mix mob.security_scan.log (mob_dev v0.3.37)

Copy Markdown View Source

Scheduled-run helper for the security scan. Designed to be invoked by cron, GitHub Actions, or any other recurring trigger.

Each run does four things:

  1. Runs the full mix mob.security_scan against the project.
  2. Overwrites SECURITY_SCAN.md — a current-state snapshot you can point at to answer "what's the situation right now?".
  3. Prepends a changelog entry to SECURITY_HISTORY.md — newest at the top — describing what's New / Resolved / Still present since the last logged run.
  4. Updates the JSON state sidecar at .security_scan/state.json so the next run can compute its diff.

Commit all three files. The state file is what makes the changelog meaningful across machines and CI runs — without it every scheduled run reports every finding as "new" and the history loses signal.

Usage

mix mob.security_scan.log                      # default paths
mix mob.security_scan.log --scan SECURITY.md \
    --history HISTORY.md \
    --state .scan/state.json
mix mob.security_scan.log --strict             # exit 1 if any high+ finding

Suggested cron entry

# daily at 06:00 local
0 6 * * *  cd /path/to/project && mix mob.security_scan.log >> /tmp/security_scan.log 2>&1

Suggested GitHub Actions workflow

name: security-scan
on:
  schedule: [{cron: "0 6 * * *"}]
  workflow_dispatch:
jobs:
  scan:
    runs-on: macos-latest
    steps:
      - uses: actions/checkout@v4
      - uses: erlef/setup-beam@v1
        with: {elixir-version: "1.19", otp-version: "28"}
      - run: brew install osv-scanner semgrep flawfinder detekt swiftlint
      - run: mix deps.get
      - run: mix mob.security_scan.log
      - uses: peter-evans/create-pull-request@v6
        with:
          title: "security: weekly scan update"
          commit-message: "security: weekly scan update"
          branch: security-scan-update
          add-paths: SECURITY_SCAN.md SECURITY_HISTORY.md .security_scan/state.json