Hacking mix to globally map Hex dependencies to audited git repositories

depmapper.exs

# ~/.mix/depmapper.exs
defmodule Mix.DepMapper do
  @repos_path "/ejail/code/erlang"

  # The branch to check out.  My workflow is to mark audited known-good
  # commits with both a branch and timestamped tag using
  # https://github.com/ludios/tagmyrebase
  @default_branch "bien"

  def mapdep(dep) do
    #IO.puts("dep: #{inspect dep, pretty: true, width: 0}")
    opts = Enum.into(dep.opts, %{})
    if not Map.has_key?(opts, :hex) do
      # TODO: convert other git, github deps as well
      dep
    else
      dest = opts.dest
      name = Atom.to_string(opts.hex)
      git = Path.join(@repos_path, name)
      if System.get_env("DEPMAPPER_DEBUG") do
        IO.puts("[depmapper] Hex #{name} -> git #{git}")
      end
      opts = opts
        |> Map.delete(:hex)
        |> Map.put(:checkout, dest)
        |> Map.put(:git, git)
        |> Map.put(:branch, @default_branch)
      dep
        |> Map.put(:requirement, nil)
        |> Map.put(:scm, Mix.SCM.Git)
        |> Map.put(:opts, Enum.into(opts, []))
    end
  end
end

depmapper.exs converts a Hex dependency like

dep: %Mix.Dep{app: :dialyxir,
  deps: [],
  extra: [],
  from: "/ejail/code/erlang/debpress/mix.exs",
  manager: nil,
  opts: [env: :prod,
   hex: :dialyxir,
   build: "/ejail/code/erlang/debpress/_build/dev/lib/dialyxir",
   dest: "/ejail/code/erlang/debpress/deps/dialyxir",
   only: :dev],
  requirement: "~> 0.3.5",
  scm: Hex.SCM,
  status: {:unavailable,
   "/ejail/code/erlang/debpress/deps/dialyxir"},
  top_level: false}

into a git dependency like

dep: %Mix.Dep{app: :dialyxir,
  deps: [],
  extra: [],
  from: "/ejail/code/erlang/debpress/mix.exs",
  manager: nil,
  opts: [env: :prod,
   checkout: "/ejail/code/erlang/debpress/deps/dialyxir",
   build: "/ejail/code/erlang/debpress/_build/dev/lib/dialyxir",
   dest: "/ejail/code/erlang/debpress/deps/dialyxir",
   git: "/ejail/code/erlang/dialyxir",
   branch: "bien",
   only: :dev],
  requirement: nil,
  scm: Mix.SCM.Git,
  status: {:unavailable,
   "/ejail/code/erlang/debpress/deps/dialyxir"},
  top_level: false}