
Research
2025 Report: Destructive Malware in Open Source Packages
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.
@lukeocodes/vectornator
Advanced tools
Maintain remote vector stores with your repository content - GitHub Action and CLI tool
Maintain remote vector stores with your repository content. Automatically sync documentation, markdown files, and other text content to vector databases for AI applications.
name: Sync to Vector Store
on:
push:
branches: [main]
paths:
- "docs/**"
- "*.md"
jobs:
sync:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
with:
fetch-depth: 0 # Required for git branch metadata
- uses: lukeocodes/vectornator@v1
with:
api-key: ${{ secrets.OPENAI_API_KEY }}
store-id: ${{ secrets.VECTOR_STORE_ID }}
directory: docs
patterns: "**/*.md,**/*.mdx"
# Install globally
npm install -g @lukeocodes/vectornator
# Or use with npx
npx @lukeocodes/vectornator sync --directory ./docs
npm install -g @lukeocodes/vectornator
Add to your workflow:
- uses: lukeocodes/vectornator@v1
# OpenAI Provider
OPENAI_API_KEY=your-api-key
OPENAI_STORE_ID=your-store-id
# Metadata branch name (optional)
VECTORNATOR_METADATA_BRANCH=metadata/my-project
# Other providers (coming soon)
PINECONE_API_KEY=your-api-key
PINECONE_ENVIRONMENT=your-environment
See Configuration Guide for more options.
vectornator sync [options]
Options:
-d, --directory <path> Directory to sync (default: ".")
-p, --provider <name> Vector store provider (default: "openai")
--patterns <patterns...> File patterns to include
--exclude <patterns...> File patterns to exclude
--dry-run Show what would be done without making changes
--metadata-storage <type> Metadata storage type: git-branch or file (default: git-branch)
--store-id <id> Vector store ID
--api-key <key> API key for the provider
-v, --verbose Verbose output
-h, --help Display help
| Input | Description | Required | Default |
|---|---|---|---|
api-key | API key for the vector store provider | Yes | - |
store-id | Vector store ID | No | - |
directory | Directory to sync | No | . |
provider | Vector store provider | No | openai |
patterns | File patterns to include (comma-separated) | No | **/*.md,**/*.mdx,**/*.txt |
exclude | File patterns to exclude (comma-separated) | No | node_modules/**,.git/**,dist/** |
dry-run | Show what would be done without making changes | No | false |
verbose | Enable verbose output | No | false |
# Sync current directory
vectornator sync
# Sync specific directory
vectornator sync --directory ./docs
# Dry run to see what would happen
vectornator sync --dry-run
vectornator create-store "my-documentation"
# Output: Store ID: vs_abc123...
vectornator list
# Only sync markdown files
vectornator sync --patterns "**/*.md"
# Exclude test files
vectornator sync --exclude "**/test/**" "**/*.test.md"
By default, Vectornator stores sync metadata in a dedicated git branch. This keeps your repository clean:
# View metadata
vectornator show-metadata
# Use file-based metadata instead
vectornator sync --metadata-storage file
Vectornator uses a dedicated git branch by default to store sync metadata. This means:
.vectornator directory in your repoThe metadata is stored in the metadata/vectornator branch and includes:
const provider = new OpenAIProvider();
await provider.initialize({
apiKey: process.env.OPENAI_API_KEY,
storeId: process.env.OPENAI_STORE_ID,
});
Implement the VectorStoreProvider interface:
import { BaseVectorStoreProvider } from "@lukeocodes/vectornator";
export class MyCustomProvider extends BaseVectorStoreProvider {
name = "custom";
async validateConfig(): Promise<void> {
// Validate your configuration
}
async connect(): Promise<void> {
// Connect to your service
}
async uploadFile(
filePath: string,
content: Buffer,
metadata: FileMetadata
): Promise<string> {
// Upload file and return ID
}
// ... implement other required methods
}
# Clone the repository
git clone https://github.com/lukeocodes/vectornator.git
cd vectornator
# Install dependencies
npm install
# Build
npm run build
# Run tests
npm test
# Development mode
npm run dev
During development, you can test the sync functionality using the test workflow:
# Go to Actions tab in GitHub and run "Test Sync Workflow"
# Or trigger via GitHub CLI:
gh workflow run test-sync.yml -f dry-run=true -f provider=openai
The test workflow allows you to:
vectornator/
├── src/
│ ├── types/ # TypeScript interfaces
│ ├── providers/ # Vector store providers
│ ├── core/ # Core sync engine
│ └── cli.ts # CLI interface
├── action.yml # GitHub Action definition
└── package.json # npm package definition
Vectornator supports two metadata storage strategies:
Uses a dedicated metadata/vectornator branch to store sync state:
# Default behavior
vectornator sync
# Explicitly specify git-branch storage
vectornator sync --metadata-storage git-branch
The GitHub Action automatically handles fetching and pushing the metadata branch.
Stores metadata in .vectornator/metadata.json:
# Use file storage
vectornator sync --metadata-storage file --metadata-file .vectornator/metadata.json
Create a new store:
vectornator create-store "my-docs"
For existing projects, run an initial sync:
vectornator sync --force
If you need to reset the metadata branch:
# Delete local metadata branch
git branch -D metadata/vectornator
# Delete remote metadata branch
git push origin --delete metadata/vectornator
# Run sync again to recreate
vectornator sync
Contributions are welcome! Please read our Contributing Guide for details.
MIT © Luke Oliff
FAQs
Maintain remote vector stores with your repository content - GitHub Action and CLI tool
We found that @lukeocodes/vectornator demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.

Security News
Socket CTO Ahmad Nassri shares practical AI coding techniques, tools, and team workflows, plus what still feels noisy and why shipping remains human-led.

Research
/Security News
A five-month operation turned 27 npm packages into durable hosting for browser-run lures that mimic document-sharing portals and Microsoft sign-in, targeting 25 organizations across manufacturing, industrial automation, plastics, and healthcare for credential theft.