
Research
Malicious npm Packages Impersonate Flashbots SDKs, Targeting Ethereum Wallet Credentials
Four npm packages disguised as cryptographic tools steal developer credentials and send them to attacker-controlled Telegram infrastructure.
@bitrise/steplib-search
Advanced tools
A small NPM library that helps you search and fetch Bitrise Workflow steps.
You'll need an Algolia App ID and an API key with search and browse persmission.
import StepLib from '@bitrise/steplib-search';
const stepLib = new StepLib(
'ALGOLIA_APP_ID',
'ALGOLIA_API_KEY',
// You can optionally pass a config object for the indices
// These are the defaults
{ stepIndex: 'steplib_steps', inputsIndex: 'steplib_inputs' }
);
Wihtout any options, we get the all steps (and all versions) with minimal information
const latestSteps: Step[] = await stepLib.list();
// latestSteps
[
...
{ "cvs": "activate-ssh-key@4.0.5" },
{ "cvs": "git-clone@4.0.18" },
{ "cvs": "git-clone@4.0.17" },
{ "cvs": "amazon-s3-deploy@3.5.8" },
{ "cvs": "project-scanner@3.3.1" },
{ "cvs": "project-scanner@3.3.0" },
{ "cvs": "carthage@3.2.2" },
...
]
Search for a specific step, with all versions and inputs included
const allFlutterSteps: Step[] = await stepLib.list({
query: 'flutter',
latestOnly: false,
includeInputs: true
});
// allFlutterSteps
[
...
{
"cvs": "flutter@0.0.9",
"inputs": [
{ "cvs": "flutter@0.0.9", "order": 0 },
{ "cvs": "flutter@0.0.9", "order": 1 },
{ "cvs": "flutter@0.0.9", "order": 2 }
...
]
},
{
"cvs": "flutter@0.0.8",
"inputs": [
{ "cvs": "flutter@0.0.8", "order": 0 },
{ "cvs": "flutter@0.0.8", "order": 1 },
{ "cvs": "flutter@0.0.8", "order": 2 }
]
},
{
"cvs": "flutter-test@0.9.1",
"inputs": [
{ "cvs": "flutter-test@0.9.1", "order": 0 },
{ "cvs": "flutter-test@0.9.1", "order": 1 }
]
},
{
"cvs": "flutter-test@0.9.0",
"inputs": [
{ "cvs": "flutter-test@0.9.0", "order": 0 }
]
},
{
"cvs": "flutter-installer@0.9.2",
"inputs": [
{ "cvs": "flutter-installer@0.9.2", "order": 0 }
]
}
...
]
List steps by id, you can include a version to get an exact version, or omit it to get the latest
const workflowSteps: Step[] = await stepLib.list({
stepIds: ['script', 'github-release@0.9.3', 'android-build@0.10.0'],
algoliaOptions: {
attributesToRetrieve: ['id', 'version', 'cvs', 'is_latest']
}
});
// workflowSteps
[
{
"cvs": "script@1.1.6",
"id": "script",
"version": "1.1.6",
"is_latest": true
},
{
"cvs": "android-build@0.10.0",
"id": "android-build",
"version": "0.10.0",
"is_latest": true
},
{
"cvs": "github-release@0.9.3",
"id": "github-release",
"version": "0.9.3",
"is_latest": false
}
]
You can use projectTypes
to speecify which platfrom you are looking for
const iosAndAndroidLatestSteps: Step[] = await stepLib.list({
latestOnly: true,
projectTypes: ['ios', 'android'],
algoliaOptions: {
attributesToRetrieve: ['cvs', 'step.project_type_tags']
}
});
// iosAndAndroidLatestSteps
[
...
{
"cvs": "gradle-coveralls@1.0.1",
"step": {
"project_type_tags": [
"android"
]
}
},
{
"cvs": "firebase-dsym-upload@1.0.1",
"step": {
"project_type_tags": [
"ios",
"xamarin",
"react-native"
]
}
},
{
"cvs": "bitrise-step-icon-overlay@1.0.1",
"step": {
"project_type_tags": [
"ios",
"xamarin"
]
}
},
{
"cvs": "appcenter-deploy-android@1.0.1",
"step": {
"project_type_tags": [
"android",
"react-native",
"flutter"
]
}
},
{
"cvs": "detekt@1.0.0",
"step": {
"project_type_tags": [
"android"
],
}
},
...
]
With custom algoliaOptions
, you can override any Algolia parameter
const customAlgoliaOptions: Step[] = await stepLib.list({
query: 'react-native',
latestOnly: false,
algoliaOptions: {
attributesToRetrieve: ['id', 'version', 'cvs', 'info']
}
});
// customAlgoliaOptions
[
{
"cvs": "react-native-bundle@1.0.4",
"id": "react-native-bundle",
"version": "1.0.4",
"info": {
"asset_urls": {
"icon.svg": "https://bitrise-steplib-collection.s3.amazonaws.com/steps/react-native-bundle/assets/icon.svg"
}
}
},
{
"cvs": "install-react-native@0.9.2",
"id": "install-react-native",
"version": "0.9.2",
"info": {
"asset_urls": {
"icon.svg": "https://bitrise-steplib-collection.s3.amazonaws.com/steps/install-react-native/assets/icon.svg"
}
}
},
{
"cvs": "appcenter-codepush-release-react-native@0.0.2",
"id": "appcenter-codepush-release-react-native",
"version": "0.0.2",
"info": {
"asset_urls": {
"icon.svg": "https://bitrise-steplib-collection.s3.amazonaws.com/steps/appcenter-codepush-release-react-native/assets/icon.svg"
}
}
}
]
You can leverage Algolia's fuzzy search
const fuzzySteps: Step[] = await stepLib.list({
query: 'Anbroid Ebulator',
latestOnly: true,
algoliaOptions: {
restrictSearchableAttributes: ['step.title'],
typoTolerance: true,
attributesToRetrieve: ['step.title', 'cvs']
}
});
// fuzzySteps
[
{
"cvs": "start-android-emulator@1.3.2",
"step": {
"title": "Start Android emulator"
}
},
{
"cvs": "create-android-emulator@1.1.6",
"step": {
"title": "Create Android emulator"
}
},
{
"cvs": "wait-for-android-emulator@1.0.4",
"step": {
"title": "Wait for Android emulator"
}
}
]
Include these scripts
<script src="//unpkg.com/algoliasearch/dist/algoliasearch.min.js"></script>
<script src="//unpkg.com/@bitrise/steplib-search"></script>
Then use it similarly as descibed above
var stepLib = new StepLib('ALGOLIA_APP_ID', 'ALGOLIA_API_KEY');
stepLib.list().then(function(latestSteps) {
console.log('Yay, steps!', latestSteps);
});
yarn
yarn test
or yarn test --watch
This repo uses a strict commit message structure that follows the Conventional Commits spec. This is used to automate publishing the package to NPM and generating the changelog with Semantic Release.
Using Semantic Release to NPM
FAQs
List and search steps for your Bitrise workflow
The npm package @bitrise/steplib-search receives a total of 3 weekly downloads. As such, @bitrise/steplib-search popularity was classified as not popular.
We found that @bitrise/steplib-search demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 8 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Four npm packages disguised as cryptographic tools steal developer credentials and send them to attacker-controlled Telegram infrastructure.
Security News
Ruby maintainers from Bundler and rbenv teams are building rv to bring Python uv's speed and unified tooling approach to Ruby development.
Security News
Following last week’s supply chain attack, Nx published findings on the GitHub Actions exploit and moved npm publishing to Trusted Publishers.