
Research
/Security News
DuckDB npm Account Compromised in Continuing Supply Chain Attack
Ongoing npm supply chain attack spreads to DuckDB: multiple packages compromised with the same wallet-drainer malware.
@trussle/ci
Advanced tools
This package provides a suite of scripts used by Trussle's Continuous Integration system to build Docker images for testing and deployment.
Install this package as a devDependency:
npm install --save-dev @trussle/ci
Next, set up your Dockerfile with the following constraints:
builder
stage, which creates an image ready to build and
test in the /builder
directory. The ENTRYPOINT
should run all unit tests
(with coverage) and provide results in JUnit format to the directory
/builder/test-results
.ENTRYPOINT
should run the
application.NPM_TOKEN
, so you'll likely need the following lines at the top of your
Dockerfile:# Embed the NPM_TOKEN (passed in from the host machine) into the image.
ARG NPM_TOKEN
RUN echo -n ${NPM_TOKEN} > /root/.npmrc
Samples of Dockerfiles can be found in the templates.
If you have integration tests (tests that require an external dependency to be running), you should include a Docker Compose file that looks like this:
version: "2.1"
services:
integration:
image: "878732450721.dkr.ecr.eu-west-1.amazonaws.com/[package-name]-builder:latest"
# depends_on:
# - service1
# - service2
entrypoint: npm run test:integration
environment:
- NODE_ENV=CI
# Your other services go here!
You can now run:
npx t-ci builder
to make the build/test image.npx t-ci test-unit
runs unit tests in the builder.npx t-ci test-integration
sets up the Docker Compose environment and runs
the integration tests.npx t-ci runner
to make the runner image.These commands can be used to make your Jenkinsfile super short:
pipeline {
agent any
stages {
stage("Setup") { steps { sh "npx t-ci builder" } }
stage("Tests") {
parallel {
stage("Unit Tests") { steps { sh "npx t-ci test-unit" } }
stage("Integration Tests") { steps { sh "npx t-ci test-integration" } }
}
}
stage("Build") { steps { sh "npx t-ci runner" } }
}
post {
always {
junit "test-results/**/*.xml"
sh "aws s3 sync test-results/ s3://qa-junit-test-reports/${env.JOB_NAME}/${env.BUILD_NUMBER}/test-results"
cleanWs(
cleanWhenAborted: true,
cleanWhenFailure: true,
cleanWhenNotBuilt: true,
cleanWhenSuccess: true,
cleanWhenUnstable: true,
cleanupMatrixParent: true,
deleteDirs: true
)
}
}
}
FAQs
Continuous Integration scripts
We found that @trussle/ci demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 14 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
/Security News
Ongoing npm supply chain attack spreads to DuckDB: multiple packages compromised with the same wallet-drainer malware.
Security News
The MCP Steering Committee has launched the official MCP Registry in preview, a central hub for discovering and publishing MCP servers.
Product
Socket’s new Pull Request Stories give security teams clear visibility into dependency risks and outcomes across scanned pull requests.