
Security News
MCP Community Begins Work on Official MCP Metaregistry
The MCP community is launching an official registry to standardize AI tool discovery and let agents dynamically find and install MCP servers.
git-pull-run
Advanced tools
Automatically run commands like npm install when fetching changes from git, but only if certain files have changed.
Git invokes the post-merge
after a git pull
was done a local repository. This package will then run git diff-tree
to get a list of changed files. Each changed file is being matched against the specified pattern and in case of a match, then specified command or script will be executed.
For more information, please refer to my post: Automatically Install NPM Dependencies on Git Pull
npm install --save-dev git-pull-run
This package should be executed as a post-merge
git hook.
> npx git-pull-run --help
Usage: git-pull-run [options]
Options:
-V --version output the version number
-p, --pattern <glob> pattern to match files (required)
-c, --command <command> execute shell command for each matched file (default: "")
-s, --script <script> execute npm script for each matched file (default: "")
-d, --debug print additional debug information (default: false)
-h, --help display help for command
--pattern <pattern>
: Required glob pattern to detect if certain files have changed on the remote repository when pulling changes. Each changed file (including path from root) is matched against this pattern.
--command <command>
: Command to execute on the shell for each changed file that matches the pattern
. The command is going to be executed inside the directory of the changed file.
cwd
option set as directory of the matched file.--script <script>
: NPM script to execute on the shell for each changed file that matches the pattern
. Same as option --command "npm run <script>"
. The script is going to be executed inside the directory of the changed file.--debug
: Run in debug mode and print additional information about the changed files and commands and scripts that are being executed.npm install
when package-lock.json
changespost-merge
git hook with Husky:
#!/bin/sh
. "$(dirname "$0")/_/husky.sh"
# matches only the package-lock.json inside project directory
npx git-pull-run -p 'package-lock.json' -c 'npm install'
npm install
in a multi-package monorepopost-merge
git hook with Husky:
#!/bin/sh
. "$(dirname "$0")/_/husky.sh"
# assumes monorepo structure with multiple packages in directory /packages
# matches any of these package-lock.json
npx git-pull-run -p 'packages/*/package-lock.json' -c 'npm install'
package.json
or package-lock.json
?The package.json
contains the semver versions of each package whereas the package-lock.json
contains the exactly installed version of each package. See But what the hell is package-lock.json? for more information.
npm install
or npm ci
?Discussion on: But what the hell is package-lock.json?:
npm install
does not ignorepackage.json
versions, nor does it ignore thepackage-lock.json
. What it does is verify that thepackage.json
andpackage-lock.json
correspond to each other. That is, if the semver versions described inpackage.json
fit with the locked versions inpackage-lock.json
,npm install
will use the latter completely, just likenpm ci
would.Now, if you change
package.json
such that the versions inpackage-lock.json
are no longer valid, yournpm install
will be treated as if you'd donenpm install some-pkg@x.y.z
, where x.y.z is the new version in thepackage.json
for some-package.
FAQs
Run commands and scripts after git pull
The npm package git-pull-run receives a total of 7,017 weekly downloads. As such, git-pull-run popularity was classified as popular.
We found that git-pull-run demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
The MCP community is launching an official registry to standardize AI tool discovery and let agents dynamically find and install MCP servers.
Research
Security News
Socket uncovers an npm Trojan stealing crypto wallets and BullX credentials via obfuscated code and Telegram exfiltration.
Research
Security News
Malicious npm packages posing as developer tools target macOS Cursor IDE users, stealing credentials and modifying files to gain persistent backdoor access.