
Security News
npm Adopts OIDC for Trusted Publishing in CI/CD Workflows
npm now supports Trusted Publishing with OIDC, enabling secure package publishing directly from CI/CD workflows without relying on long-lived tokens.
@code4rena/skeleton
Advanced tools
```shell > npm i -D --save-exact @code4rena/skeleton > npm pkg set skeleton.module=@code4rena/skeleton > npx code-skeleton apply ```
code-skeleton
config for code4rena usage> npm i -D --save-exact @code4rena/skeleton
> npm pkg set skeleton.module=@code4rena/skeleton
> npx code-skeleton apply
Important Note on '@tsconfig/node18/tsconfig.json' not found, and Tap:
There is currently an issue in ts-node that causes a loading problem when combined with Tap.js. There is a recommended workaround for this. Once you update your skeleton, swap out these plugins:
npx tap plugin add @tapjs/tsx
npx tap plugin rm @tapjs/typescript
In your projects package.json
you can set custom CI variables to extend the default workflow. The following configuration will add a Postgres service to the test job, as well as inject the DOTENV_KEY
environment variables for dotenv vault usage.
"skeleton": {
"variables": {
"ci": {
"postgres": true,
"env_vault": true
}
}
},
When enabled, you will need to set the following repository variables in your github repos action variables ({repo}/settings/variables/actions
):
When enabled, in addition to a commited .env.vault file, you will need to set the DOTENV_KEY
environment secret for the desired .env file from your .env.keys file. Set this as a repository secret at {repo}/settings/secrets/actions
on github.
Check the latest version
Run: npm i -D --save-exact @code4rena/skeleton@[LATEST_VERSION]
Then: npx code-skeleton apply
If you see a Permission Denied
issue with shebang
, you can run chmod +x ./scripts/update-shebang.ts
FAQs
```shell > npm i -D --save-exact @code4rena/skeleton > npm pkg set skeleton.module=@code4rena/skeleton > npx code-skeleton apply ```
We found that @code4rena/skeleton demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 13 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
npm now supports Trusted Publishing with OIDC, enabling secure package publishing directly from CI/CD workflows without relying on long-lived tokens.
Research
/Security News
A RubyGems malware campaign used 60 malicious packages posing as automation tools to steal credentials from social media and marketing tool users.
Security News
The CNA Scorecard ranks CVE issuers by data completeness, revealing major gaps in patch info and software identifiers across thousands of vulnerabilities.