Security News
pnpm 10.0.0 Blocks Lifecycle Scripts by Default
pnpm 10 blocks lifecycle scripts by default to improve security, addressing supply chain attack risks but sparking debate over compatibility and workflow changes.
Convention-based build tool for Node.js projects.
npm install -g bob
Mandatory:
Optional (only relevant when project is an app):
node {name}.js start|stop|restart|status
Reserved and generated by Bob:
Bob can be run from the project root directory (same level as package.json file).
Install project dependencies (per Node.js project):
bob dep
Run Bob from project directory:
bob target1 target2 target3 ...
Run Bob with specific environment: (if unspecified, NODE_ENV defaults to 'development')
NODE_ENV=production bob start
Run Bob in robot mode and generate XML reports: (if unspecified, BOB_MODE defaults to 'human')
BOB_MODE=robot bob lint test
dep | Install all dependencies specified in package.json file by executing npm install . . |
tools | Install all Bob CLI dependencies in global scope. |
clean | Delete build/ and run/ directories, along with any nohup.* and *.log files. |
lint | Run jshint/node-jshint or tav/nodelint against all .js files in lib/ and test/ directories. |
style | Run nomiddlename/jscheckstyle against all .js files in lib/ directory. |
test | Run cloudhead/vows against all .js files in test/ directory. If {scripts.test} is available, then npm test will be executed instead. |
coverage (experimental) | Run visionmedia/node-jscoverage via cloudhead/vows against all .js files in test/ and lib/ directories. |
doc | Run nodeca/ndoc against all .js files in lib/ directory. |
versionup | Upgrade patch version number in package.json file. |
versionup-minor | Upgrade minor version number in package.json file. |
versionup-major | Upgrade major version number in package.json file. |
template (experimental) | Populate variables in template files with values from package.json file. |
stop | Stop the app by executing node {name}.js stop . If {scripts.stop} is configured, then npm stop will be executed instead. |
start | Start the app by executing node {name}.js start . If {scripts.start} is configured, then npm start will be executed instead. |
restart | Restart the app by executing node {name}.js restart . If {scripts.restart} is configured, then npm restart will be executed instead. |
status | Display app status by executing node {name}.js status . |
nuke | Kill all processes with command containing the word 'node' . |
package | Create a .tar.gz package file at build/artifact/ directory, along with md5 and sha1 checksums of the package file. |
package-meta (experimental) | Create a meta file to build/artifact, along with md5 and sha1 checksums of the meta file. |
deploy (experimental) | Upload the .tar.gz package file to a remote location, either via SCP or FTP. |
ssh-unpack (experimental) | (SSH only) Deploy, then remotely unpack the .tar.gz package file. |
ssh-restart (experimental) | (SSH only) Deploy, unpack, then remotely execute node {name.js} restart . |
ssh-mkdir (experimental) | (SSH only) Remotely create the directory to deploy the package file to. |
Even though it's recommended to follow the project convention further above, it is possible to customise Bob's build target parameters.
Create a .bob.json file on the project's root directory (same level as package.json), containing a JSON object with this format:
{
"x": {
"y": "z"
}
}
x.y properties will be used as BOB_X_Y in Bob's Makefile.
Check out the Makefile for a full list of parameters. NOTE: only the parameters prefixed with BOB_ are customisable.
###Travis CI
Configure the project's .travis.yml file:
before_install: "npm install -g bob"
script: "bob clean lint test coverage"
###Jenkins CI
Install Bob on the server, then configure a job with shell script build step:
bob clean lint test coverage;
Follow @cliffano on Twitter.
FAQs
Convention-based build tool for node.js projects.
The npm package bob receives a total of 37 weekly downloads. As such, bob popularity was classified as not popular.
We found that bob demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
pnpm 10 blocks lifecycle scripts by default to improve security, addressing supply chain attack risks but sparking debate over compatibility and workflow changes.
Product
Socket now supports uv.lock files to ensure consistent, secure dependency resolution for Python projects and enhance supply chain security.
Research
Security News
Socket researchers have discovered multiple malicious npm packages targeting Solana private keys, abusing Gmail to exfiltrate the data and drain Solana wallets.