
Security News
npm Adopts OIDC for Trusted Publishing in CI/CD Workflows
npm now supports Trusted Publishing with OIDC, enabling secure package publishing directly from CI/CD workflows without relying on long-lived tokens.
github.com/goplugin/plugin-testing-framework/tools/ghsecrets
ghsecrets is a command-line tool designed to manage and set test secrets in GitHub via the GitHub CLI.
To install ghsecrets CLI, you need to have Go installed on your machine. With Go installed, run the following command:
go install github.com/goplugin/plugin-testing-framework/tools/ghsecrets@latest
Please install GitHub CLI to use this tool - https://cli.github.com/
Set default test secrets from ~/.testsecrets file:
ghsecrets set
This error typically means that the directory where Go installs its binaries is not included in your system's PATH. The binaries are usually installed in $GOPATH/bin or $GOBIN. Here's how you can resolve this issue:
If you use asdf
run asdf reshim golang
Or, add Go bin directory to PATH:
First, find out where your Go bin directory is by running:
echo $(go env GOPATH)/bin
This command will print the path where Go binaries are installed, typically something like /home/username/go/bin
Add the following line at the end of your shell config file (.bashrc
, .zshrc
), usually located at ~/
:
export PATH="$PATH:<path-to-go-bin>"
Apply the changes by sourcing the file:
source ~/.bashrc # Use the appropriate file like .zshrc if needed
Alternatively, run using the full path:
If you prefer not to alter your PATH, or if you are troubleshooting temporarily, you can run the tool directly using its full path:
$(go env GOPATH)/bin/ghsecrets set
FAQs
Unknown package
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
npm now supports Trusted Publishing with OIDC, enabling secure package publishing directly from CI/CD workflows without relying on long-lived tokens.
Research
/Security News
A RubyGems malware campaign used 60 malicious packages posing as automation tools to steal credentials from social media and marketing tool users.
Security News
The CNA Scorecard ranks CVE issuers by data completeness, revealing major gaps in patch info and software identifiers across thousands of vulnerabilities.