
Research
PyPI Package Disguised as Instagram Growth Tool Harvests User Credentials
A deceptive PyPI package posing as an Instagram growth tool collects user credentials and sends them to third-party bot services.
@campus-online/gatsby-source-git
Advanced tools
Source plugin for pulling files into Gatsby from git repositories
Source plugin for pulling files into the Gatsby graph from abitrary Git repositories (hosted anywhere). This is useful if the markdown files you wish to render can't live within your gatsby codebase, or if need to aggregate content from disparate repositories.
It clones the repo(s) you configure (a shallow clone, into your cache folder if
you're interested), and then sucks the files into the graph as File
nodes, as
if you'd configured
gatsby-source-filesystem
on that directory. As such, all the tranformer plugins that operate on files
should work exactly as they do with gatsby-source-filesystem
eg with
gatsby-transformer-remark
, gatsby-transformer-json
etc.
The only difference is that the File
nodes created by this plugin will
also have a gitRemote
field, which will provide you with various bits of
Git related information. The fields on the gitRemote
node are
mostly provided by
IonicaBazau/git-url-parse, with
the addition of ref
and weblink
fields, which are
the 2 main things you probably want if you're constructing "edit on github"
style links.
Requires git to be installed, and to be callable using the command git
.
Ideally we'd use nodegit, but it doesn't support shallow clones (see libgit2/libgit2#3058) which would have a significant effect on build times if you wanted to read files from git repositories with large histories.
Only public repositories are supported right now. But a PR should be simple enough if you want that.
Not published on npm yet, so for now:
npm install --save stevetweeddale/gatsby-source-git
// In your gatsby-config.js
module.exports = {
plugins: [
// You can have multiple instances of this plugin
// to read source nodes from different repositories.
{
resolve: `gatsby-source-git`,
options: {
name: `repo-one`,
remote: `https://bitbucket.org/stevetweeddale/markdown-test.git`,
// Optionally supply a branch. If none supplied, you'll get the default branch.
branch: `develop`,
// Tailor which files get imported eg. import the docs folder from a codebase.
patterns: `docs/**`
}
},
{
resolve: `gatsby-source-git`,
options: {
name: `repo-two`,
remote: `https://bitbucket.org/stevetweeddale/markdown-test.git`,
// Multiple patterns and negation supported. See https://github.com/mrmlnc/fast-glob
patterns: [`*`, `!*.md`]
}
},
{
resolve: `gatsby-source-git`,
options: {
name: `repo-three`,
remote: `https://bitbucket.org/stevetweeddale/markdown-test.git`,
// Multiple "sourceInstanceName" on the same repo via object.
patterns: {
articles: `docs/articles/*.md`,
authors: `docs/authors/*.md`,
}
}
}
]
};
You can query file nodes exactly as you would node query for nodes created with
gatsby-source-filesystem
,
eg:
{
allFile {
edges {
node {
extension
dir
modifiedTime
}
}
}
}
Similarly, you can filter by the name
you specified in the config by using
sourceInstanceName
:
{
allFile(filter: { sourceInstanceName: { eq: "repo-one" } }) {
edges {
node {
extension
dir
modifiedTime
}
}
}
}
And access some information about the git repo:
{
allFile {
edges {
node {
gitRemote {
webLink
ref
}
}
}
}
}
FAQs
Source plugin for pulling files into Gatsby from git repositories
The npm package @campus-online/gatsby-source-git receives a total of 0 weekly downloads. As such, @campus-online/gatsby-source-git popularity was classified as not popular.
We found that @campus-online/gatsby-source-git demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
A deceptive PyPI package posing as an Instagram growth tool collects user credentials and sends them to third-party bot services.
Product
Socket now supports pylock.toml, enabling secure, reproducible Python builds with advanced scanning and full alignment with PEP 751's new standard.
Security News
Research
Socket uncovered two npm packages that register hidden HTTP endpoints to delete all files on command.