
Security News
vlt Launches "reproduce": A New Tool Challenging the Limits of Package Provenance
vlt's new "reproduce" tool verifies npm packages against their source code, outperforming traditional provenance adoption in the JavaScript ecosystem.
@amagaki/amagaki-plugin-kintaro
Advanced tools
[![NPM Version][npm-image]][npm-url] [![GitHub Actions][github-image]][github-url] [![TypeScript Style Guide][gts-image]][gts-url]
An experimental Amagaki plugin for integration with Kintaro, a headless CMS.
Features include:
npm install --save @amagaki/amagaki-plugin-kintaro
Authenticate. See authentication for details.
Access the plugin in amagaki.ts
:
import {BuilderPlugin, Pod, ServerPlugin} from '@amagaki/amagaki';
import {KintaroPlugin} from '@amagaki/amagaki-plugin-kintaro';
export default (pod: Pod) => {
const kintaro = KintaroPlugin.register(pod, {
repoId: '<Kintaro Repo ID>',
projectId: '<Kintaro Project ID>',
});
// Download and bind kintaro collections
const serverPlugin = pod.plugins.get('ServerPlugin') as ServerPlugin;
serverPlugin.register(async () => {
try {
await kintaro.bindCollection({
collectionPath: '/content/kintaro/',
});
} catch (err) {
console.warn(`[Kintaro Plugin] Unable to download; ${err}`);
}
});
// Create Amagaki routes from a Kintaro collection.
const setup = async () => {
await kintaro.addRouteProvider({
collectionId: '<Kintaro Collection ID>',
path: '/posts/${doc.basename}/${doc.fields.slug}/',
view: '/views/base.njk',
});
};
const builder = pod.plugins.get('BuilderPlugin') as BuilderPlugin;
builder.addBeforeBuildStep(async () => {
await setup();
});
const server = pod.plugins.get('ServerPlugin') as ServerPlugin;
server.register(async () => {
await setup();
});
// Import translations to your Amagaki project.
await kintaro.importTranslations({
stringKeyPatterns: [
'_label$',
'.label$',
'.text$',
'.title$',
'^cta_text_alt$',
'^description$',
'^headline$',
'^next$',
'^previous$',
'^site_name$',
'^title$',
],
});
};
(To be documented)
?flush
query parameter to reset the cache. Add ?flush
to reload Kintaro content
without restarting the server.(To be documented)
There are two ways to authenticate. We recommend using the application default identity (option 1), but using a service account key file is acceptable as well.
gcloud SDK
. See instructions.gcloud auth application-default login \
--scopes=openid,https://www.googleapis.com/auth/userinfo.email,https://www.googleapis.com/auth/cloud-platform,https://www.googleapis.com/auth/spreadsheets,https://www.googleapis.com/auth/kintaro
gcloud
CLI (see below for an example).PROJECT=<Google Cloud Project ID>
# Create a service account named `amagaki`.
gcloud --project=$PROJECT \
iam service-accounts create \
amagaki
# Create a JSON key and download it to `key.json`.
gcloud --project=$PROJECT \
iam service-accounts keys create \
--iam-account amagaki@$PROJECT.iam.gserviceaccount.com \
key.json
key.json
is added to your .gitignore
.keyFile
to the plugin.KintaroPlugin.register(pod, {
keyFile: 'key.json',
repoId: '<Kintaro Repo ID>',
projectId: '<Kintaro Project ID>',
});
Kintaro does not support webhooks – as a result there is no inbuilt way to run builds when a workspace is published. As a workaround, you can deploy a Google Cloud Function to poll Kintaro for the last time a workspace was published. When a publish event is observed via the polling mechanism, a new cloud build is submitted.
Ensure the following permissions are configured:
apps/kintaro-webhook-simulator/index.js
:import {WebhookSimulator} from '@amagaki/amagaki-plugin-kintaro';
import functions from '@google-cloud/functions-framework';
functions.http('syncKintaroRepoStatus', WebhookSimulator.getCloudFunction({
// `branchName` to use when submitting the Cloud Build.
branchName: '<string>',
// GCP project that owns the Cloud Build trigger and Datastore instance. This should usually be omitted.
gcpProject: '<string | undefined>',
// Kintaro "project" ID. Same as a Kintaro "workspace". Should be left as `undefined` to trigger only published content.
kintaroProjectId: '<string | undefined>',
// Kintaro "repo" ID. Same as a Kintaro "site".
kintaroRepoId: '<string>',
// UUID of the Cloud Build trigger.
buildTriggerId: '<string>',
}));
apps/kintaro-webhook-simulator/package.json
:{
"main": "index.js",
"type": "module",
"dependencies": {
"@amagaki/amagaki-plugin-kintaro": "^2.0.1",
"@google-cloud/functions-framework": "^3.0.0"
}
}
gcloud
CLI:gcloud functions deploy \
syncKintaroRepoStatus \
--runtime nodejs16 \
--trigger-http
Configure this from the Cloud Scheduler page:
https://console.cloud.google.com/cloudscheduler?project=<GCP PROJECT ID>
Use the following configuration:
* * * * *
http
https://us-central1-<GCP PROJECT ID>.cloudfunctions.net/syncKintaroRepoStatus
GET
Add OIDC token
FAQs
[![NPM Version][npm-image]][npm-url] [![GitHub Actions][github-image]][github-url] [![TypeScript Style Guide][gts-image]][gts-url]
The npm package @amagaki/amagaki-plugin-kintaro receives a total of 71 weekly downloads. As such, @amagaki/amagaki-plugin-kintaro popularity was classified as not popular.
We found that @amagaki/amagaki-plugin-kintaro demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
vlt's new "reproduce" tool verifies npm packages against their source code, outperforming traditional provenance adoption in the JavaScript ecosystem.
Research
Security News
Socket researchers uncovered a malicious PyPI package exploiting Deezer’s API to enable coordinated music piracy through API abuse and C2 server control.
Research
The Socket Research Team discovered a malicious npm package, '@ton-wallet/create', stealing cryptocurrency wallet keys from developers and users in the TON ecosystem.