Security News
Maven Central Adds Sigstore Signature Validation
Maven Central now validates Sigstore signatures, making it easier for developers to verify the provenance of Java packages.
@automattic/vip-go-internal-cli
Advanced tools
Internal CLI Tools for VIP Go Sandboxes and the Goop API.
Show available commands:
vipgo --help
You can append --help
to any sub-command to see options and sub-sub-commands.
Make sure you have an open connection to the Automattic proxy and are able to tunnel local traffic to port 8080.
npm install -g wpvip-cli
vipgo config PROXY=socks://127.0.0.1:8080
vipgo login
To start hacking:
cd
to the cloned directory.npm install
to install dependencies.npm run build
.node build/bin/vipgo.js
.Note: changing this setting will also affect the installed npm package, and not only your cloned repository. Remember to clear this setting when you are done testing!
Testing in production is not good, so if you need to test against a locally running copy of GOOP, you can prepend a specific env variable to all commands as follows:
VIP_API_URL=http://localhost:2999 ./build/bin/vipgo.js sandbox list
To avoid typing every time, save the variable in your config file:
./build/bin/vipgo.js config VIP_API_URL=http://localhost:2999
Then re-login with a user id and token valid for your local GOOP installation.
To get a valid token for local GOOP:
curl -X POST http://localhost:2999/v1/tokens
Note 1: Your development version will use the same config as the globally installed module and any changes to the config will impact that.
Note 2: You can use npm link
to link your development copy with your globally installed version to simplify development.
npm run publish-please --dry-run
to ensure there are no publishing blockersnpm version patch
for small bugfixesnpm version minor
if there are some new features/fixesgit push --tags
npm run publish-please
package.json
to the next minor and append -dev
git push
veetoop2
with details about the new release (example).Note: doing the last two steps can help with debugging in case someone is running the dev version (via vipgo -V
).
For a critical fix (or a small number of fixes), we can git checkout
the last release and add/or cherry-pick some changes.
Then bump the version number with npm version patch
and npm publish
. This is especially nice if there are already some bigger changes in the master branch and you don’t want to push a normal release.
src
directory because it's not used and just makes builds larger (skipped via .npmignore
).FAQs
Internal CLI tools for the VIP team at Automattic
The npm package @automattic/vip-go-internal-cli receives a total of 39 weekly downloads. As such, @automattic/vip-go-internal-cli popularity was classified as not popular.
We found that @automattic/vip-go-internal-cli demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Maven Central now validates Sigstore signatures, making it easier for developers to verify the provenance of Java packages.
Security News
CISOs are racing to adopt AI for cybersecurity, but hurdles in budgets and governance may leave some falling behind in the fight against cyber threats.
Research
Security News
Socket researchers uncovered a backdoored typosquat of BoltDB in the Go ecosystem, exploiting Go Module Proxy caching to persist undetected for years.