Added static code analysis

.check.exs

@@ -3,10 +3,10 @@
   # parallel: false,
 
   ## don't print info about skipped tools
-  # skipped: false,
+  skipped: false,
 
   ## always run tools in fix mode (put it in ~/.check.exs locally, not in project config)
-  # fix: true,
+  fix: true,
 
   ## don't retry automatically even if last run resulted in failures
   # retry: false,
@@ -14,7 +14,13 @@
   ## list of tools (see `mix check` docs for a list of default curated tools)
   tools: [
     {:compiler, env: %{"MIX_ENV" => "test"}},
-    {:formatter, env: %{"MIX_ENV" => "test"}}
+    {:formatter, env: %{"MIX_ENV" => "test"}},
+    {:sobelow, "mix sobelow --config"},
+    # TODO: delete these and replace them with builtin ex_unit and formatter tools
+    # once Elixir 1.16.2 is released (see: https://github.com/karolsluszniak/ex_check/issues/41#issuecomment-1921390413)
+    {:elixir_tests, "mix test"},
+    {:elixir_formatting, "mix format --check-formatted", fix: "mix format"},
+    {:prettier_formatting, "yarn run prettier . --check", fix: "yarn run prettier . --write"}
 
     ## curated tools may be disabled (e.g. the check for compilation warnings)
     # {:compiler, false},

.sobelow-conf

@@ -0,0 +1,15 @@
+[
+  verbose: false,
+  private: false,
+  skip: false,
+  router: nil,
+  exit: :medium,
+  format: "txt",
+  out: nil,
+  threshold: :low,
+  # All of these are ignorable because this app is intended to be single-user and self-hosted.
+  # There is an expectation that the user won't intentionally run a FS Traversal on themselves
+  ignore: ["CI.System", "Traversal.FileModule", "Config.HTTPS", "Config.CSP"],
+  ignore_files: [],
+  version: false
+]

ideas.md

@@ -3,3 +3,4 @@
 - Look into this and its recommended plugins https://hexdocs.pm/ex_check/readme.html
 - Add output template option for the source's friendly name
 - TODO: Install Elixir 1.16.2 when available to fix bug with `ex_check` https://github.com/karolsluszniak/ex_check/issues/41#issuecomment-1921390413
+  - delete `{:elixir_tests, "mix test"}` and formatting check

mix.exs

@@ -60,7 +60,8 @@ defmodule Pinchflat.MixProject do
       {:mox, "~> 1.0", only: :test},
       {:credo, "~> 1.7", only: [:dev, :test], runtime: false},
       {:ex_check, "~> 0.14.0", only: [:dev, :test], runtime: false},
-      {:faker, "~> 0.17", only: :test}
+      {:faker, "~> 0.17", only: :test},
+      {:sobelow, "~> 0.13", only: [:dev, :test], runtime: false}
     ]
   end
 

mix.lock

@@ -43,6 +43,7 @@
   "plug_cowboy": {:hex, :plug_cowboy, "2.6.1", "9a3bbfceeb65eff5f39dab529e5cd79137ac36e913c02067dba3963a26efe9b2", [:mix], [{:cowboy, "~> 2.7", [hex: :cowboy, repo: "hexpm", optional: false]}, {:cowboy_telemetry, "~> 0.3", [hex: :cowboy_telemetry, repo: "hexpm", optional: false]}, {:plug, "~> 1.14", [hex: :plug, repo: "hexpm", optional: false]}], "hexpm", "de36e1a21f451a18b790f37765db198075c25875c64834bcc82d90b309eb6613"},
   "plug_crypto": {:hex, :plug_crypto, "2.0.0", "77515cc10af06645abbfb5e6ad7a3e9714f805ae118fa1a70205f80d2d70fe73", [:mix], [], "hexpm", "53695bae57cc4e54566d993eb01074e4d894b65a3766f1c43e2c61a1b0f45ea9"},
   "ranch": {:hex, :ranch, "1.8.0", "8c7a100a139fd57f17327b6413e4167ac559fbc04ca7448e9be9057311597a1d", [:make, :rebar3], [], "hexpm", "49fbcfd3682fab1f5d109351b61257676da1a2fdbe295904176d5e521a2ddfe5"},
+  "sobelow": {:hex, :sobelow, "0.13.0", "218afe9075904793f5c64b8837cc356e493d88fddde126a463839351870b8d1e", [:mix], [{:jason, "~> 1.0", [hex: :jason, repo: "hexpm", optional: false]}], "hexpm", "cd6e9026b85fc35d7529da14f95e85a078d9dd1907a9097b3ba6ac7ebbe34a0d"},
   "swoosh": {:hex, :swoosh, "1.14.4", "94e9dba91f7695a10f49b0172c4a4cb658ef24abef7e8140394521b7f3bbb2d4", [:mix], [{:cowboy, "~> 1.1 or ~> 2.4", [hex: :cowboy, repo: "hexpm", optional: true]}, {:ex_aws, "~> 2.1", [hex: :ex_aws, repo: "hexpm", optional: true]}, {:finch, "~> 0.6", [hex: :finch, repo: "hexpm", optional: true]}, {:gen_smtp, "~> 0.13 or ~> 1.0", [hex: :gen_smtp, repo: "hexpm", optional: true]}, {:hackney, "~> 1.9", [hex: :hackney, repo: "hexpm", optional: true]}, {:jason, "~> 1.0", [hex: :jason, repo: "hexpm", optional: false]}, {:mail, "~> 0.2", [hex: :mail, repo: "hexpm", optional: true]}, {:mime, "~> 1.1 or ~> 2.0", [hex: :mime, repo: "hexpm", optional: false]}, {:plug, "~> 1.9", [hex: :plug, repo: "hexpm", optional: true]}, {:plug_cowboy, ">= 1.0.0", [hex: :plug_cowboy, repo: "hexpm", optional: true]}, {:req, "~> 0.4 or ~> 1.0", [hex: :req, repo: "hexpm", optional: true]}, {:telemetry, "~> 0.4.2 or ~> 1.0", [hex: :telemetry, repo: "hexpm", optional: false]}], "hexpm", "081c5a590e4ba85cc89baddf7b2beecf6c13f7f84a958f1cd969290815f0f026"},
   "tailwind": {:hex, :tailwind, "0.2.2", "9e27288b568ede1d88517e8c61259bc214a12d7eed271e102db4c93fcca9b2cd", [:mix], [{:castore, ">= 0.0.0", [hex: :castore, repo: "hexpm", optional: false]}], "hexpm", "ccfb5025179ea307f7f899d1bb3905cd0ac9f687ed77feebc8f67bdca78565c4"},
   "telemetry": {:hex, :telemetry, "1.2.1", "68fdfe8d8f05a8428483a97d7aab2f268aaff24b49e0f599faa091f1d4e7f61c", [:rebar3], [], "hexpm", "dad9ce9d8effc621708f99eac538ef1cbe05d6a874dd741de2e689c47feafed5"},