The local client for Hexorcist — it fetches a project's
upgrade plan and applies the safe, lockfile-only part (mix deps.update),
optionally test-gated, leaving the mix.lock change as a reviewable diff.
Think Dependabot/Renovate, but driven by Hexorcist's analysis and run on your machine or CI — no GitHub integration, no auto-push.
Install
mix archive.install hex hexorcist_update
# or straight from this repo:
mix archive.install git https://git.sr.ht/~sbr/hexorcist
# or from a local checkout (build the .ez, then install it):
cd hexorcist && mix archive.build && mix archive.install ./hexorcist_update-*.ez
It installs as a global Mix archive (so mix hexorcist.update works in any
project), with no runtime dependencies (uses OTP :httpc + :json), so it
won't touch your project's dependency tree.
Updating
Archives don't auto-update — reinstall to move to a newer version.
mix archive # list installed archives (look for hexorcist_update-X.Y.Z)
# From Hex or git, pulling the latest published version:
mix archive.install hex hexorcist_update --force
mix archive.install git https://git.sr.ht/~sbr/hexorcist --force
# From a local checkout — rebuild the .ez from current source first:
cd hexorcist && git pull && mix archive.build
mix archive.install ./hexorcist_update-*.ez --force
--force overwrites the installed copy without prompting. Reinstalling the
same version replaces it in place; after a version bump, remove the old
one so it doesn't linger alongside the new:
mix archive.uninstall hexorcist_update-0.3.0
Usage
Run it inside your project's git checkout. The token is a secret (keep it in your environment); the project id can live in the repo:
# .hexorcist.exs — commit this so the project id travels with the repo
[project: "de4faba9-2d6c-4f9e-99fa-905b10a6f419"]
export HEXORCIST_TOKEN=hxo_... # account token (Settings page); never commit this
mix hexorcist.update # apply lockfile updates, leave a diff
mix hexorcist.update --test # ...and roll back if `mix test` fails
mix hexorcist.update --edit-mix # also raise mix.exs constraints for blocked majors
mix hexorcist.update --dry-run # just print the plan; change nothing
mix hexorcist.update --commit # commit the change (never pushes)
| Flag / env | Meaning |
|---|---|
--project / HEXORCIST_PROJECT / :project in .hexorcist.exs | Project public id (required) |
--token / HEXORCIST_TOKEN | Account token (required; never put in the file) |
--url / HEXORCIST_URL / :url in .hexorcist.exs | Base URL (default https://hexorcist.net) |
Resolution order is flag → env → .hexorcist.exs. The config file is parsed
as a literal (never eval'd), so a cloned repo's config can't execute code.
| --test | Run mix test; roll back mix.lock on failure |
| --commit | git commit the change (never pushes) |
| --dry-run | Print the plan only |
Scope
By default only lockfile updates are applied — versions that already fit your
mix.exs constraints. Updates blocked by a constraint are reported, and with
--edit-mix their literal {:dep, "~> x.y"} constraint is raised (à la
Renovate's mix manager) — in the root mix.exs or, for an umbrella, whichever
apps/*/mix.exs declare the dep. Anything not safely rewritable (non-~>,
ambiguous, or transitive deps) is reported as a suggestion rather than edited,
and an edit that doesn't actually unlock the dep is reverted.
License
BSD-3-Clause