
Research
Two Malicious Rust Crates Impersonate Popular Logger to Steal Wallet Keys
Socket uncovers malicious Rust crates impersonating fast_log to steal Solana and Ethereum wallet keys from source code.
@trussle/ci
Advanced tools
This package provides a suite of scripts used by Trussle's Continuous Integration system to build Docker images for testing and deployment.
Install this package as a devDependency:
npm install --save-dev @trussle/ci
Next, set up your Dockerfile with the following constraints:
builder
stage, which creates an image ready to build and
test in the /builder
directory. The ENTRYPOINT
should run all unit tests
(with coverage) and provide results in JUnit format to the directory
/builder/test-results
.ENTRYPOINT
should run the
application.NPM_TOKEN
, so you'll likely need the following lines at the top of your
Dockerfile:# Embed the NPM_TOKEN (passed in from the host machine) into the image.
ARG NPM_TOKEN
RUN echo -n ${NPM_TOKEN} > /root/.npmrc
Samples of Dockerfiles can be found in the templates.
If you have integration tests (tests that require an external dependency to be running), you should include a Docker Compose file that looks like this:
version: '2.1'
services:
integration:
image: "878732450721.dkr.ecr.eu-west-1.amazonaws.com/[package-name]-builder:latest"
# depends_on:
# - service1
# - service2
entrypoint: npm run test:integration
environment:
- NODE_ENV=CI
# Your other services go here!
You can now run:
npx t-ci builder
to make the build/test image.npx t-ci test-unit
runs unit tests in the builder.npx t-ci test-integration
sets up the Docker Compose environment and runs
the integration tests.npx t-ci runner
to make the runner image.These commands can be used to make your Jenkinsfile super short:
pipeline {
agent any
stages {
stage("Setup") { steps { sh "npx t-ci builder" } }
stage("Tests") {
parallel {
stage("Unit Tests") { steps { sh "npx t-ci test-unit" } }
stage("Integration Tests") { steps { sh "npx t-ci test-integration" } }
}
}
stage("Build") { steps { sh "npx t-ci runner" } }
}
post {
always {
junit "test-results/**/*.xml"
sh "aws s3 sync test-results/ s3://qa-junit-test-reports/${env.JOB_NAME}/${env.BUILD_NUMBER}/test-results"
cleanWs(
cleanWhenAborted: true,
cleanWhenFailure: true,
cleanWhenNotBuilt: true,
cleanWhenSuccess: true,
cleanWhenUnstable: true,
cleanupMatrixParent: true,
deleteDirs: true
)
}
}
}
FAQs
Continuous Integration scripts
We found that @trussle/ci demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 14 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Socket uncovers malicious Rust crates impersonating fast_log to steal Solana and Ethereum wallet keys from source code.
Research
A malicious package uses a QR code as steganography in an innovative technique.
Research
/Security News
Socket identified 80 fake candidates targeting engineering roles, including suspected North Korean operators, exposing the new reality of hiring as a security function.