Security News
PyPI’s New Archival Feature Closes a Major Security Gap
PyPI now allows maintainers to archive projects, improving security and helping users make informed decisions about their dependencies.
@treehouse/guidelines
Advanced tools
This repository contains all guidelines for the development team. This is meant as a living document and contributions or changes are welcome and can be discussed through the form of a Pull Request to this repository.
A default local development environment can be quickly set up using our provisioning scripts. This will install the Atom IDE and configure a basic Node environment with the n
module available to quickly switch between Node versions on your local machine.
Once your development environment is configured, you can customize your toolsets or IDE as you see fit so long as any final pushed code aligns with TreeHouse development guidelines and any agreed-upon conventions as determined by your team.
The "Current" (6.x
) version of Node is being used unless otherwise noted in a specific project. TreeHouse has a private NPM namespace at @treehouse/[package]
which contains code specific to TreeHouse applications or where a public release is not appropriate due to the volatility of the development state. (See our open source guidelines for more details on use)
Once you have been added to our NPM organization you will need to login and add the authorization token to your .bash_profile
in order to install and run any host application with a private dependency:
npm login
and enter your credentials.cat ~/.npmrc | awk -F'authToken=' '{print $2}' | pbcopy
to copy your access token.atom ~/.bash_profile
to edit your bash profileexport NPM_TOKEN="[token]"
to the top of this file.source ~/.bash_profile
to refresh your Terminal session.Docker is being used to run databases locally depending on the specific project requirements. Kitematic is installed as a GUI for managing the running containers.
Databases will be determined by the project and it's specific needs. With that in mind, we will typically use the following databases:
All databases can be installed and run locally in a Docker container using Kitematic.
Team development guidelines and agreed-upon conventions should be observed at all times. More information on general team guidelines can be found in Contributing Guidelines.
Specific architecture decisions will be documented in their corresponding repositories. With that said, we will generally use the following technologies:
Whenever appropriate, new applications which can be built off the main services API will be structured as independent lightweight front-end applications.
Following best practices, all applications store sensitive configuration in the environment and not the codebase. Local configuration can be managed in config/local.js
to provide environment variables at run-time when developing locally.
Winston is used to declare various levels of verbosity in the log output. In production, only info
level and above will be sent to Logentries for storage and aggregation. In development, the logging output can be adjusted for individual debugging needs but defaults to verbose
and above.
In addition to standard logging, exception tracking in Production on both the server and the client will be reported through Raygun. This will include aggregation of full stack traces along with details on the user and browser when the exception occurred.
New Relic APM is used for storage and aggregation of all metrics from applications running in production. In addition, it will serve as uptime monitor and emergency alerts in the case of an issue in production.
Heroku is used for all production applications, QA environments, and review apps. Each application will be configured in a Pipeline. This ensures that all code being reviewed at any stage in the feature development lifecycle is done so on an exact replica of the production environment.
IBM Compose is used for all databases and provides automated backups and disaster recovery in addition to general database environment optimization and configuration.
Due to ephemeral file systems on all production applications, any permanent file storage will utilize Amazon S3 buckets. When files are uploaded by users, a CORS upload will be used to transfer the file directly between the user and S3 without involving the production application.
Cloudflare is used as both a CDN and a layer of threat mitigation. If custom proxying is required an additional proxy server may be used which runs NGINX. Generally, all caching should be deferred to either Cloudflare or NGINX to avoid cache conflicts and prevent deployment complications.
FAQs
TreeHouse development guidelines and team processes.
The npm package @treehouse/guidelines receives a total of 2 weekly downloads. As such, @treehouse/guidelines popularity was classified as not popular.
We found that @treehouse/guidelines demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 3 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
PyPI now allows maintainers to archive projects, improving security and helping users make informed decisions about their dependencies.
Research
Security News
Malicious npm package postcss-optimizer delivers BeaverTail malware, targeting developer systems; similarities to past campaigns suggest a North Korean connection.
Security News
CISA's KEV data is now on GitHub, offering easier access, API integration, commit history tracking, and automated updates for security teams and researchers.