
Security News
vlt Launches "reproduce": A New Tool Challenging the Limits of Package Provenance
vlt's new "reproduce" tool verifies npm packages against their source code, outperforming traditional provenance adoption in the JavaScript ecosystem.
@backstage-community/plugin-github-actions
Advanced tools
A Backstage plugin that integrates towards GitHub Actions
Website: https://github.com/actions
TBD
Create an OAuth App in your GitHub organization, setting the callback URL to:
http://localhost:7007/api/auth/github/handler/frame
Replacing localhost:7007
with the base URL of your backstage backend instance.
Note: This setup can also be completed with a personal GitHub account.
Keep in mind that using a personal account versus an organization account will affect which repositories the app can access.
Take the Client ID and Client Secret from the newly created app's settings page and you can do either:
AUTH_GITHUB_CLIENT_ID
and AUTH_GITHUB_CLIENT_SECRET
environment variables.auth:
providers:
github:
development:
clientId: ${AUTH_GITHUB_CLIENT_ID}
clientSecret: ${AUTH_GITHUB_CLIENT_SECRET}
Annotate your component with a correct GitHub Actions repository and owner:
The annotation key is github.com/project-slug
.
Example:
apiVersion: backstage.io/v1alpha1
kind: Component
metadata:
name: backstage
description: backstage.io
annotations:
github.com/project-slug: 'backstage/backstage'
spec:
type: website
lifecycle: production
owner: user:guest
# From your Backstage root directory
yarn --cwd packages/app add @backstage-community/plugin-github-actions
Note: If you are using GitHub auth to sign in, you may already have the GitHub provider, if it is not the case, install it by running:
yarn --cwd packages/backend add @backstage/plugin-auth-backend-module-github-provider
And add the following dependency to your backend index file:
backend.add(import('@backstage/plugin-auth-backend-module-github-provider'));
EntityPage
EntityPage
component:// In packages/app/src/components/catalog/EntityPage.tsx
import {
EntityGithubActionsContent,
isGithubActionsAvailable,
} from '@backstage-community/plugin-github-actions';
// You can add the tab to any number of pages, the service page is shown as an
// example here
const serviceEntityPage = (
<EntityLayout>
{/* other tabs... */}
<EntityLayout.Route path="/github-actions" title="GitHub Actions">
<EntityGithubActionsContent />
</EntityLayout.Route>
yarn start
and the backend with yarn start-backend
.
Then navigate to /github-actions/
under any entity.EntityPage
(New Frontend System)Follow this section if you are using Backstage's new frontend system.
Import githubActionsPlugin
in your App.tsx
and add it to your app's features
array:
import githubActionsPlugin from '@backstage-community/plugin-github-actions/alpha';
// ...
export const app = createApp({
features: [
// ...
githubActionsPlugin,
// ...
],
});
The plugin will try to use backstage.io/source-location
or backstage.io/managed-by-location
annotations to figure out the location of the source code.
host
and apiBaseUrl
to your app-config.yaml
# app-config.yaml
integrations:
github:
- host: 'your-github-host.com'
apiBaseUrl: 'https://api.your-github-host.com'
Github Workflow Runs optional UI to show in Card view instead of table, with branch selection option
// You can add the tab to any number of pages, the service page is shown as an
// example given here
const serviceEntityPage = (
<EntityLayout>
{/* other tabs... */}
<EntityLayout.Route path="/github-actions" title="GitHub Actions">
<EntityGithubActionsContent view='cards' />
</EntityLayout.Route>
FAQs
A Backstage plugin that integrates towards GitHub Actions
The npm package @backstage-community/plugin-github-actions receives a total of 14,350 weekly downloads. As such, @backstage-community/plugin-github-actions popularity was classified as popular.
We found that @backstage-community/plugin-github-actions demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
vlt's new "reproduce" tool verifies npm packages against their source code, outperforming traditional provenance adoption in the JavaScript ecosystem.
Research
Security News
Socket researchers uncovered a malicious PyPI package exploiting Deezer’s API to enable coordinated music piracy through API abuse and C2 server control.
Research
The Socket Research Team discovered a malicious npm package, '@ton-wallet/create', stealing cryptocurrency wallet keys from developers and users in the TON ecosystem.