Skip to content

chore: CI, community docs, dependency security upgrades and missing-binary handling - #1

Merged
developerfred merged 6 commits into
mainfrom
chore/repo-hygiene
Oct 18, 2026
Merged

developerfred merged 6 commits into
mainfrom
chore/repo-hygiene

Conversation

@developerfred

@developerfred developerfred commented Oct 18, 2026 •

Copy link
Copy Markdown
Owner

Summary

  • CI: GitHub Actions workflow (format check, --warnings-as-errors compile, tests, escript build, Docker build).
  • Community docs: CONTRIBUTING.md, CHANGELOG.md, CODE_OF_CONDUCT.md; ticked the completed items in VIRAL_STRATEGY.md.
  • Security: upgraded dependencies to clear the advisories reported by mix hex.audit (cowboy, cowlib, plug, plug_cowboy, phoenix, phoenix_live_view 0.20 -> 1.2, mint, hpax). One remains: cowlib EEF-CVE-2026-43966 (MEDIUM); 2.21.0 is the latest release and has no fix yet.
  • Docker: the image did not build or run (wrong Alpine package names, no Erlang runtime for the escript, and a deps.get alias in mix.exs that started the app during mix deps.get --only prod). Fixed, added .dockerignore.
  • Node: System.cmd raised :enoent when scrot/ffmpeg/notify-send/gpspipe were missing. All external commands now go through exec/exec_ok and return %{ok: false, error: "required command not found: <cmd>"}. Failed captures were previously reported as ok: true with a path to a file that was never written; they now fail honestly. Camera names with spaces (e.g. "FaceTime HD Camera") were rejected as :invalid_device and are now accepted.
  • Tests/warnings: fixed all compiler warnings, fixed GatewaySupervisorTest (it started a supervisor the app already runs and passed a keyword list where a map is expected), ran mix format. Tests needing real camera/screen/notification/GPS tooling are tagged :hardware and skipped unless ELIXIR_CLAW_HARDWARE_TESTS=1.

Test plan

  • mix format --check-formatted, mix compile --warnings-as-errors, mix test (76 tests, 16 :hardware excluded) on macOS
  • Same checks and tests in an elixir:1.19 Linux container
  • docker build and docker run ... --help
  • /api/* routes return 200 with the upgraded stack
  • GitHub Actions run on this PR

Known issue (not caused by this PR)

The LiveView pages (/, /nodes, ...) return 500 even on the original commit: the endpoint has no session plug / error view configured. Left for a separate change.

Group Node.execute clauses, drop unused code in LLM and Endpoint, and fix
GatewaySupervisorTest (reuse the app-supervised instance, pass a map config).
Tag hardware-dependent NodeTest cases with :hardware; skipped unless
ELIXIR_CLAW_HARDWARE_TESTS=1.
Use an Elixir runtime image (the escript needs Erlang), correct Alpine package
names, add .dockerignore, and drop the deps.get alias that started the app
during 'mix deps.get --only prod'.
GitHub Actions (format, warnings-as-errors, tests, escript, docker build),
CONTRIBUTING, CHANGELOG, CODE_OF_CONDUCT; tick completed VIRAL_STRATEGY items.
Update cowboy, plug, phoenix, mint, hpax and friends within their ranges and
bump phoenix_live_view to ~> 1.2. Replace the deprecated controller :namespace
option with formats: [:json]. Remaining: cowlib EEF-CVE-2026-43966 (no fixed
release yet).
…shing

System.cmd raised :enoent when scrot/ffmpeg/notify-send/gpspipe were missing,
and failed captures were reported as ok with a nonexistent path. Route all
external commands through exec/exec_ok, return %{ok: false, error: ...}, and
accept camera names with spaces. Tests simulate absent binaries via an empty
PATH.
@developerfred
developerfred merged commit 4d47501 into main Oct 18, 2026
4 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant