Research
Security News
Malicious PyPI Package ‘pycord-self’ Targets Discord Developers with Token Theft and Backdoor Exploit
Socket researchers uncover the risks of a malicious Python package targeting Discord developers.
ciena-devops
Advanced tools
A collection of scripts and configurations used by the Ciena organization in their DevOps
A collection of scripts and configurations used by the Ciena organization in their DevOps
After pr-bumper
has merged an outstanding PR and bumped the package version this script should then be ran to send a
message to the #frost-foundation
Slack channel.
The message will look like:
PATCHES will have a green color, MINOR blue, and MAJOR burgundy.
An error message may also be sent when an error is encountered:
A repository
property needs to added to the package.json file, such as:
"repository": {
"type": "git",
"url": "https://<url>/<organization>/<repo>.git"
},
An environment variable needs to be added to the TravisCI configuration at https://travis-ci.org as well as two additions need to be added to the .travis.yml file.
The environment variable that needs to be added to the respective package's configuration in TravisCI is
SLACK_INCOMING_WEBHOOK_URL
and needs to be set to the url of the incoming webhook integration for the
#frost-foundation
channel. To do this visit https://travis-ci.org/<organization>/<repo>/settings
. NOTE: When adding the SLACK_INCOMING_WEBHOOK_URL
variable, make sure to keep the "Display value in build log" set to "OFF"
otherwise the url will be written to the build logs for the public to see.
The additions to the .travis.yml file are to add the ciena-devops
package to the npm install
in the
before_install
configuration, such as:
before_install:
- npm install -g pr-bumper@^3.2.3 ciena-devops^1.0.0
The second addition is to add an after_deploy
configuration, such as:
after_deploy:
- $(npm root -g)/ciena-devops/scripts/slack/incoming-webhooks/send-message.sh
An environment variable needs to be added to the TeamCity project configuration named env.tc.slack.frost-foundation.incoming.webhook
whose value is set to the url of the incoming webhook integration for the #frost-foundation
channel.
The Setup CI Environment (inherited)
build step needs to be duplicated and modified, with the original build step being set to disabled. Name the new build step: Setup CI Environment (deviates from inherited by exporting SLACK_INCOMING_WEBHOOK_URL
The modification that needs to be made is to add
# Fill in SLACK_INCOMING_WEBHOOK_URL
export SLACK_INCOMING_WEBHOOK_URL="%env.tc.slack.frost-foundation.incoming.webhook%"
somewhere within the cat << EOF > ${ENV_DIR}/nenv
section, before the EOF
entry.
A new build step needs to be added to the TeamCity project configuration with the following information:
where the contents of the Custom script
are:
#!/bin/bash
NAME=frost-ci-image
IMAGE=$(docker images | grep ${NAME} | awk '{print$3}')
CONTAINER=$(docker ps -a | grep $IMAGE | awk '{print$1}')
# Fill in TEAMCITY_PULL_REQUEST
stripped_branch=$(echo "%teamcity.build.branch%" | sed -e "s/\/merge//")
re='^[0-9]+$'
if [[ $stripped_branch =~ $re ]]
then
export TEAMCITY_PULL_REQUEST="$stripped_branch"
else
export TEAMCITY_PULL_REQUEST="false"
fi
if [[ "$TEAMCITY_PULL_REQUEST" = "false" ]]
then
docker exec $CONTAINER nenv npm install -g ciena-devops@^1.0.0 || exit $?
docker exec $CONTAINER nenv /opt/node-envs/%env.node_version%/lib/node_modules/ciena-devops/scripts/slack/incoming-webhooks/send-message.sh || exit $?
fi
and set to run after the Slack Notification (1) (inherited)
step and before the Cleanup Container (inherited)
step.
This script contains several functions related to retrieving information about packages.
When developing new scripts you must change the permissions of them before committing, as per https://docs.travis-ci.com/user/customizing-the-build/#Implementing-Complex-Build-Steps
You may also find the https://www.shellcheck.net tool helpful when writing bash
scripts.
FAQs
A collection of scripts and configurations used by the Ciena organization in their DevOps
The npm package ciena-devops receives a total of 6 weekly downloads. As such, ciena-devops popularity was classified as not popular.
We found that ciena-devops demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket researchers uncover the risks of a malicious Python package targeting Discord developers.
Security News
The UK is proposing a bold ban on ransomware payments by public entities to disrupt cybercrime, protect critical services, and lead global cybersecurity efforts.
Security News
Snyk's use of malicious npm packages for research raises ethical concerns, highlighting risks in public deployment, data exfiltration, and unauthorized testing.