
Security News
vlt Launches "reproduce": A New Tool Challenging the Limits of Package Provenance
vlt's new "reproduce" tool verifies npm packages against their source code, outperforming traditional provenance adoption in the JavaScript ecosystem.
This is a cli tool to sync local git repository and remote GitHub repository automatically.
For example, if your tech team and biz team share some codebase, tech team wants to manage it with git (and GitHub) but biz team wants to edit files directly via FTP, right?
You can resolve this problem with ghsync.
git add
, git commit
and git push
.git pull
.Additionally, if some auto-push and auto-pull conflict, ghsync stops observing soon and sends you a notification email. So you don't have to worry about that ghsync destroys your codebase.
This tool requires local git version 1.7.9.6 or later for using --no-edit
option for git pull
.
$ npm install -g ghsync
If you install with sudo --unsafe-perm
is required to generate config file after installation automatically.
$ sudo npm install -g ghsync --unsafe-perm
After installation you have now ~/.ghsync/config/default.json
of configuration file with initial content. Tailor this file.
$ vi ~/.ghsync/config/default.json
git commit
so that prevents creating many commits uselessly)After update ghsync via npm, unfortunately ~/.ghsync/config/default.json
is regenerated with initial content. But old configuration is backed up as ~/.ghsync/config/default.json.bak
so please copy the content like below unless the structure of json isn't changed.
$ cat ~/.ghsync/config/default.json.bak > ~/.ghsync/config/default.json
At first, configure webhook on GitHub.
And start ghsync server on your server.
$ ghsync run
That's it.
When local git repository are directly edited ghsync commits it with message "Automatically committed". And When remote GitHub repository is updated ghsync pulls it soon.
If some auto-push and auto-pull conflict, ghsync stops observing and sends you a notification email like below.
Subject: [ghsync] Error occurred in auto git-pull
[path]
/path/to/local/repo
[stdout]
Updating 40a9764..dc47ada
[stderr]
From github.com:owner/repo
* branch master -> FETCH_HEAD
40a9764..dc47ada master -> origin/master
error: Your local changes to the following files would be overwritten by merge:
some/changed/file
Please, commit your changes or stash them before you can merge.
Aborting
Then you should go to your server and resolve conflict by hand, and commit and push it.
After you push it, auto-pull runs because remote GitHub repository is updated just now by you, and this pull will get successful. Then, ghsync starts observing again automatically.
You may want to run ghsync on background. You can use Supervisor or something to do that. But especially for Node.js script it's one of the easiest way to use forever.
# install forever
$ npm install -g forever
# run ghsync via forever
$ forever start $(which ghsync) run
# confirm process is running
$ forever list
info: Forever processes running
data: uid command script forever pid id logfile uptime
data: [0] H7wO /usr/local/bin/node /usr/local/bin/ghsync run 59716 59726 /home/user/.forever/H7wO.log 0:0:0:2.636
You can stop daemon by like below.
$ forever stop 0
Please learn more at forever GitHub repository.
FAQs
Sync local git repository and remote GitHub repository automatically.
The npm package ghsync receives a total of 0 weekly downloads. As such, ghsync popularity was classified as not popular.
We found that ghsync demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
vlt's new "reproduce" tool verifies npm packages against their source code, outperforming traditional provenance adoption in the JavaScript ecosystem.
Research
Security News
Socket researchers uncovered a malicious PyPI package exploiting Deezer’s API to enable coordinated music piracy through API abuse and C2 server control.
Research
The Socket Research Team discovered a malicious npm package, '@ton-wallet/create', stealing cryptocurrency wallet keys from developers and users in the TON ecosystem.