
Security News
GitHub to Block pull_request_target Workflows by Default Starting December 2
GitHub is tightening GitHub Actions security with new restrictions on privileged pull request workflows. Here's what changes and how maintainers are affected.
create-programmable-hook
Advanced tools
Scaffold Uniswap v4 hooks for Programmable Market, and check them against the live admission invariants before you submit
Scaffold Uniswap v4 hooks for Programmable Market, and check them against the platform's admission invariants before you submit.
npx create-programmable-hook my-hook
npx programmable-check ./my-hook/src/
A custom launch request is immutable. A rejected submission burns the attempt and you only find out afterwards. This catches the seven hard blocks locally first.
npx create-programmable-hook my-hook # buyback-hook
npx create-programmable-hook my-hook --template creator-fee-hook
npx create-programmable-hook --list
You get a contract pinned to 0.8.26 with PoolManager auth on every effectful callback
and permissions matched to implementations, plus foundry.toml, remappings.txt, a key
leak guard, a filled-in launch config, and an AGENTS.md your AI assistant reads
automatically. The scaffolder checks its own output before it finishes.
npx programmable-check ./src/ # exit 0 = nothing would hard-block
npx programmable-check ./src/ --json
npx programmable-check --show-profile # the pinned compiler, bits, and invariants
| Hard block | Condition |
|---|---|
| HC-001 | callcode in source |
| HC-002 | selfdestruct in source |
| HC-003 | Effectful callback with no PoolManager check |
| HC-004 | Hardcoded PoolManager address |
| HC-005 | Permissions and implementations disagree |
| HC-006 | Callback returns the wrong number of values |
| HC-007 | Reserved platform: action id |
Plus soft warnings for delegatecall, a non-pinned pragma, ownership/pause controls,
and mint functions — each a disclosure obligation, none of which fail the run.
Comments and strings are stripped before scanning, and revert-only stubs are recognised as stubs, so correct hooks don't get flagged.
import { checkPath, scaffold } from "create-programmable-hook";
const result = await checkPath("./src");
if (!result.ok) console.error(result.findings);
Every rule is grounded in the platform's live manifest, not inferred. Full docs: BUILD_GUIDE.md.
FAQs
Scaffold Uniswap v4 hooks for Programmable Market, and check them against the live admission invariants before you submit
The npm package create-programmable-hook receives a total of 0 weekly downloads. As such, create-programmable-hook popularity was classified as not popular.
We found that create-programmable-hook demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
GitHub is tightening GitHub Actions security with new restrictions on privileged pull request workflows. Here's what changes and how maintainers are affected.

Security News
/Application Security
A practical guide to securing GitHub Actions against supply chain attacks, covering malicious pull requests, credential theft, dependency risks, and release pipelines.

Security News
Composer 2.11 adds dependency cooldowns, joining package managers that delay new releases to reduce supply chain risks while allowing urgent security updates.