
Research
/Security News
Popular Tinycolor npm Package Compromised in Supply Chain Attack Affecting 40+ Packages
Malicious update to @ctrl/tinycolor on npm is part of a supply-chain attack hitting 40+ packages across maintainers
@actions/expressions
Advanced tools
@actions/expressions
is a library to parse and evaluate GitHub Actions expressions.
The package contains TypeScript types and compiled ECMAScript modules.
npm install @actions/expressions
import { Parser, Lexer, Evaluator, data } from '@actions/expressions';
const lexer = new Lexer("1 == 2");
const lr = lexer.lex();
const parser = new Parser(lr.tokens, [], []);
const expr = parser.parse();
const evaluator = new Evaluator(expr, new data.Dictionary());
const result = evaluator.evaluate();
console.log(result.coerceString()) // false
import { Parser, Lexer, Evaluator, data } from '@actions/expressions';
const lexer = new Lexer("'monalisa' == context.name");
const lr = lexer.lex();
const parser = new Parser(lr.tokens, ["context"], []);
const expr = parser.parse();
const evaluator = new Evaluator(expr, new data.Dictionary([{
key: "context"
value: new data.Dictionary([{
key: "name"
value: new data.StringData("monalisa")
}])
}]));
const result = evaluator.evaluate();
console.log(result.coerceString()) // true
See CONTRIBUTING.md at the root of the repository for general guidelines and recommendations.
This project is just one of multiple implementations of the GitHub Actions Expressions language. We therefore cannot accept contributions that add new language features or significantly change the behavior of existing language features. If you would like to propose a change to the language itself, please use our Community Forum.
If you do want to contribute, please run prettier to format your code and add unit tests as appropriate before submitting your PR. ./testdata contains test cases that all implementations should pass, please also make sure those tests are still passing.
npm run build
or to watch for changes
npm run watch
npm test
or to watch for changes and run tests:
npm run test-watch
npm run format-check
This project is licensed under the terms of the MIT open source license. Please refer to MIT for the full terms.
FAQs
Unknown package
We found that @actions/expressions demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 6 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
/Security News
Malicious update to @ctrl/tinycolor on npm is part of a supply-chain attack hitting 40+ packages across maintainers
Security News
pnpm's new minimumReleaseAge setting delays package updates to prevent supply chain attacks, with other tools like Taze and NCU following suit.
Security News
The Rust Security Response WG is warning of phishing emails from rustfoundation.dev targeting crates.io users.