Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
@camunda/camunda-composite-components
Advanced tools
Camunda Composite Components (also known as C3) is the main software artifact of the Design System Team.
We have a dedicated slack channel for everyone having questions, comments, bug reports or concerns about this repository: #camunda-composite-components. For more general questions towards the Design System team, please use #ask-cds.
If you like the idea of having a repository for your own composite components - how about you do your own Camunda Custom Composite Components? Just go over here, fork it, lezgo! A list of C4-Adopters can be found here.
A live view of the main
branch can be found
here. When opening a PR, a
version of storybook with the changes is deployed automatically and can be
accessed by clicking on the link in the PR.
# install
yarn
# start storybook
yarn storybook
# build components
yarn build
Simply run our release workflow in the GitHub Actions tab. This will create a new release, publish the package to npm and update the changelog automatically.
Pushing to main
will update the storybook available under
cloudflare page.
Example for navbar:
import { C3NavigationElementProps } from "@camunda/camunda-composite-components"
// ...
return (
<C3Navigation
app={{
ariaLabel: "Camunda Console",
name: "Console",
prefix: "Camunda",
routeProps: { route: routes.home, router: router },
}}
// ...
/>
)
We use Playwright screenshot tests to be aware of any visual changes introduced by dependency updates or changes in the component code.
We run VRT inside a docker container to avoid different results caused by different platforms. Simply run:
yarn start:docker-storybook
then
yarn test:visual-regression:docker
The commands above will:
c3-visual-regression
.When developing, it might not always be helpful to run all of these steps at once. You can find more granular scripts in the package.json.
There is a Visual regression tests
workflow that is triggered automatically on
push. You can also trigger it manually in the Actions
tab.
If the workflow fails, you can find the test report by navigating to the
workflow run summary, then scrolling down to the Artifacts
section. Click on
the artifact called Playwright report
to download it, go to your downloads
folder, then open the index.html
file of the test report in your browser to
view the report.
When a VRT fails, this can have two reasons:
Make sure you have the c3-visual-regression
docker container running, or start
it like described here. Then, have a look at the test
report:
yarn report:visual-regression
Double-check that you don't apply any unwanted changes by looking at the difference that is highlighted in the failed test's report.
To update all screenshots, run:
yarn update:visual-regression:docker
The tests should now pass locally and in the CI. Commit and push the updated screenshot(s).
FAQs
Camunda Composite Components
We found that @camunda/camunda-composite-components demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.