
Security News
vlt Launches "reproduce": A New Tool Challenging the Limits of Package Provenance
vlt's new "reproduce" tool verifies npm packages against their source code, outperforming traditional provenance adoption in the JavaScript ecosystem.
deployment
Advanced tools
Continuous deployment for the masses. Download the latest version of your GitHub package, run tests and deploy to the specified directory. Run a deployment server to launch deployments from the internet, and integrate with GitHub easily. Includes an API t
Continuous Deployment for the masses.
Download the latest version of your git package, run all tests and deploy to the specified directory. Run a deployment server to launch deployments from the internet, and integrate with GitHub easily. Includes an API to fire deployments from an external source.
Install from npm:
$ npm install deployments
Or add to your package.json as a dependency.
For manual installation, download from GitHub:
$ git clone https://github.com/alexfernandez/deployment
Install node modules:
$ cd deployment
$ npm install
Et voilà!
There are three basic ways to start a deployment.
To start a deployment from the command line:
$ node lib/deployment.js
Will launch a deployment, using the current directory as deployment directory.
The temp directory will be called like current, but reside in ../test'. For instance, if your current directory is
/home/af/projects/x', the default
test directory will be `/home/af/projects/test/x'.
When your server can be reached from the internet, you can start a web server that will listen to requests, by default on port 3470.
$ node bin/deployment-server.js --token wydjzfoytrg4grmy
Any requests coming in with the special, magic token will result in a deployment. From localhost use this URL:
http://localhost:3470/wydjzfoytrg4grmy/deploy
You should see an OK message, or "Bad request" if an incorrect URL is sent.
If a token is not passed and therefore the default token is used, a warning will be shown. To generate a good, random token just write at your Bash console:
$ echo "$(head -c 16 /dev/random | base64 | tr '[A-Z]' '[a-z]' | sed 's/\/\+//g' | head -c 16)"
To access from the outside you can
http://localhost:3470/wydjzfoytrg4grmy/deploy
The resulting external URL can be added as a webhook to GitHub.
You can also start a deployment using the API.
The process is standardized as follows:
As console commands, the sequence would be: $ git pull /home/af/projects/test/x $ npm install /home/af/projects/test/x $ npm test /home/af/projects/test/x $ git pull /home/af/projects/x $ npm install /home/af/projects/x
You will note that we have not mentioned any restart as part of the deployment process. By default `deployment' does not deal with service restart, so how does the new code enter into service? There are several alternatives.
First, deployment' can be configured to run a specified command, passing it an option
deploymentCommand' from the API.
Second, the service could be run using `supervisor', which would restart the service automatically right after downloading the new code.
Another option is to run your services in cluster mode, rebooting each worker after a specified time. This scheme does not mesh well with database schema updates, or any other irreversible changes.
FAQs
Continuous deployment for the masses. Download the latest version of your GitHub package, run tests and deploy to the specified directory. Run a deployment server to launch deployments from the internet, and integrate with GitHub easily. Includes an API t
The npm package deployment receives a total of 14 weekly downloads. As such, deployment popularity was classified as not popular.
We found that deployment demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
vlt's new "reproduce" tool verifies npm packages against their source code, outperforming traditional provenance adoption in the JavaScript ecosystem.
Research
Security News
Socket researchers uncovered a malicious PyPI package exploiting Deezer’s API to enable coordinated music piracy through API abuse and C2 server control.
Research
The Socket Research Team discovered a malicious npm package, '@ton-wallet/create', stealing cryptocurrency wallet keys from developers and users in the TON ecosystem.