
Security News
vlt Launches "reproduce": A New Tool Challenging the Limits of Package Provenance
vlt's new "reproduce" tool verifies npm packages against their source code, outperforming traditional provenance adoption in the JavaScript ecosystem.
ngx-deploy-npm
Advanced tools
Table of contents:
Note: all the examples are focused on Angular, if you don't see an explicit command for an Nx workspace just change
ng
fornx
This quick start assumes that you already have an existing Angular or a Nx workspace with a publishable
package created and you already are logged in on npm using npm login
Add ngx-deploy-npm
to your project. It will configure all your publishable libraries present in the project
Angular🅰️ | Nx🐬 |
---|---|
ng add ngx-deploy-npm | nx generate ngx-deploy-npm:init |
Deploy your library to NPM with all default settings.
ng deploy your-library
Your library should be published on npm. So go and check npmjs.com/YOUR-PACKAGE
Independently of the CI/CD that you are using you must create an NPM token. To do so, you have two methods
npm token create
Set the env variable
NPM_TOKEN
Indicate how to find the token
run: echo '//registry.npmjs.org/:_authToken=${NPM_TOKEN}' > YOUR_REPO_DIRECTORY/.npmrc
YOUR_REPO_DIRECTORY
for the path of your project,
commonly is /home/circleci/repo
(Optional) check that you are logged
run: npm whoami
Deploy your package
Angular🅰️ | Nx🐬 |
---|---|
ng deploy your-library | nx deploy your-library |
ng/nx deploy YOUR_LIBRARY
.
If you want to make that script on JavaScript and put it on the package.json,
execute it using npm
not with yarn, there is an issue associated with thatEnjoy your just released package 🎉📦
The job full example is for an Angular project is
# .circleci/config.yml
jobs:
init-deploy:
executor: my-executor
steps:
- attach_workspace:
at: /home/circleci/repo/
# Set NPM token to be able to publish
- run: echo '//registry.npmjs.org/:_authToken=${NPM_TOKEN}' > /home/circleci/repo/.npmrc
- run: npm whoami
- run: npx ng deploy YOUR_PACKAGE
-c
ng deploy --configuration=production
– The configuration production
is being used to build your packageA named build target, as specified in the configurations
section of angular.json
.
Each named target is accompanied by a configuration of option defaults for that target.
Same as ng build --configuration=XXX
.
This command has no effect if the option --no-build
option is active.
false
(string)ng deploy
– Angular project is build in production mode before the deploymentng deploy --no-build
– Angular project is NOT buildSkip build process during deployment.
This can be used when you are sure that you haven't changed anything and want to deploy with the latest artifact.
This command causes the --configuration
setting to have no effect.
ng deploy --package-version 2.3.4
It's going to put that version on your package.json
and publish the library with that version on NPM.
latest
(string)ng deploy --tag alpha
– Your package will be available for download using that tag, npm install your-package@alpha
useful for RC versions, alpha, betas.Registers the published package with the given tag, such that npm install @
will install this version. By default, npm publish
updates and npm install
installs the latest
tag. See npm-dist-tag
for details about tags.
public
(string)ng deploy --access public
Tells the registry whether this package should be published as public or restricted. It only applies to scoped packages, which default to restricted. If you don’t have a paid account, you must publish with --access public to publish scoped packages.
ng deploy --otp TOKEN
If you have two-factor authentication enabled in auth-and-writes mode then you can provide a code from your authenticator with this.
false
(boolean)ng deploy --dry-run
For testing: Run through without making any changes. Execute with --dry-run and nothing will happen. A list of options will be printed
To avoid all these command-line cmd options, you can write down your
configuration in the angular.json
or workspace.json
file in the options
attribute
of your deploy project's architect.
Just change the kebab-case to lower camel case.
This is the notation of all options in lower camel case:
A list of all available options is also available here.
Example:
ng deploy your-library --tag alpha --access public --dry-run
becomes
"deploy": {
"builder": "ngx-deploy-npm:deploy",
"options": {
"tag": "alpha",
"access": "public",
"dryRun": "true"
}
}
And just run ng deploy YOUR-LIBRARY
😄.
ℹ️ You can always use the --dry-run option to verify if your configuration is right.
Those files must be in the root of the library. They are being copied by the builder at the moment of deployment.
If you have those files outside the project's root, you can create a symbolic link to solve that problem.
See symbolic links on git to know how to create them properly.
This deployer doesn't bump or generates a new version of the package, it just builds the package/library, take the package.json as it and publish it. You can use --package-version
option to change it.
For Nx workspace, only publishable libraries are going to be configured
We are looking forward to the following features:
ng add
Your feature that's not on the list yet?
We look forward to any help. PRs are welcome! 😃
We create a special document for you to give you through this path
Code released under the MIT license.
FAQs
Publish your libraries to NPM with just one command
The npm package ngx-deploy-npm receives a total of 13,347 weekly downloads. As such, ngx-deploy-npm popularity was classified as popular.
We found that ngx-deploy-npm demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
vlt's new "reproduce" tool verifies npm packages against their source code, outperforming traditional provenance adoption in the JavaScript ecosystem.
Research
Security News
Socket researchers uncovered a malicious PyPI package exploiting Deezer’s API to enable coordinated music piracy through API abuse and C2 server control.
Research
The Socket Research Team discovered a malicious npm package, '@ton-wallet/create', stealing cryptocurrency wallet keys from developers and users in the TON ecosystem.