CI never runs the dependency audit or the coverage gate the repo defines #60

New issue

Open

opened 2026-11-03 18:52:31 +00:00 by skippy-bot · 0 comments

skippy-bot commented

2026-11-03 18:52:31 +00:00

Problem

The pull request pipeline runs mix test and mix hex.audit. hex.audit only checks whether a locked package has been retired, so a dependency with a published advisory passes, and mix test never reads test_coverage, so the 87 percent threshold is never evaluated. The local precommit alias does run deps.audit, which means the gate a contributor runs is stricter than the one that blocks a merge, and AGENTS.md says precommit mirrors CI.

Evidence

At 2f150f66:

.forgejo/workflows/ci.yml:190 is run: mix test and :193 is run: mix hex.audit.
mix.exs:199 wires precommit: ["format --check-formatted", "credo --strict", "deps.audit", "test"].
mix.exs:18 sets summary: [threshold: 87], and mix.exs:179 carries mix_audit.
AGENTS.md:20 documents the coverage gate and :21 says precommit mirrors CI.
.github/workflows/ci.yml:44 repeats the plain mix test in the mirror workflow.

Expected

The pipeline runs the advisory audit and the coverage threshold the repository defines, and AGENTS.md describes what actually runs.

How to verify

Set the threshold to 100, or pin a dependency with a known advisory, and watch the pipeline stay green. Then swap the two steps for mix deps.audit and mix test --cover and watch it fail on the same commit.

Acceptance criteria

CI runs mix deps.audit.
CI runs the suite through the coverage alias or --cover so the threshold applies.
AGENTS.md lists the steps CI actually runs.

Effort: S
Lens: ops

## Problem The pull request pipeline runs `mix test` and `mix hex.audit`. `hex.audit` only checks whether a locked package has been retired, so a dependency with a published advisory passes, and `mix test` never reads `test_coverage`, so the 87 percent threshold is never evaluated. The local `precommit` alias does run `deps.audit`, which means the gate a contributor runs is stricter than the one that blocks a merge, and AGENTS.md says precommit mirrors CI. ## Evidence At `2f150f66`: - `.forgejo/workflows/ci.yml:190` is `run: mix test` and `:193` is `run: mix hex.audit`. - `mix.exs:199` wires `precommit: ["format --check-formatted", "credo --strict", "deps.audit", "test"]`. - `mix.exs:18` sets `summary: [threshold: 87]`, and `mix.exs:179` carries `mix_audit`. - `AGENTS.md:20` documents the coverage gate and `:21` says precommit mirrors CI. - `.github/workflows/ci.yml:44` repeats the plain `mix test` in the mirror workflow. ## Expected The pipeline runs the advisory audit and the coverage threshold the repository defines, and AGENTS.md describes what actually runs. ## How to verify Set the threshold to 100, or pin a dependency with a known advisory, and watch the pipeline stay green. Then swap the two steps for `mix deps.audit` and `mix test --cover` and watch it fail on the same commit. ## Acceptance criteria - [ ] CI runs `mix deps.audit`. - [ ] CI runs the suite through the coverage alias or `--cover` so the threshold applies. - [ ] AGENTS.md lists the steps CI actually runs. **Effort:** S **Lens:** ops

skippy-bot added the

Medium

bug

effort: S

labels

2026-11-03 18:52:31 +00:00