Security News
pnpm 10.0.0 Blocks Lifecycle Scripts by Default
pnpm 10 blocks lifecycle scripts by default to improve security, addressing supply chain attack risks but sparking debate over compatibility and workflow changes.
build-workflow
Advanced tools
IMPORTANT
If I have to start again, I will probably not choose any build tool but directly embrace the npm as build tool* trend. Grunt has indeed helped me a lot, there are lot of plugins available, it is easy to configure, but it can get really messy for a fairly complex build workflow. And that's the same with gulp or all the other build tools out there.
I still have some fairly complex web projects that use grunt and this module is still great to help me organize them.
For more info on how to use npm as a build tool check:
A module that helps to break a gigantic Gruntfile
into smaller modules that are easy to manage and reason about.
It also provide some tasks, helpers and utilities for common tasks
This module aims to simplify the creation of workflows based on grunt, I know gulp is better :) or webpack or (insert better tool here
)
Since some of the projects I'm working right now are still using grunt, I wanted to have a better way to manage the build
workflows.
This module is inspired by this blog post supercharging your gruntfile
The main differences are:
grunt
object, the pkg
, package.json
parsed objectgrunt-deps/tasks
folder they will be loaded automatically.yaml
, so the aliases for tasks are defined in javascript. This is to keep it simple and avoid
leaving the javascript realm.Create the following folder structure
your-project
|--grunt-deps/
| |--configs/ # this will be directory where configs should live
| | |--task-name.js # should correspond to the name of the task and should return an object.
| | # The object will be set in the cfg as cfg[task-name].
| |
| |--tasks/ # place here custom tasks. These can be either multitasks or single tasks
| | |--custom-task.js # that for whatever reason are only needed in the current project
| |
| |--workflows/
| |--aliases.js # use this file to define the sequence of your tasks.
|
|--Gruntfile.js # the grunt
|--package.json # your package.json
This is all the code required for your grunt file, because all the configuration sections have been moved to the their own file.
module.exports = function ( grunt ) {
'use strict';
require( 'build-workflow' )( grunt );
};
One of the benefits of this, is that navigating to a given task is super simple. Since each file has the name
of the task, navigating to it, using sublime or other IDE is super simple. In Sublime Text
you only need to
type the name of the task to navigate directly to the file.
Create the following folder structure:
your-project
|--grunt-deps
| |--configs
| | |--babel.js // this will have your configuration for babel
| |--workflows
| |--aliases.js // this will have your alias definitions
|--Gruntfile.js
install build-workflow
as a dev dependency
npm i -D build-workflow
the content of your Gruntfile.js
module.exports = function ( grunt ) {
'use strict';
require( 'build-workflow' )( grunt );
};
the content of your aliases.js
module.exports = function ( grunt ) {
grunt.task.registerTask('default', ['babel']);
};
The content of your babel.js
file
module.exports = function ( grunt ) {
return {
'target': {
options: {
sourceMap: true
},
files: [{
src: 'src/**/*.js', // your files to transform
expand: true,
dest: 'dest/' // the destination to move the tanspiled code
}]
}
};
};
Now just run
grunt babel
If everythig went ok you should be able to see an output similar to this:
Read it here
FAQs
Simple gruntfile helper to define build workflows
We found that build-workflow demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
pnpm 10 blocks lifecycle scripts by default to improve security, addressing supply chain attack risks but sparking debate over compatibility and workflow changes.
Product
Socket now supports uv.lock files to ensure consistent, secure dependency resolution for Python projects and enhance supply chain security.
Research
Security News
Socket researchers have discovered multiple malicious npm packages targeting Solana private keys, abusing Gmail to exfiltrate the data and drain Solana wallets.