
Research
Security News
Lazarus Strikes npm Again with New Wave of Malicious Packages
The Socket Research Team has discovered six new malicious npm packages linked to North Korea’s Lazarus Group, designed to steal credentials and deploy backdoors.
github.com/codefreshdemo/cf-example-golang-hello-world
So, you've decided to try Codefresh? Welcome on board!
Using this repository we'll help you get up to speed with basic functionality such as: compiling, testing and building Docker images.
This project uses golang
(or just go
) to build an application which will eventually become a distributable Docker image.
We'll use https://github.com/nuveo/prest[pREST] as an example application. pREST allows you to serve a RESTful API from any PostgreSQL database. Have a look at the README.pREST.md file for more information about pREST.
In the root of this repository you'll find a file named codefresh.yml
, this is our https://docs.codefresh.io/docs/what-is-the-codefresh-yaml[build descriptor] and it describes the different steps that comprise our process.
Let's quickly review the contents of this file:
To test our code we use Codefresh's https://docs.codefresh.io/docs/steps#section-freestyle[Freestyle step].
The Freestyle step basically let's you say "Hey, Codefresh! Here's a Docker image. Create a new container and run these commands for me, will ya?"
perform_tests:
image: golang:latest
working_directory: ${{main_clone}}
description: Performing unit tests...
commands:
# Need to have the source in the correct GOPATH folder - let's do that
- mkdir -p /go/src/github.com/${{CF_REPO_OWNER}}
- ln -s /codefresh/volume/${{CF_REPO_NAME}} /go/src/github.com/${{CF_REPO_OWNER}}/${{CF_REPO_NAME}}
- cd /go/src/github.com/${{CF_REPO_OWNER}}/${{CF_REPO_NAME}} && go get
- cd /go/src/github.com/${{CF_REPO_OWNER}}/${{CF_REPO_NAME}} && go test
The image
field states which image should be used when creating the container (Similar to Travis CI's language
or CircleCIs
machine`).
The commands
field is how you specify all the commands that you'd like to execute
To bake our application into a Docker image we use Codefresh's https://docs.codefresh.io/docs/steps#section-build[Build step].
The Build is a simplified abstraction over the Docker build command.
build_image:
type: build
description: Building the image...
image_name: ${{CF_REPO_OWNER}}/${{CF_REPO_NAME}}
tag: '${{CF_BRANCH}}'
Use the image_name
field to declare the name of the resulting image (don't forget to change the image owner name from ${{CF_REPO_OWNER}}
to your own!).
This is where it gets real! Let's use Codefresh's https://docs.codefresh.io/docs/steps#section-launch-composition[Launch Composition step] to run our composition within Codefresh!
Launching compositions within Codefresh means you have your very own staging area, at a click of a button!
launch_composition:
type: launch-composition
description: Launching an environment from a composition...
composition:
version: '2'
services:
prest:
image: '${{CF_REPO_OWNER}}/${{CF_REPO_NAME}}:${{CF_BRANCH}}'
environment:
- PREST_PG_HOST=postgres
- PREST_PG_USER=prest
- PREST_PG_PASS=prest
- PREST_PG_DATABASE=prest
- PREST_PG_PORT=5432
depends_on:
- postgres
ports:
- '3000'
postgres:
image: mbrung/postgres-no-volume
environment:
- POSTGRES_USER=prest
- POSTGRES_DB=prest
- POSTGRES_PASSWORD=prest
ports:
- '5432'
Using the composition
field, we direct Codefresh to the location if the docker-compose
file in our repository.
Once the Launch Composition step has completed successfully, you'll be able to review and share your running composition in the https://docs.codefresh.io/docs/share-environment-with-your-test[Environments page].
You'll now be able to either connect directly to pREST to perform RESTful opreations, or to the ephemereal Postgres database to create new schemas and tables for pREST to work with.
Now that we've gotten a grip on the flow, let's get cracking!
To use this example:
. Fork this repository to your own Github account. (If you want to make changes and get the CI working on new commits)
. Log in to Codefresh using your Github account.
. Click the Add Service
button.
. Select the forked repository. (Or paste in the the original repository's URL.)
. Select the I have a codefresh.yml file
option.
. Complete the wizard.
. Rejoice!
FAQs
Unknown package
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
The Socket Research Team has discovered six new malicious npm packages linked to North Korea’s Lazarus Group, designed to steal credentials and deploy backdoors.
Security News
Socket CEO Feross Aboukhadijeh discusses the open web, open source security, and how Socket tackles software supply chain attacks on The Pair Program podcast.
Security News
Opengrep continues building momentum with the alpha release of its Playground tool, demonstrating the project's rapid evolution just two months after its initial launch.