chore(#52): OSS/Hex packaging hygiene#56
Merged
Merged
Conversation
Add the Hex package metadata `mix hex.build` warns about, per the packaging checklist item in #52 (LICENSE already existed, Apache-2.0): - `package/0` in mix.exs: licenses, links, and a `files` whitelist so the 2.6M conformance `spec/` tree, tests, benchmarks, and Dockerfile stay out of the tarball (150K). `lib/mix/` is excluded too: the `bier.fixtures.load` task is dev-only, requires the excluded spec/ fixtures, and would surface in host apps' `mix help`. - `description` + `source_url` in project/0. - CHANGELOG.md (Keep a Changelog format) with an Unreleased summary of the current feature set, linked from the package metadata. - `docs/0` for ex_doc: README as the landing page, CHANGELOG and CONTRIBUTING as extras. Skip autolinking the two `@moduledoc false` internals the README mentions, and skip undefined-reference warnings for CONTRIBUTING.md (it points at the repo-internal docs/CONFORMANCE_IMPL.md), keeping `mix docs --warnings-as-errors` green. `mix hex.build` now builds warning-free. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
`mix hex.audit` (Hex >= 2.5) flags both locked versions: - hpax 1.0.3 — CVE-2026-58226 (HIGH): unauthenticated DoS via unbounded HPACK integer decoding. - mint 1.9.0 — CVE-2026-56810 (HIGH): entire chunked response chunk buffered in memory in Mint.HTTP1.decode_body/5. Patch releases fix both; audit is clean afterwards. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Tackles the OSS/Hex packaging hygiene checklist item from #52.
What changed
package/0inmix.exs—licenses(Apache-2.0, theLICENSEfile already existed),links(GitHub + Changelog), and afileswhitelist. The 2.6M conformancespec/tree, tests, benchmarks, and Dockerfile stay out; the tarball is 150K.lib/mix/is additionally excluded viaexclude_patterns:mix bier.fixtures.loadis the dev-only conformance-fixture loader, hard-fails without the excludedspec/conformance/fixtures.sql, and dependency mix tasks would otherwise surface in host apps'mix help.description+source_urlinproject/0.CHANGELOG.md— Keep a Changelog format, with an Unreleased section summarizing the current feature set (nothing published to Hex yet).docs/0for ex_doc — README as the landing page, CHANGELOG and CONTRIBUTING as extras. Two targeted suppressions keepmix docs --warnings-as-errorsgreen:skip_code_autolink_tofor the@moduledoc falseinternals the README mentions (Bier.Application,Bier.schema/0), andskip_undefined_reference_warnings_onfor CONTRIBUTING.md (it links the repo-internaldocs/CONFORMANCE_IMPL.md, deliberately not published).Verification
mix hex.buildbuilds warning-free; inspected the tarball contents to confirmspec/,test/, andlib/mix/are absent.mix precommitpasses except for 3 geojson conformance cases (1616–1618, missingtest.shops), which fail identically onmain— pre-existing local-environment issue (PostGIS fixture), unrelated to this change.🤖 Generated with Claude Code