Oratos Hex package

Mix wrapper that downloads and runs the Oratos CLI from GitHub Releases. It does not audit HTML inside the BEAM.

Install

# mix.exs
defp deps do
  [
    {:oratos, "~> 0.3"}
  ]
end

Local development against this monorepo:

{:oratos, path: "packaging/hex"}

mix deps.get
mix oratos.audit ./priv/static --fail-under 85
mix oratos --version

Publish

Automated

Pushing a v* tag runs .github/workflows/release.yml. After GitHub Release assets are uploaded, the Publish to Hex job:

1. Syncs @version in mix.exs from the tag (e.g. v0.3.0 → 0.3.0)
2. Runs mix hex.publish --yes

Requires repository secret HEX_API_KEY (Hex dashboard → New key with API access). If the secret is missing, the job skips publish and exits 0.

Manual

cd packaging/hex
# bump @version in mix.exs if needed
mix local.hex --force
mix deps.get
HEX_API_KEY=... mix hex.publish --yes

Configuration

# config/config.exs
config :oratos,
  version: "0.3.0",
  # path: "/usr/local/bin/oratos",  # use an existing binary instead of downloading
  prefer_path: false

Notes

• Requires network access on first use to fetch the release asset (or set :path).
• Unix: tar must be available. Windows: unzip must be available for zip assets.
• Publish runs after the GitHub Release so consumers can download the matching CLI binary.