
Security News
GitHub Actions Supply Chain Attack Puts Thousands of Projects at Risk
A compromised GitHub Action exposed secrets in CI/CD logs, putting thousands of projects at risk and forcing developers to urgently secure their workflows.
git-pull-run
Advanced tools
Automatically run commands like npm install when fetching changes from git, but only if certain files have changed.
Git invokes the post-merge
hook after a git pull
was done a local repository. This package will then run git diff-tree
to get a list of changed files. Each changed file is being matched against the specified pattern and in case of a match, the specified command or script will be executed.
For more information, please refer to my post: Automatically Install NPM Dependencies on Git Pull
npm install --save-dev git-pull-run
This package should be executed as a post-merge
git hook.
> npx git-pull-run --help
Usage: git-pull-run [options]
Options:
-V --version output the version number
-p, --pattern <glob> pattern to match files (required)
-c, --command <command> execute shell command for each matched file
-s, --script <script> execute npm script for each matched file
-m, --message <message> print message to the console if matches were found
-d, --debug print additional debug information (default: false)
-o, --once run command only once if any files match the pattern (default: false)
-h, --help display help for command
--pattern <pattern>
: Required glob pattern to detect if certain files have changed on the remote repository when pulling changes. Each changed file (including path from root) is matched against this pattern.
--command <command>
: Command to execute on the shell for each changed file that matches the pattern
. The command is going to be executed inside the directory of the changed file.
cwd
option set as directory of the matched file.--script <script>
: NPM script to execute on the shell for each changed file that matches the pattern
. Same as option --command "npm run <script>"
. The script is going to be executed inside the directory of the changed file.--message <message>
: Message to print on the shell if any changed files matches the pattern
. The message is printed only once and not for each changed file.--once
: Run the command or script only once in the git root directory if any files match the pattern, instead of running it for each matched file.--debug
: Run in debug mode and print additional information about the changed files and commands and scripts that are being executed.npm install
when package-lock.json
changespost-merge
git hook with Husky:
#!/bin/sh
. "$(dirname "$0")/_/husky.sh"
# matches only the package-lock.json inside project directory
npx git-pull-run --pattern "package-lock.json" --command "npm install"
On Windows, white spaces in the command like npm install
must be escaped with backslashes, for example: npx git-pull-run --pattern "package-lock.json" --command "npm\ install"
npm install
in a multi-package monorepopost-merge
git hook with Husky:
#!/bin/sh
. "$(dirname "$0")/_/husky.sh"
# assumes monorepo structure with multiple packages in directory /packages
# matches any of these package-lock.json
npx git-pull-run --pattern "packages/*/package-lock.json" --command "npm install"
post-merge
git hook with Husky:
#!/bin/sh
. "$(dirname "$0")/_/husky.sh"
# matches only the package-lock.json inside project directory
npx git-pull-run --pattern "package-lock.json" --message "Some packages were changed. You may run npm install to update your dependencies..."
package.json
or package-lock.json
?The package.json
contains the semver versions of each package whereas the package-lock.json
contains the exactly installed version of each package. See But what the hell is package-lock.json? for more information.
npm install
or npm ci
?Discussion on: But what the hell is package-lock.json?:
npm install
does not ignorepackage.json
versions, nor does it ignore thepackage-lock.json
. What it does is verify that thepackage.json
andpackage-lock.json
correspond to each other. That is, if the semver versions described inpackage.json
fit with the locked versions inpackage-lock.json
,npm install
will use the latter completely, just likenpm ci
would.Now, if you change
package.json
such that the versions inpackage-lock.json
are no longer valid, yournpm install
will be treated as if you'd donenpm install some-pkg@x.y.z
, where x.y.z is the new version in thepackage.json
for some-package.
On Windows, white spaces in the command like npm install
must be escaped with backslashes, for example: npx git-pull-run --pattern "package-lock.json" --command "npm\ install"
Issue: Command failed with exit code 1: npm #1
The yarn.lock
file should be used as pattern option (instead of package-lock.json
) and the yarn install
should be used as command option (instead of npm install
). If you want to run scripts defined in the package.json
with yarn instead of npm, please use the command option with --command "yarn run <script>"
instead of --script "<script>"
.
FAQs
Run commands and scripts after git pull
We found that git-pull-run demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
A compromised GitHub Action exposed secrets in CI/CD logs, putting thousands of projects at risk and forcing developers to urgently secure their workflows.
Research
Security News
A malicious Maven package typosquatting a popular library is secretly stealing OAuth credentials on the 15th of each month, putting Java developers at risk.
Security News
Socket and Seal Security collaborate to fix a critical npm overrides bug, resolving a three-year security issue in the JavaScript ecosystem's most popular package manager.