
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
@haoadoresorange/gitpkg
Advanced tools
Publish packages as git tags
🍴 Fork of original gitpkg, bypass git hooks by default.
🔧 Works with projects with build steps.
👯 Works with projects with multiple packages (monorepos).
🏎 Lightweight git tags (only the files needed are included).
Both npm and yarn support installing packages from git tags.
But things can get difficult with packages that have a build step (eg babel) and monorepos with multiples packages (eg lerna).
gitpkg publish creates a git tag with the same files as if you were running npm publish or yarn publish and uploads the generated git tag to a git repository.
Also you can publish any gitpkg package to the same repository, so you can have only one repository used as common registry and you get away from your project git repository the git tags with the build code.
Node.js v10.12 or newer is required.
Via the yarn client:
$ yarn global add @haoadoresorange/gitpkg
Via the npm client:
$ npm install -g @haoadoresorange/gitpkg
Via the yarn client:
$ yarn global add https://github.com/haoadoresorange/gitpkg.git#haoadoresorange-gitpkg-v1.0.0-gitpkg
Via the npm client:
$ npm install -g https://github.com/haoadoresorange/gitpkg.git#haoadoresorange-gitpkg-v1.0.0-gitpkg
Publishes a package to a git repository, by default uploads the package to the git repository in the git remote origin (git remote -v to see your git remote origin url). The package published is defined by the package.json in the current directory.
$ gitpkg publish
$ gitpkg publish --registry git@mygit.server:org/private-registry.git
This flag tells gitpkg to publish the package to a specific gitpkg registry.
You can also set the gitpkg registry permanently by adding "gitpkg":{"registry":"git@mygit.server:org/private-registry.git"} to the package.json.
You can also configure gitpkg with a config file. Create a file named gitpkg.config.js in the root of your project or in the root of a subpackage.
Publish the package to a specific gitpkg registry. Same as the registry flag of the cli.
Function used to create the git tags. The function receives one object pkg, which is the content of the package.json file.
// Example content of gitpkg.config.js
module.exports = () => ({
registry: "git@mygit.server:org/private-registry.git",
getTagName: (pkg) => `${pkg.name}-v${pkg.version}-gitpkg`,
});
Feel free to dive in! Open an issue or submit PRs.
gitpkg follows the Contributor Covenant Code of Conduct.
FAQs
Publish packages as git tags
We found that @haoadoresorange/gitpkg demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.