
Security News
Software Engineering Daily Podcast: Feross on AI, Open Source, and Supply Chain Risk
Socket CEO Feross Aboukhadijeh joins Software Engineering Daily to discuss modern software supply chain attacks and rising AI-driven security risks.
gh-helpers
Advanced tools
Various helper methods for Github Actions/API automation
npm install gh-actions
Within Github Actions, just
const github = require('gh-helpers')()
Outside example over API for repo at PrismarineJS/vec3, make sure to specify your PAT with perms to the repo
const github = require('gh-helpers')({
repo: { owner: 'PrismarineJS', name: 'vec3' }
}, GITHUB_PAT)
See src/index.d.ts
interface GithubHelper {
// Return a new GithubHelper instance to run methods against a different repo
using(opts: { owner?: string, repo: string }): GithubHelper
repoURL: string;
// Gets information about the currently authenticated user (who's PAT is in use)
getCurrentUser(): Promise<{
// Github username
login: string,
// Full name
name: string,
email: string,
avatar: string
}>
getRepoDetails(): Promise<{
owner: string,
repo: string,
fullName: string,
private: boolean,
description: string,
defaultBranch: string,
url: string
}>;
getDefaultBranch(): string;
// Read an option from Github Actions' workflow args
getInput(name: string, required?: boolean): string;
findIssues(options: IssuePRLookupOpts): Promise<IssuePRDetail[]>
findIssue(options: IssuePRLookupOpts): Promise<IssuePRDetail>
getIssue(id: number): Promise<IssuePRDetail>
updateIssue(id: number, payload: { body: string }): Promise<void>;
createIssue(payload: object): Promise<void>;
findPullRequests(options: IssuePRLookupOpts): Promise<IssuePRDetail[]>;
findPullRequest(options: IssuePRLookupOpts): Promise<IssuePRDetail>;
getComments(id: number): Promise<Comment[]>;
// Get full details about a PR by ID
getPullRequest(id: number, includeComments?: boolean): Promise<FullPRData>;
updatePull(id: number, payload: { title?: string; body?: string }): Promise<void>;
createPullRequest(title: string, body: string, fromBranch: string, intoBranch?: string): Promise<{ number: number, url: string }>;
createPullRequestReview(id: number, payload: {
commit_id?: string | undefined;
body?: string | undefined;
event?: "APPROVE" | "REQUEST_CHANGES" | "COMMENT" | undefined;
comments?: object[]
}): Promise<void>;
close(id: number, reason?: string): Promise<void>;
// Comment on an issue or PR
comment(id: number, body: string): Promise<{ type: 'issue', id: number, url: string }>;
// Comment on a commit hash
comment(id: string, body: string): Promise<{ type: 'commit', id: number, url: string }>;
// Update a comment on an issue or commit
updateComment(id: string, body: string, type?: 'issue' | 'commit'): Promise<void>
addCommentReaction(commentId: number, reaction: string): Promise<void>;
getRecentCommitsInRepo(max?: number): Promise<any[]>;
getDiffForPR(id: number): Promise<{ diff: string, title: string }>
getDiffForCommit(hash: string): Promise<{ diff: string, url: string }>
// Sends a workflow dispatch request to the specified owner/repo's $workflow.yml file, with the specified inputs
sendWorkflowDispatch(arg: { owner: string, repo: string, workflow: string, branch: string, inputs: Record<string, string> }): void
// Check if a repo exists under the specific repo ID (like `microsoft/typescript`). If no slash is included (like `typescript`), assumes the current org.
checkRepoExists(id: string): Promise<boolean>
checkRepoExists(id: [owner, repo]): Promise<boolean>
checkRepoExists(id: { owner, repo }): Promise<boolean>
// Events
onRepoComment(fn: (payload: RepoCommentPayload, rawPayload: any) => void): void;
onUpdatedPR(fn: (payload: UpdatedPRPayload) => void): void;
onWorkflowDispatch(fn: (payload: {
// The inputs that were passed to the workflow
inputs: Record<string, string>,
// The branch ref that the workflow was triggered on
ref: string,
// The repository that the workflow ran on (owner/repo)
repo: string,
// Who triggered the workflow
sender: string,
// Full path to workflow that was triggered
workflowId: string,
// Name of the workflow file that was triggered
workflowName: string
}) => void): void;
artifacts: ArtifactsAPI
}
interface ArtifactsAPI {
upload(name: number, files: string[], filesRoot: string, options: UploadArtifactOptions): Promise<{ id: number, size: number }>
deleteId(id: number): Promise
deleteIdFrom(owner: string, repo: string, id: number): Promise
downloadId(id: number, path: string): Promise
downloadIdFrom(owner: string, repo: string, id: string, path: string): Promise
list(): Promise<Artifact[]>
listFrom(): Promise<Artifact[]>
readTextArtifact(id: number): Promise<Record<string, Artifact>>
readTextArtifactFrom(owner: string, repo: string, id: number): Promise<Record<string, Artifact>>
createTextArtifact(name: string, fileContents: Record<string, string>, options?: UploadArtifactOptions): Promise<{ id: number, size: number }>
}
// If the module is instantiated within Github Actions, all the needed info
// is avaliable over environment variables
function loader(): GithubHelper
// If the module is instantiated outside Actions over API, you need to supply
// repo context + a Github personal access token (PAT)
function loader(context: { repo: { owner: string, name: string } }, githubToken?: string): GithubHelper
export = loader
FAQs
Various helper methods for Github Actions and API automation
The npm package gh-helpers receives a total of 923 weekly downloads. As such, gh-helpers popularity was classified as not popular.
We found that gh-helpers demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Socket CEO Feross Aboukhadijeh joins Software Engineering Daily to discuss modern software supply chain attacks and rising AI-driven security risks.

Security News
GitHub has revoked npm classic tokens for publishing; maintainers must migrate, but OpenJS warns OIDC trusted publishing still has risky gaps for critical projects.

Security News
Rust’s crates.io team is advancing an RFC to add a Security tab that surfaces RustSec vulnerability and unsoundness advisories directly on crate pages.