feat: add Credo check flagging raw/1 in HEEx templates

[zorn]

Closes #131.

Problem

Sobelow's XSS.Raw check never fires on raw/1 used inside a ~H template, because a template's contents are an unparsed binary in the AST — the same reason a naive Credo/AST check would miss it too. So raw/1 in HEEx was invisible to our security tooling.

Solution

A custom Credo check, Flick.Credo.Check.RawInHeex, that walks the AST for ~H (sigil_H) nodes and scans their template text for raw/1 calls, flagging each as a potential XSS risk (with accurate line/column).

Legitimate uses opt out with a HEEx-native marker:

<%!-- credo:allow-raw sanitized by Flick.Markdown --%>
{raw(Flick.Markdown.render_to_html(@content))}

A HEEx-native marker is required because Credo's built-in # credo:disable-* comments only work as real Elixir comments and can't live inside a template sigil.

Changes

• credo/checks/raw_in_heex.ex — the check (kept out of lib/ since it depends on Credo.Check, unavailable in :prod).
• .credo.exs — loads the check via requires and enables it.
• mix.exs — mix precommit now runs credo --strict, so the guardrail fires in the normal workflow.
• test/test_helper.exs — loads the check and starts Credo's supervision tree (runtime: false) so its unit tests can use Credo.Test.Case.
• <.markdown> core component — rendered Markdown is the app's only sanctioned raw/1 use, now centralized in one component that carries the sole opt-out. Both LiveViews (viewer_live, vote_capture_live) use it, reducing the audited raw surface from two sites to one.

Verification

• mix precommit green: format clean, credo --strict 0 issues (95 checks), 106 tests pass.
• 7 dedicated unit tests for the check (Credo.Test.Case).
• Confirmed end-to-end: removing a marker makes Credo report the raw/1 in HEEx warning; restoring it returns to green.

Known limitations (deliberate)

• The scan is line-based, so a raw( split across multiple lines could slip through. Real call sites are single-line {raw(...)}; this is defense-in-depth, not a proof.
• The regex also matches qualified calls like Phoenix.HTML.raw( — appropriate for the security intent.

[Copilot]

Pull request overview

This PR closes #131 by adding a custom Credo check to detect raw/1 usage inside ~H (HEEx) sigils—covering a blind spot where template contents are stored as an unparsed binary in the AST—and by centralizing the app’s sanctioned Markdown-to-HTML rendering behind a single component-level raw/1 call.

Changes:

• Add Flick.Credo.Check.RawInHeex and enable it via .credo.exs requires + check configuration.
• Ensure the check is exercised in CI/dev workflow by running credo --strict in mix precommit, and wiring Credo into the test environment for unit tests.
• Replace direct raw(Flick.Markdown.render_to_html(...)) usage in LiveViews with a new <.markdown> core component that contains the sole opt-out marker.

Reviewed changes

Copilot reviewed 8 out of 8 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
credo/checks/raw_in_heex.ex	Implements the custom Credo check that scans ~H template text for raw/1 usage with an allow-marker escape hatch.
.credo.exs	Loads the custom check via requires and enables it in the configured checks list.
mix.exs	Updates mix precommit to run credo --strict so the new guardrail runs in the normal workflow.
test/test_helper.exs	Ensures the custom check module is loaded for tests and starts Credo when needed for Credo.Test.Case.
test/flick/credo/check/raw_in_heex_test.exs	Adds unit tests validating detection and allow-marker behavior for the new check.
lib/flick_web/components/core_components.ex	Adds a reusable <.markdown> component that sanitizes Markdown output and contains the single approved raw/1 use + marker.
lib/flick_web/live/ballots/viewer_live.ex	Switches ballot description rendering to use <.markdown> instead of calling raw/1 inline.
lib/flick_web/live/vote/vote_capture_live.ex	Switches ballot description rendering to use <.markdown> instead of calling raw/1 inline.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[zorn]

Good catch — tightened in 80265e4. The check now requires a HEEx interpolation opener before raw( on the line, so literal raw( in prose, HTML attributes, or <pre> code samples no longer produces a false positive.

One adjustment to the suggestion: requiring { alone would create a false negative for <%= raw(...) %> (valid HEEx body interpolation), which is worse for a security guardrail. So the regex matches either opener — (?:\{|<%=)[^{}]*\braw\s*\( — and I added regression tests for both the <%= %> form and for non-interpolated literal text like <div>raw(@x)</div>.