
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
A mint on Gitment, the gitment is a comment system based on GitHub Issues.
<link rel="stylesheet" href="https://aimingoo.github.io/gitmint/style/default.css">
<script src="https://aimingoo.github.io/gitmint/dist/gitmint.browser.js"></script>
or via npm and build it:
> git clone https://github.com/aimingoo/gitmint
> cd gitmint
> npm install && npm run build
# dist files
> ls style/default.css
> ls dist/gitmint.browser.js
or via npm module only:
> npm install --save gitmint
## and in js:
## import Gitmint from 'gitmint'
Click here to register an OAuth application, and you will get a client ID and a client secret.
Make sure the callback URL is right. Generally it's the origin of your site, like https://YOURNAME.github.io, or https://your-site.
const gitment = new Gitmint({
id: 'Your page ID', // optional
owner: 'Your GitHub ID',
repo: 'The repo to store comments',
oauth: {
client_id: 'Your client ID',
client_secret: 'Your client secret',
// proxy_gateway: 'Your proxy service, either this or client_secret'
},
// ...
// For more available options, check out the documentation below
})
gitment.render('comments')
// or
// gitment.render(document.getElementById('comments'))
// or
// document.body.appendChild(gitment.render())
maybe, you need a automation tool.
no client_secret when create gitment instance, either proxy_gateway or client_secret. ex:
const gitment = new Gitmint({
...
oauth: {
client_id: 'Your client ID',
proxy_gateway: 'https://YOUR_PROXY'
},
...
proxy/gateway is a service, @see aimingoo/intersect
The option admin is string array, support a set of organization repository's adminstrarories. the string array ignore lower/uppercase, and anyone can initialize your post's comments. so them need have write/create-issues access of organization repository. ex:
const gitment = new Gitmint({
owner: 'GitHub ID of organization repository',
admin: ['user1', 'user2'],
...
translator module is included, use it in your theme. example in src/theme/default.js:
import { chinese as $ } from '../translator'
...
// translate 'Comment' from english to chinese
submitButton.innerText = $('Comment')
// OR, switch to language
import * as translator from '../translator'
var $ = translator.fromLanguageCode('zh-CN');
...
submitButton.innerText = $('Comment')
update the translator.js module to support more text and languages.
set language code in options:
const gitment = new Gitmint({
lang: 'zh-CN',
...
the language code format:
and support 'en-US', 'zh-CN' and 'zh-TW' now. Maybe you can do more for this feature. :)
set oauth option:
const gitment = new Gitmint({
...
oauth: {
redirect_protocol: 'https',
...
...
make sure it same to protocol of the callback URL in Github OAuth application's settings. by default, the protocol will get from current location href.
make a html block, gitmint will automatic update it:
<span class="post-comments-count gitment-comments-count" itemprop="commentsCount"></span>
@see https://github.com/imsun/gitment#methods
@see https://github.com/imsun/gitment#about-security, and https://github.com/imsun/gitment/pull/25#issuecomment-314352684
2017.10.26 v0.0.3-update.3 released, support organization repo, and defalt force redirect protocol updated.
2017.10.03 v0.0.3-update.2 released, hexo-theme-next friendly and more features.
2017.07.12 create gitmint, first release.
2017.05.30 fork and push some commits to Gitment.
FAQs
A mint on Gitment
We found that gitmint demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.