Research
Security News
Quasar RAT Disguised as an npm Package for Detecting Vulnerabilities in Ethereum Smart Contracts
Socket researchers uncover a malicious npm package posing as a tool for detecting vulnerabilities in Etherium smart contracts.
github.com/posener/goreadme
Package goreadme generates readme markdown file from go doc.
The package can be used as a command line tool and as Github action, described below:
Github actions can be configured to update the README file automatically every time it is needed.
Below there is an example that on every time a new change is pushed to the main branch, the
action is trigerred, generates a new README file, and if there is a change - commits and pushes
it to the main branch. In pull requests that affect the README content, if the GITHUB_TOKEN
is given, the action will post a comment on the pull request with changes that will be made to
the README file.
To use this with Github actions, add the following content to .github/workflows/goreadme.yml
.
See ./action.yml for all available input options.
on:
push:
branches: [main]
pull_request:
branches: [main]
permissions:
# Goreadme needs permissions to update pull requests comments and change contents.
pull-requests: write
contents: write
jobs:
goreadme:
runs-on: ubuntu-latest
steps:
- name: Check out repository
uses: actions/checkout@v2
- name: Update readme according to Go doc
uses: posener/goreadme@v1
with:
badge-travisci: 'true'
badge-codecov: 'true'
badge-godoc: 'true'
badge-goreadme: 'true'
# Optional: Token allows goreadme to comment the PR with diff preview.
GITHUB_TOKEN: '${{ secrets.GITHUB_TOKEN }}'
Use as a command line tool
$ GO111MODULE=on go get github.com/posener/goreadme/cmd/goreadme
$ goreadme -h
Both Go doc and readme files are important. Go doc to be used by your user's library, and README file to welcome users to use your library. They share common content, which is usually duplicated from the doc to the readme or vice versa once the library is ready. The problem is that keeping documentation updated is important, and hard enough - keeping both updated is twice as hard.
The formatting of the README.md is done by the go doc parser. This makes the result README.md a
bit more limited. Currently, goreadme
supports the formatting as explained in
godoc page, or
here. Meaning:
A header is a single line that is separated from a paragraph above.
Code block is recognized by indentation as Go code.
func main() {
...
}
Inline code is marked with backticks
.
URLs will just automatically be converted to links: https://github.com/posener/goreadme
Additionally, the syntax was extended to include some more markdown features while keeping the Go doc readable:
Bulleted and numbered lists are possible when each bullet item is followed by an empty line.
Diff blocks are automatically detected when each line in a code block starts with a ' '
,
'-'
or '+'
:
-removed line starts with '-'
remained line starts with ' '
+added line starts with '+'
A repository file can be linked when providing a path that start with [./](./)
: ./goreadme.go.
A link can have a link text by prefixing it with parenthesised text: goreadme page.
A link to repository file and can have a link text: goreadme main file.
An image can be added by prefixing a link to an image with (image/<image title>)
:
The goreadme tests the test cases in the ./testdata directory. It generates readme files for
all the packages in that directory and asserts that the result readme matches the existing one.
When modifying goreadme behavior, there is no need to manually change these readme files. It is
possible to run WRITE_READMES=1 go test ./...
which regenerates them and check the changes
match the expected (optionally using git diff
).
Readme created from Go doc with goreadme
FAQs
Unknown package
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket researchers uncover a malicious npm package posing as a tool for detecting vulnerabilities in Etherium smart contracts.
Security News
Research
A supply chain attack on Rspack's npm packages injected cryptomining malware, potentially impacting thousands of developers.
Research
Security News
Socket researchers discovered a malware campaign on npm delivering the Skuld infostealer via typosquatted packages, exposing sensitive data.