
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
@appflags/gitexporter
Advanced tools
Utility for exporting private git repository commits to a open source public repository
You're in the right place if:
Others cases:
gitexporter create a new git repo from your existing repository with only allowed public files and dirs.
The gitexporter goes through the git commit tree and adds to a new repo only the allowed files.
/ -- monorepository root/apps/service1 -- it's open source/apps/optional-secure-service2 -- it's closed source/gitexporter.config.json -- git exporter config filegitexporter.config.json
{
"forceReCreateRepo": true,
"targetRepoPath": "my-open-source-repo",
"sourceRepoPath": ".",
"allowedPaths": ["apps/service1/*"],
"ignoredPaths": ["apps/service1/.env", "apps/optional-secure-service2", "gitexporter.config.json"]
}
Just run npx gitexporter gitexporter.config.json and you will get a new git repository with just apps/service1 directory.
sync-botSSH_SYNC_BOT_PRIVATE_KEY: https://github.com/settings/keysorg/private and org/open repoSSH_SYNC_BOT_PRIVATE_KEY to org/private repoorg/private repo:.github/workflows/gitexporter.yml
name: gitexporter
on:
push:
branches:
- 'master'
jobs:
gitexporter:
name: Gitexporter
runs-on: self-hosted
steps:
- name: Checkout
uses: actions/checkout@v2
with:
ssh-key: ${{ secrets.SSH_SYNC_BOT_PRIVATE_KEY }}
- name: Checkout org/private
uses: actions/checkout@v2
with:
repository: 'org/private'
fetch-depth: 0
submodules: recursive
ssh-key: ${{ secrets.SSH_SYNC_BOT_PRIVATE_KEY }}
path: gitexporter.source
ref: 'master'
- name: Checkout org/open
uses: actions/checkout@v2
with:
repository: 'org/open'
fetch-depth: 0
submodules: recursive
ssh-key: ${{ secrets.SSH_SYNC_BOT_PRIVATE_KEY }}
path: gitexporter.target
ref: 'master'
- name: gitexporter.sh
run: |
bash .github/workflows/gitexporter.sh gitexporter.source gitexporter.target
cat gitexporter.source.log.json
.github/workflows/gitexporter.sh
#!/usr/bin/env bash
set -eo pipefail
if [[ -z "$1" || -z "$2" ]]; then
echo "use $0 <source-git-repo> <target-git-repo>"
exit 2
fi
SOURCE_FOLDER=$1
TARGET_FOLDER=$2
echo "[GITEXPORTER]"
cat > ${SOURCE_FOLDER}.config.json <<EOF
{
"forceReCreateRepo": false,
"followByNumberOfCommits": true,
"syncAllFilesOnLastFollowCommit": true,
"logFilePath": "${SOURCE_FOLDER}.log.json",
"targetRepoPath": "${TARGET_FOLDER}",
"sourceRepoPath": "${SOURCE_FOLDER}",
"allowedPaths": [
"*"
],
"ignoredPaths": [
"secret/*"
]
}
EOF
npx gitexporter ${SOURCE_FOLDER}.config.json
echo "[TARGET/SETUP]"
cd ${TARGET_FOLDER}
git branch -D master || echo "no branch master"
git checkout -B master $(git rev-parse HEAD)
echo "[TARGET/PUSH]"
git push origin master
cd -
echo "[END]"
FAQs
Utility for exporting private git repository commits to a open source public repository
We found that @appflags/gitexporter demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.