
Security News
vlt Launches "reproduce": A New Tool Challenging the Limits of Package Provenance
vlt's new "reproduce" tool verifies npm packages against their source code, outperforming traditional provenance adoption in the JavaScript ecosystem.
circle-github-bot
Advanced tools
This library helps you submit a comment on the PR from inside your CircleCI build and link to a static artifact from the build.
When reviewing a PR on github, it's useful to read the code but even more useful to test out the code on that branch in a live working web app.
See an example PR on this github repo https://github.com/themadcreator/circle-github-bot/pull/3
It works like so:
Create a demo.js
script using this library to post a comment on github
referencing the current PR.
Example:
#!/usr/bin/env node
const bot = require("circle-github-bot").create();
bot.comment(`
<h3>${bot.env.commitMessage}</h3>
Demo: <strong>${bot.artifactLink('demo/index.html', 'demo')}</strong>
`);
With that "shebang" at the top, you can chmod +x
your script file from the
command line to make it self-executable.
circle.yml
file to the root of your repodemo/
directory in the general.artifacts
listdeployment
that generates your preview and posts the commentgeneral:
artifacts:
- demo
deployment:
demo:
branch: /.*/
commands:
- ./demo.js
Make sure your script can actually post the comment to github
Optional, but helpful. This makes sure your builds actually pass before a PR can be submitted.
FAQs
CircleCI comments on github
We found that circle-github-bot demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
vlt's new "reproduce" tool verifies npm packages against their source code, outperforming traditional provenance adoption in the JavaScript ecosystem.
Research
Security News
Socket researchers uncovered a malicious PyPI package exploiting Deezer’s API to enable coordinated music piracy through API abuse and C2 server control.
Research
The Socket Research Team discovered a malicious npm package, '@ton-wallet/create', stealing cryptocurrency wallet keys from developers and users in the TON ecosystem.