chore: make ci happy

.circleci/config.yml

@@ -171,38 +171,66 @@ jobs:
       - run:
           name: "Check code formatting"
           command: |
-            sudo -u lightning mix format --check-formatted || echo "format" >> /tmp/lint_failed
+            mkdir -p /tmp/lint
+            sudo -u lightning mix format --check-formatted > /tmp/lint/format.log 2>&1 \
+              || echo "format" >> /tmp/lint_failed
+            cat /tmp/lint/format.log
       - run:
           name: "Check code style with Credo"
           when: always
           command: |
-            sudo -u lightning mix credo --strict --all || echo "credo" >> /tmp/lint_failed
+            mkdir -p /tmp/lint
+            sudo -u lightning mix credo --strict --all > /tmp/lint/credo.log 2>&1 \
+              || echo "credo" >> /tmp/lint_failed
+            cat /tmp/lint/credo.log
       - run:
           name: "Check for security vulnerabilities"
           when: always
           command: |
-            sudo -u lightning mix sobelow --threshold medium || echo "sobelow" >> /tmp/lint_failed
+            mkdir -p /tmp/lint
+            sudo -u lightning mix sobelow --threshold medium > /tmp/lint/sobelow.log 2>&1 \
+              || echo "sobelow" >> /tmp/lint_failed
+            cat /tmp/lint/sobelow.log
       - run:
           name: "Check for known-vulnerable Hex dependencies"
           when: always
           command: |
-            # GHSA-g2wm-735q-3f56: cowlib cookie encoder CRLF injection (low);
-            #   no patched release available yet.
+            mkdir -p /tmp/lint
+            # Ignored advisories (with rationale) live in .mix_audit.ignore so
+            # local runs and CI share one source of truth. Run the same command
+            # locally: mix deps.audit --ignore-file .mix_audit.ignore
             sudo -u lightning mix deps.audit \
-              --ignore-advisory-ids GHSA-g2wm-735q-3f56 \
+              --ignore-file .mix_audit.ignore \
+              > /tmp/lint/deps_audit.log 2>&1 \
               || echo "deps.audit" >> /tmp/lint_failed
+            cat /tmp/lint/deps_audit.log
       - run:
           name: "Check for retired Hex packages"
           when: always
           command: |
-            sudo -u lightning mix hex.audit || echo "hex.audit" >> /tmp/lint_failed
+            mkdir -p /tmp/lint
+            sudo -u lightning mix hex.audit > /tmp/lint/hex_audit.log 2>&1 \
+              || echo "hex.audit" >> /tmp/lint_failed
+            cat /tmp/lint/hex_audit.log
       - run:
           name: "Verify all checks passed"
           when: always
           command: |
             if [ -f /tmp/lint_failed ]; then
               echo "The following checks failed:"
               cat /tmp/lint_failed
+              echo
+              while IFS= read -r check; do
+                # map the check name to its captured log file
+                log="/tmp/lint/$(echo "$check" | tr '.' '_').log"
+                echo "==================== ${check} ===================="
+                if [ -f "$log" ]; then
+                  cat "$log"
+                else
+                  echo "(no output captured)"
+                fi
+                echo
+              done < /tmp/lint_failed
               exit 1
             fi
 

.mix_audit.ignore

@@ -0,0 +1,17 @@
+# Advisories intentionally ignored by `mix deps.audit`.
+# One advisory ID per line; `#` lines and blank lines are ignored.
+#
+# hackney: all four advisories are fixed in hackney 4.0.1, but we cannot
+# upgrade yet. hackney 4.x is a breaking API change, and our dependency graph
+# blocks it: tzdata (all releases, incl. latest 1.1.4) hard-pins
+# hackney ~> 1.17 and calls :hackney directly, and bumping to httpoison 3.0
+# (the release requiring hackney 4.x) is blocked by gcs_signed_url pinning
+# httpoison ~> 2.0. Revisit once tzdata ships a hackney-4.x compatible release.
+#   GHSA-gp9c-pm5m-5cxr (high)     ssl:connect post-handshake timeout
+#   GHSA-pj7v-xfvx-wmjq (moderate) SSRF allowlist bypass
+#   GHSA-j9wq-vxxc-94wf (moderate) CR/LF injection in query param
+#   GHSA-mp55-p8c9-rfw2 (low)      CRLF injection via domain/path
+GHSA-gp9c-pm5m-5cxr
+GHSA-pj7v-xfvx-wmjq
+GHSA-j9wq-vxxc-94wf
+GHSA-mp55-p8c9-rfw2

mix.exs

@@ -29,6 +29,7 @@ defmodule Lightning.MixProject do
         verify: :test
       ],
       compilers: Mix.compilers(),
+      hex: hex_audit(),
 
       # Docs
       name: "Lightning",
@@ -64,6 +65,37 @@ defmodule Lightning.MixProject do
   defp elixirc_paths(:test), do: ["lib", "test/support"]
   defp elixirc_paths(_), do: ["lib"]
 
+  # Advisories acknowledged for `mix hex.audit`. Each entry here has no
+  # reachable fix given our dependency graph; revisit whenever the noted
+  # blocker is lifted. IDs are matched against an advisory's primary ID or
+  # any alias, so the CVE form also silences the GHSA/EEF variants.
+  #
+  # hackney (fixed in 4.0.1): 4.x is a breaking API change and tzdata (all
+  #   releases, incl. 1.1.4) hard-pins hackney ~> 1.17. Unblock when tzdata
+  #   ships a hackney-4.x compatible release.
+  # cowlib: no patched release exists yet (latest is 2.18.0).
+  # req + swoosh: their fixes require mime ~> 2.0, but google_gax 0.4.1 (latest,
+  #   pulled by google_api_storage) hard-pins mime ~> 1.0. Unblock when the
+  #   Google API libraries support mime 2.x.
+  defp hex_audit do
+    [
+      ignore_advisories: [
+        # hackney
+        "CVE-2026-47071",
+        "CVE-2026-47075",
+        "CVE-2026-47076",
+        "CVE-2026-47069",
+        # cowlib
+        "CVE-2026-43966",
+        "CVE-2026-43969",
+        # req
+        "CVE-2026-49755",
+        # swoosh
+        "CVE-2026-54893"
+      ]
+    ]
+  end
+
   # Specifies your project dependencies.
   #
   # Type `mix help deps` for examples and options.