Latest Threat Research:SANDWORM_MODE: Shai-Hulud-Style npm Worm Hijacks CI Workflows and Poisons AI Toolchains.Details
Socket
Book a DemoInstallSign in
Socket

mygithub.libinneed.workers.dev/stackitcloud/stackit-cli

Package Overview
Dependencies
Versions
172
Alerts
File Explorer

Advanced tools

Socket logo

Install Socket

Detect and block malicious and high-risk dependencies

Install

mygithub.libinneed.workers.dev/stackitcloud/stackit-cli - npm Package Compare versions

Comparing version
v0.37.5
to
v0.37.6
+50
-22
.github/workflows/release.yaml

@@ -20,9 +20,8 @@ # STACKIT CLI release workflow.

goreleaser:
name: Release
name: Build and Release
runs-on: macOS-latest
outputs:
gpg_fingerprint: ${{ steps.import_gpg.outputs.fingerprint }}
env:
SNAPCRAFT_STORE_CREDENTIALS: ${{ secrets.SNAPCRAFT_TOKEN }}
# Needed to publish new packages to our S3-hosted APT repo
AWS_ACCESS_KEY_ID: ${{ secrets.OBJECT_STORAGE_ACCESS_KEY_ID }}
AWS_SECRET_ACCESS_KEY: ${{ secrets.OBJECT_STORAGE_SECRET_ACCESS_KEY }}
steps:

@@ -65,7 +64,2 @@ - name: Checkout

AUTHKEY_BASE64: ${{ secrets.APPLE_API_KEY }}
# aptly version 1.6.0 results in an segmentation fault. Therefore we fall back to version 1.5.0.
# Since it is not possible to specify a version via brew command a formula was added for aptly 1.5.0
# (source: https://github.com/Homebrew/homebrew-core/pull/202415/files)
- name: Install Aptly version 1.5.0
run: brew install aptly.rb
- name: Install Snapcraft

@@ -80,16 +74,51 @@ uses: samuelmeuli/action-snapcraft@v3

GPG_FINGERPRINT: ${{ steps.import_gpg.outputs.fingerprint }}
- name: Setup Docker with Colima
- name: Upload dist artifacts
uses: actions/upload-artifact@v4
with:
name: dist
path: dist/
retention-days: 1
publish-packages:
name: Publish Packages
runs-on: ubuntu-latest
needs: goreleaser
if: contains(github.ref_name, '-') == false
env:
AWS_ACCESS_KEY_ID: ${{ secrets.OBJECT_STORAGE_ACCESS_KEY_ID }}
AWS_SECRET_ACCESS_KEY: ${{ secrets.OBJECT_STORAGE_SECRET_ACCESS_KEY }}
GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
GPG_PRIVATE_KEY_FINGERPRINT: ${{ needs.goreleaser.outputs.gpg_fingerprint }}
steps:
- name: Checkout
uses: actions/checkout@v4
with:
fetch-depth: 0
- name: Import GPG key
uses: crazy-max/ghaction-import-gpg@v6
id: import_gpg
with:
gpg_private_key: ${{ secrets.GPG_PRIVATE_KEY }}
passphrase: ${{ secrets.GPG_PASSPHRASE }}
# aptly version 1.6.0 results in an segmentation fault. Therefore we fall back to version 1.5.0.
# Since it is not possible to specify a version via brew command a formula was added for aptly 1.5.0
# (source: https://github.com/Homebrew/homebrew-core/pull/202415/files)
- name: Install Aptly version 1.5.0
run: |
# Install Docker CLI
brew install docker
# Install Colima
brew install colima
# Start Colima
colima start --cpu 2 --memory 4 --disk 20
# Verify Docker is working
docker --version
docker info
echo "Docker is ready!"
# Install aptly on Ubuntu
wget -O - https://www.aptly.info/pubkey.txt | apt-key add -
echo "deb https://repo.aptly.info/ squeeze main" | tee -a /etc/apt/sources.list.d/aptly.list
apt-get update
apt-get install -y aptly
- name: Install createrepo_c
run: |
# Install createrepo_c on Ubuntu
sudo apt-get update
sudo apt-get install -y createrepo-c
- name: Download dist artifacts
uses: actions/download-artifact@v4
with:
name: dist
path: dist/
- name: Publish packages to APT repo
if: contains(github.ref_name, '-') == false
env:

@@ -100,3 +129,2 @@ GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}

- name: Publish packages to RPM repo
if: contains(github.ref_name, '-') == false
env:

@@ -103,0 +131,0 @@ GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}

@@ -36,14 +36,5 @@ #!/bin/bash

# Create RPM repository metadata using createrepo_c in Docker
# Create RPM repository metadata using createrepo_c
printf "\n>>> Creating RPM repository metadata \n"
docker run --rm \
-v "${TEMP_DIR}/rpm-repo:/repo" \
fedora:latest \
bash -c "
# Install createrepo_c
dnf install -y createrepo_c
# Create repository metadata
createrepo_c /repo
"
createrepo_c ${TEMP_DIR}/rpm-repo

@@ -50,0 +41,0 @@ # Sign the repository metadata using the same GPG key as APT