Research
Security News
Quasar RAT Disguised as an npm Package for Detecting Vulnerabilities in Ethereum Smart Contracts
Socket researchers uncover a malicious npm package posing as a tool for detecting vulnerabilities in Etherium smart contracts.
Deployment (CI) from Bitbucket or Github (and other) to your server. Simple.
.js
file like gulpfile -> it is 100% programmable!npm install -g bulldozer
Create a configuration file bulldozer.js
in the project (repository) root. You have to put this file manually on your server. It's a good idea to keep it in the project repository. Since it is a javascript file, you can easily require
and use stuff from your project. You can use 3rd party libraries. The world is your oyster.
// this is an example configuration file
// place it into the root of your project
// it is used by both sides - server and client
var config = {
// main server address
url: 'https://example.org',
// bulldozer deployment server port (must be different than your app port!)
port: 8000,
// secures communication between bulldozer's client & server
// WARNING: you must use HTTPS to keep this token secure!
secret: 'YOUR_SECRET',
// bitbucket or github
gitUrl: 'github',
// git repository name
name: 'steida/este',
// branch that will be tagged by 'bulldozer tag' (master is default)
branch: 'master',
// in case the repository is private
// HTTPS authentication is used
auth: {
username: 'USERNAME',
password: 'PASSWORD'
},
// pre-deployment hook
// put here everything that should be ran before the
// replacement of source code from Git repository
preDeploy: function(utils) {
// utils.getLogger() gives you Winston utility
utils.getLogger().info('Pre-deploy started.');
// good place to run some integration tests
// if false, the deployment is stopped
// if true, the deployment continues
return true;
},
// post deployment hook
// put here everything that should be ran with a new source code
postDeploy: function(utils) {
utils.getLogger().info('Post-deploy started.');
// it runs exec(), logs stdout/stderr and returns promise
utils.run('npm install')
.then(function() {
utils.getLogger().info('Deploy finished.');
utils.getLogger().info('Starting production server.');
return utils.run('PORT=80 NODE_ENV=production forever stop src/server');
})
// if there was no server running, forever stop fails, so I'm catching it here...
.fail(function() {return utils.getLogger().info('There was no running instance of production server.'); })
// start application
.then(function() {return utils.run('PORT=80 NODE_ENV=production forever start src/server'); })
.then(function() {
utils.getLogger().info('Production server started.');
// this is a good place to do something with the output log
// e.g. you can send it as an email through service like Mailgun or save it as a file
utils.getLoggerOutput(); // << THIS RETURNS THE OUTPUT LOG AS A STRING
// resets the output log, so the next deployment log starts clean
utils.resetLoggerOutput();
});
},
// on error hook
// this is a good place to do something with the output log
// e.g. you can send it as an email through service like Mailgun or save it as a file
onError: function(utils) {
utils.getLoggerOutput(); // << THIS RETURNS THE OUTPUT LOG AS A STRING
utils.resetLoggerOutput();
}
};
module.exports = config;
I really recommend to install and use forever to run your app (it's used in the example).
npm install -g forever
bulldozer start
This way you can see the real-time output. Or run it on a background.
nohup bulldozer start &
The deployment server is started. There is a simple GET API deploy/:tag?secret=YOUR_SECRET
. When you call it (with a proper tag and secret) the deployment starts.
To make your life easier there are some another built-in commands. These commands must be ran from the project (repository) root. It expects the same bulldozer.js
configuration that is used on the server.
npm install -g bulldozer
Yes, everything is in the same module.
bulldozer tag
This creates a tag rYYYYMMDDHHmmss
for the latest commit and branch that you set in the configuration file (master
is default).
bulldozer deploy
This finds the latest deploy tag (rYYYYMMDDHHmmss
) and calls the deployment server /deploy
API. It uses the secret from the configuration file.
bulldozer deploy :tag
You can specify the tag. It can be any tag, not just a release tag (rYYYYMMDDHHmmss
).
Don't forget to git push --tags
between bulldozer tag
and bulldozer deploy
.
It's quite simple and naive right now.
preDeploy()
hook..zip
archive for every tagpostDeploy()
hook.onError()
hook.It's up to you to save logs. It's up to you to call npm install
. It's up to you to send an email with results...
There are three important hooks (callback) that you can use through the configuration file. preDeploy(utils)
, postDeploy(utils)
and onError(utils)
. When are they called? Check the Deployment process
section above.
They all accept and get utils
argument. That's a set of helper functions coming from the bulldozer.
This returns the instance of Winston (logger utility) which is used by bulldozer. Have fun with it! It's particularly useful for logging, duh.
utils.getLogger().info('some message')
utils.getLogger().error('error message')
This calls onError()
hook.
Returns all Winston messages as a string. Great for emailing.
Resets the previous string. You should do it at the end of every deployment.
This calls the command as a child process and returns a promise. It uses child-process-promise. The bulldozer is automatically logging stdout
and stderr
for you. This is a nice way how you can chain more commands (aka asynchronous child processes). See the example bulldozer.js
.
postDeploy()
and that's bad because it can modify the running app; on the other hand, it makes npm install
really fastpostDeploy()
should not have access to the root directory, but it should also use the temporary dir. There will be probably a new hook postMove()
that can be used for a server start.Please, create issues and pull requests.
git clone https://github.com/tajo/bulldozer
cd bulldozer
npm install
npm run compile
npm link bulldozer
npm install -g bulldozer
gulp eslint
before every commit to preserve the coding style. Do you know there is a nice real-time checking integration for your editor? ;-)FAQs
Deployment/CI from Bitbucket/Github to your server.
We found that bulldozer demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket researchers uncover a malicious npm package posing as a tool for detecting vulnerabilities in Etherium smart contracts.
Security News
Research
A supply chain attack on Rspack's npm packages injected cryptomining malware, potentially impacting thousands of developers.
Research
Security News
Socket researchers discovered a malware campaign on npm delivering the Skuld infostealer via typosquatted packages, exposing sensitive data.