Security News
Maven Central Adds Sigstore Signature Validation
Maven Central now validates Sigstore signatures, making it easier for developers to verify the provenance of Java packages.
@sparkbox/carbon-cli
Advanced tools
$ npm i -g @sparkbox/carbon-cli
Alternatively, you can run it without a global install:
$ npx -p @sparkbox/carbon-cli carbon
Accelerated project setup. Use existing repos as templates.
carbon
After installing, you should have a carbon
command. Running with no options will walk you through a repo setup...
$ carbon
? GitHub username or email iamnathanj
? GitHub password ◦◦◦◦◦◦◦◦
? GitHub 2FA passcode 508412
? search repos bouncy-ball
? project name /Users/nj/code/bouncy-ball-copy
✔ initialize repo
✔ download bouncy-ball
✔ tidy up package.json
✔ customize project files
✔ create new remote on GitHub
✔ install dependencies
╭────────────────────────────────────────────────────────────────────╮
│ │
│ success! │
│ │
│ ❯ /Users/nj/code/bouncy-ball-copy │
│ │
│ --- │
│ │
│ url https://api.github.com/repos/iAmNathanJ/bouncy-ball-copy │
│ ssh git@github.com:iAmNathanJ/bouncy-ball-copy.git │
│ https https://github.com/iAmNathanJ/bouncy-ball-copy.git │
│ │
╰────────────────────────────────────────────────────────────────────╯
This command requires authenticating with your GitHub account and selecting a repo as a starting point. The overall flow is:
master
)true
)After that
carbon config
This config
command will add a set of configuration files for common front-end tooling. The generated files are intended to follow "best practices" but are somewhat opinionated. These are meant to be used as a starting point, but many will suffice as is.
The configs
command is non-destructive. It will not overwrite any existing config files unless run in force
mode.
The default carbon
command provides a basic auth flow for GitHub so you can access your repos. You can alternatively provide a personal access token via an environment variable called CARBON_CLI_TOKEN
to skip the login step.
To set this up:
.bashrc
(or similar).One way of doing this is to create a file specifically for personal or secret information.
# ~/.secrets
export CARBON_CLI_TOKEN=xxxxxxxxxxxxxxxxxxx
Then source
that file from your shell startup.
# .bashrc
source ~/.secrets
Yes, please!
See the contributing guidelines for details.
TODO
FAQs
Project Setup Automation
We found that @sparkbox/carbon-cli demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 8 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Maven Central now validates Sigstore signatures, making it easier for developers to verify the provenance of Java packages.
Security News
CISOs are racing to adopt AI for cybersecurity, but hurdles in budgets and governance may leave some falling behind in the fight against cyber threats.
Research
Security News
Socket researchers uncovered a backdoored typosquat of BoltDB in the Go ecosystem, exploiting Go Module Proxy caching to persist undetected for years.