Security News
New Python Packaging Proposal Aims to Solve Phantom Dependency Problem with SBOMs
PEP 770 proposes adding SBOM support to Python packages to improve transparency and catch hidden non-Python dependencies that security tools often miss.
@amazon-codecatalyst/blueprint-component.workflows
Advanced tools
This is a representation of a codecatalyst workflow.
import {...} from '@amazon-codecatalyst/blueprint-component.workflows'
The workflow component can be found here.
A workflow is used by CodeCatalyst projects to execute some actions based off triggers. The blueprints team exposes some helpful workflows components that are meant to help in building and putting together workflow yaml files. See public workflows documentation for general use.
import { WorkflowBuilder, Workflow } from '@amazon-codecatalyst/blueprint-component.workflows'
This is a class that helps build a workflow definition. This can then be given over to a workflow component for rendering in a repository.
import { WorkflowBuilder } from '@amazon-codecatalyst/blueprint-component.workflows'
const workflowBuilder = new WorkflowBuilder({} as Blueprint, {
Name: 'my_workflow',
});
// trigger the workflow on pushes to branch 'main'
workflowBuilder.addBranchTrigger(['main']);
// add a build action
workflowBuilder.addBuildAction({
// give the action a name
actionName: 'build_and_do_some_other_stuff',
// the action pulls from source code
input: {
Sources: ['WorkflowSource'],
},
// the output attempts to autodiscover test reports, but not in the node modules
output: {
AutoDiscoverReports: {
Enabled: true,
ReportNamePrefix: AutoDiscovered,
IncludePaths: ['**/*'],
ExcludePaths: ['*/node_modules/**/*'],
},
},
// execute some arbitrary steps
steps: [
'npm install',
'npm run myscript',
'echo hello-world',
],
// add an account connection to the workflow
environment: convertToWorkflowEnvironment(myEnv),
});
This is a projen component that writes a workflow yaml to a repository.
import { Workflow } from '@amazon-codecatalyst/blueprint-component.workflows'
...
const repo = new SourceRepository
const blueprint = this;
const workflowDef = workflowBuilder.getDefinition()
// creates a workflow.yaml at .aws/workflows/${workflowDef.name}.yaml
new Workflow(blueprint, repo, workflowDef);
// can also pass in any object and have it rendered as a yaml. This is unsafe and may not produce a valid workflow
new Workflow(blueprint, repo, {... some object ...});
Many workflows need to run in an AWS account connection. Workflows deal with this by allowing actions to connect to environments, with account and role name specifications.
import { convertToWorkflowEnvironment } from '@amazon-codecatalyst/blueprint-component.workflows'
const myEnv = new Environment(...);
// can be passed into a workflow constructor
const workflowEnvironment = convertToWorkflowEnvironment(myEnv);
// add a build action
workflowBuilder.addBuildAction({
...
// add an account connection to the workflow
environment: convertToWorkflowEnvironment(myEnv),
});
FAQs
This is a representation of a codecatalyst workflow.
The npm package @amazon-codecatalyst/blueprint-component.workflows receives a total of 2,544 weekly downloads. As such, @amazon-codecatalyst/blueprint-component.workflows popularity was classified as popular.
We found that @amazon-codecatalyst/blueprint-component.workflows demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
PEP 770 proposes adding SBOM support to Python packages to improve transparency and catch hidden non-Python dependencies that security tools often miss.
Security News
Socket CEO Feross Aboukhadijeh discusses open source security challenges, including zero-day attacks and supply chain risks, on the Cyber Security Council podcast.
Security News
Research
Socket researchers uncover how threat actors weaponize Out-of-Band Application Security Testing (OAST) techniques across the npm, PyPI, and RubyGems ecosystems to exfiltrate sensitive data.