Code.eval_string is not safe. I’d suggest Code.string_to_quoted

You can just travese AST with functions provided in macro. You should look for field version in project funcion. If it contains, @version, than look for @version attirbute. If it contains something else, than there’s no safe way to fetch a version without executing code defined in this module

The AST of a keyword list is not a keyword list by itself, so you cannot use Keyword to access things. AST is an abstraction of written code, and not of the data represented by that code. You’ll need more manual approaches for filtering out the information you need.

A rather naive appraoch to getting to the information you seek would be like this:

{_ast, acc} =
  Macro.postwalk(ast, %{version: nil, attributes: %{}}, fn
    {:@, _, [{name, _, value}]} = ast, acc when is_atom(name) and not is_nil(value) ->
      {ast, put_in(acc.attributes[name], value)}

    {:version, {:@, _, [{name, _, nil}]}} = ast, acc ->
      {ast, Map.put(acc, :version, {:attribute, name})}

    {:version, value} = ast, acc ->
      {ast, Map.put(acc, :version, value)}

    ast, acc ->
      {ast, acc}
  end)

acc
# %{attributes: %{version: ["0.0.7"]}, version: {:attribute, :version}}

However you’d want to be more cautious as currently any later keyword list with a :version key would overwrite the returned result.

What you’re doing here is very brittle, as you’re trying to interpret code without running it, which can easily break by someone not sticking to conventions closely.

No. There’s no safe way to do that for all possible mix.exs files. Mix itself doesn’t use versions for git dependencies at all, it uses branches or git sha’s.

https://elixirschool.com/en/lessons/advanced/metaprogramming/
https://hexdocs.pm/elixir/Macro.html