabot.yml