Security News
The Risks of Misguided Research in Supply Chain Security
Snyk's use of malicious npm packages for research raises ethical concerns, highlighting risks in public deployment, data exfiltration, and unauthorized testing.
corp-semantic-release
Advanced tools
Semantic-release package for repositories inside private networks (e.g. corporations) or for non-GitHub repositories.
Semantic-release for repositories that are inside private networks (e.g. corporations) or for non-GitHub repositories.
It has almost all expected features from semantic-release but will not publish to an NPM registry at the end.
Obviously this project is 100% inspired by semantic release. This module is not supposed to replace its parent. First try to use semantic-release. If you have special requirements under corporate network, then this module is made for you. Ironically this module uses semantic-release as I don't have any network restrictions at my home.
CHANGELOG.md
file.package.json
git add package.json CHANGELOG.md
pre-commit
script, if specifiedgit commit -m "chore(build): release v1.0.0"
git tag v1.0.0
git push
git push --tags
npm install corp-semantic-release --save-dev
This tool installs itself as a bin
. After installation, you have this command corp-semantic-release
available from anywhere.
Add this script to your package.json
"scripts": {
"corp-release": "corp-semantic-release [options here]"
}
Of course you can change corp-release
to any name you like.
--ci-skip [boolean]
: Skip Continuous Integration in CI environment. This adds [ci skip] ***NO_CI***
to the commit message. Default is true
.-d
or --dryrun
: it runs in non-destructive mode. No alteration should be done in your workspace.--pre-commit [npm-script]
: Pre-commit hook. Pass the name of the npm script to run. It will run like this: npm run [npm-script]
.--post-success [command]
: Post-success hook (after git push
completes successfully). Pass a command to run as the argument. Eg: --post-success "npm publish"
.-b [branch]
or --branch [branch]
: Branch name allowed to run release. Default is master
. If you want to release from another branch, you need to specify. Use "*" to allow any branch - Useful for Jenkins as git does a revision check-out.-v
or --verbose
: it prints extra info such as commit list from last tag and command details.--changelogpreset [preset]
: The conventional-changelog preset to use. Default is angular
. angular-bitbucket
is available for BitBucket repositories. Other presets can be installed, e.g: npm i conventional-changelog-jquery
then pass this flag to the command: --changelogpreset jquery
.-r [num]
or --releasecount [num]
: How many releases of changelog you want to generate. It counts from the upcoming release. Useful when you forgot to generate any previous changelog. Set to 0 to regenerate all (will overwrite any existing changelog!).--tagPrefix [tag name]
: Gives the tag version a prefix such as ALPHA 1.1.2.NOTE: If you run via npm
, you have to add --
before the options so npm passes all arguments to node. Eg.: npm run corp-release -- -v -d
A pretty common requirement when updating the version number is to update other files with the same version number. There are two ways you can run your own scripts to update additional files:
In the following example, updateOtherFiles.js
does NOT receive the version as an argument but must query package.json
to get the bumped version.
"scripts": {
"corp-release": "corp-semantic-release",
"version": "node updateOtherFiles.js"
}
"scripts": {
"corp-release": "corp-semantic-release --pre-commit updateFiles",
"updateFiles": "node updateOtherFiles.js"
}
Remember to stage the files using git add <file-name>
after modifying the files, so that when corp-semantic-release
commits the changes, all the changed files are commited.
Please refer to the Contributor Guidelines and Conduct of Code from AngularJs project.
This NPM module is for you! I was unable to pass the setup stage of semantic-release
inside a corporation network. That was one of the reasons why I created this package.
corp-semantic-release
?Run npm install corp-semantic-release
. There is no setup wizard like the semantic-release
package has. Simple!
Take a look at the file test/e2e.spec.js
. It has comprehensive system tests in order to make sure it works as expected.
semantic-release
?Yes. Importantly, corp-semantic-release
will not attempt to publish to an NPM registry.
Actions performed:
package.json
with the new version number.CHANGELOG.md
with the relevant log entries (from the commit history).semantic-release
?corp-semantic-release
, at the moment, generetes and appends changelog contents to a file called CHANGELOG.md.
I totally understand your frustrations and you are not the only one. Proxy settings is not the focus of this project
but I am happy to provide some help if I can. I use cntlm
as reverse proxy. I also turn off ssl on npm.
This is how I get things working. If you need further instructions on cntlm, send me a message.
This software is licensed under the MIT Licence. See LICENSE.
FAQs
Semantic-release package for repositories inside private networks (e.g. corporations) or for non-GitHub repositories.
The npm package corp-semantic-release receives a total of 85 weekly downloads. As such, corp-semantic-release popularity was classified as not popular.
We found that corp-semantic-release demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Snyk's use of malicious npm packages for research raises ethical concerns, highlighting risks in public deployment, data exfiltration, and unauthorized testing.
Research
Security News
Socket researchers found several malicious npm packages typosquatting Chalk and Chokidar, targeting Node.js developers with kill switches and data theft.
Security News
pnpm 10 blocks lifecycle scripts by default to improve security, addressing supply chain attack risks but sparking debate over compatibility and workflow changes.