Fun idea. Made it my evening project. GitHub - aseigo/hexagon

Am running it on my laptop right now with Elixir 1.7.1 and Erlang 21.0.4 … let’s see what happens. If the community feels it would be actually useful, I could run it regularly on servers at work. Could also extend it with other checks, e.g. perhaps harness credo to do some static analysis.

It is pretty bare-bones … perhaps logging with json would be nicer for later usage. Also just noticed it fails for rebar projects, which should be easy enough to fix. So rough edges, to be expected for a few hours thrown at a project, I guess … improvements welcome

It has already found packages with problems, e.g.:

 == 23:15:30.197
FAILED at compile: /home/aseigo/packages/ex_loader/0.4.1
errors: could not compile dependency :pre_commit_hook, "mix compile" failed. You can recompile this 
dependency with "mix deps.compile pre_commit_hook", update it with "mix deps.update pre_commit_hook" 
or clean it with "mix deps.clean pre_commit_hook"

Neat.

edit: bonus round … Since I had them on disk already, I ran cloc over the entire set of packages. https://exote.ch/~aseigo/state_of_hex.txt

It might be nice to give people a reminder about the @moduledoc false convention. Or even better a tool that flags uses of private apis from the standard lib as a compile time warning.

Also, it would really be nice to have at least a warning when a private API is being used by a module outside its application. I remember that being discussed somewhere else but don’t remember the outcome of it, maybe that’s not even possible, IDK.

Wouldn’t it be better to be able to have truly private APIs built into the language so that compilation against “private” modules and functions would fail? Seems like something the language owners could add.

Something like a defpmodule macro that accepted either as part of the module def or possibly a well known constant, a list of module friends able to access internally public functions.

I think this is a good example of why the pragmatic version of “Don’t use private APIs” is “Be aware of the risks of using private APIs”. Any feature that provides some kind of compile time check on private API usage should have an escape hatch, because there are situations where being locked to a specific version of the language and having a feature is sensibly considered a worthwhile trade off.

A tracking mechanism for private usage would actually make that sort of thing safer, since it’d be easier to audit.