
Security News
PodRocket Podcast: Inside the Recent npm Supply Chain Attacks
Socket CEO Feross Aboukhadijeh discusses the recent npm supply chain attacks on PodRocket, covering novel attack vectors and how developers can protect themselves.
@monstermakes/larry-bnd
Advanced tools
More accurate called "Build, release, and deploy" this package aims to provide an opinionated way to build, release and deploy mono repo based products and libraries.
It provides a cookbook to help train developers on these opinons and provide BND developers with a playground to explore ideas and develop changes to BND itself.
It provides a set of scm tools to help code owners enforce the rules and make sure things stay tidy.
It provides build tooling for both products and libraries where the pipelines are fixed but the implemenation is provided by the products and library packages themselves.
It provides deployment tooling for products to describe how they must be deployed, this includes release notes generation, deployment communication, rollback, and verification/smoke test.
references
portion of the conventional commithttps://automation.atlassian.com/pro/hooks/8d76c6f30c3a785d60d205cbdbd2b0534fd63628
{
"pullrequest": {
"source": {
"branch": {
"name": "AFD-2164"
}
},
"destination": {
"branch": {
"namex": "int-super-dope-sauce",
"namex": "super-dope-sauce",
"name": "1.0.0-alpha.0"
}
}
}
}
https://automation.atlassian.com/pro/hooks/49da906af1de911547f7695cfdb04143a4e83317
"versionDetails": {
"productVersion": "12.4.0-beta.0",
"fixVersion": "12.4.0"
},
"environmentDetails": {
"environmentNameX": "alpha",
"environmentName": "beta",
"environmentNameX": "rc",
"environmentNameX": "staging",
"environmentNameX": "production"
},
"deploymentDetails": {
"releaseNotes": "{code}\n#Markdown goes here!{code}\n"
}
}
file names
Tag locally to set the last released changeset
Would this even make sense outside of a mono repo?
FAQs
Build and Deploy of mono repo projects.
We found that @monstermakes/larry-bnd demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Socket CEO Feross Aboukhadijeh discusses the recent npm supply chain attacks on PodRocket, covering novel attack vectors and how developers can protect themselves.
Security News
Maintainers back GitHub’s npm security overhaul but raise concerns about CI/CD workflows, enterprise support, and token management.
Product
Socket Firewall is a free tool that blocks malicious packages at install time, giving developers proactive protection against rising supply chain attacks.