Security News
New Python Packaging Proposal Aims to Solve Phantom Dependency Problem with SBOMs
PEP 770 proposes adding SBOM support to Python packages to improve transparency and catch hidden non-Python dependencies that security tools often miss.
ngx-deploy-npm
Advanced tools
Table of contents:
Add ngx-deploy-npm
to your project. It will configure all your publishable libraries present in the project:
npm install --save-dev ngx-deploy-npm
nx generate ngx-deploy-npm:install
Deploy your library to NPM with all default settings.
nx deploy your-library --dry-run
When you are happy with the result, remove the --dry-run
option
Independently of the CI/CD you are using, you need an NPM token. To do so, you have two methods.
npm token create
Set the env variable
NPM_TOKEN
Indicate how to find the token
run: echo '//registry.npmjs.org/:_authToken=${NPM_TOKEN}' > YOUR_REPO_DIRECTORY/.npmrc
YOUR_REPO_DIRECTORY
for the path of your project,
commonly is /home/circleci/repo
(Optional) check that you are logged
run: npm whoami
Deploy your package
Create a step with:
nx deploy your-library
Enjoy your just-released package 🎉📦
The complete job example is:
# .circleci/config.yml
jobs:
init-deploy:
executor: my-executor
steps:
- attach_workspace:
at: /home/circleci/repo/
# Set NPM token to be able to publish
- run: echo '//registry.npmjs.org/:_authToken=${NPM_TOKEN}' > /home/circleci/repo/.npmrc
- run: npm whoami
- run: npx nx deploy YOUR_PACKAGE
You can check the steps suggested in the CircleCI's guide
--dist-folder-path
nx generate ngx-deploy-npm:install --project=lib-1 --dist-folder-path="dist/libs/lib-1"
Indicates the dist folder path. The path where is located the bundle of your library. The path should be relative to the project's root.
--project
nx generate ngx-deploy-npm:install --project=lib-1 --dist-folder-path="dist/libs/lib-1"
– lib-1
will be configured. It will create the target deploy with the default options on the project lib-1
.Specify which library should be configured.
--access
public
nx generate ngx-deploy-npm:install --access=restricted --project=lib-1 --dist-folder-path="dist/libs/lib-1"
Tells the registry whether to publish the package as public or restricted. It only applies to scoped packages, which default to restricted. If you don't have a paid account, you must publish with --access public to publish scoped packages.
--dist-folder-path
nx deploy --dist-folder-path='dist/libs/my-project'
Indicate the dist folder path. The path must relative to project's root.
--check-existing
nx deploy --check-existing=warning
nx deploy --check-existing=error
Check if the package version already exists before publishing.
If it exists and --check-existing=warning
, it will skip the publishing and log a warning.
If it exists and --check-existing=error
, it will throw an error.
--package-version
nx deploy --package-version 2.3.4
It's going to put that version on your package.json
and publish the library with that version on NPM.
--tag
latest
(string)nx deploy --tag alpha
– Your package will be available for download using that tag, npm install your-package@alpha
useful for RC versions, alpha, betas.Registers the published package with the given tag, such that npm install @
will install this version. By default, npm publish
updates and npm install
installs the latest
tag. See npm-dist-tag
for details about tags.
--access
public
(string)nx deploy --access public
Tells the registry whether to publish the package as public or restricted. It only applies to scoped packages, which default to restricted. If you don't have a paid account, you must publish with --access public to publish scoped packages.
--otp
nx deploy --otp TOKEN
If you have two-factor authentication enabled in auth-and-writes mode, you can provide a code from your authenticator.
--registry
nx deploy --registry http://localhost:4873
Configure npm to use any compatible registry you like, and even run your own registry.
--dry-run
false
(boolean)nx deploy --dry-run
For testing: Run through without making any changes. Execute with --dry-run
, and nothing will happen. It will show a list of the options used on the console.
Version | Nx Workspace Version |
---|---|
v8.3.0 | ^20.0.0 || ^19.0.0 || ^18.0.0 || ^17.0.0 || ^16.0.0 |
v8.2.0 | ^19.0.0 || ^18.0.0 || ^17.0.0 || ^16.0.0 |
v8.1.0 | ^18.0.0 || ^17.0.0 || ^16.0.0 |
v8.0.0 | ^17.0.0 || ^16.0.0 |
v7.1.0 | ^17.0.0 || ^16.0.0 |
v7.0.1 | ^16.0.0 |
To avoid all these command-line cmd options, you can write down your
configuration in the workspace.json
file in the options
attribute
of your deploy project's executor.
Just change the option to lower camel case.
A list of all available options is also available here.
Example:
nx deploy your-library --tag alpha --access public --dry-run
becomes
"deploy": {
"executor": "ngx-deploy-npm:deploy",
"options": {
"tag": "alpha",
"access": "public",
"dryRun": true
}
}
Now you can just run nx deploy YOUR-LIBRARY
without all the options in the command line! 😄
ℹ️ You can always use the --dry-run option to verify if your configuration is correct.
This deployer doesn't bump or generate a new package version; here, we care about doing one thing well, publish your libs to NPM. You can change the version package at publishment using the --package-version
option.
We strongly recommend using @jscutlery/semver
to generate your package's version based on your commits automatically. When a new version is generated you can specify to publish it using ngx-deploy-npm
.
For more information go to semver's documentation
We use @jscutlery/semver
here on ngx-deploy-npm
to generate the package's next version, and we use ngx-deploy-npm
to publish that version to NPM. Yes, it uses itself, take a look by yourself ngx-deploy-npm/project.json
Only publishable libraries are going to be configured.
We create a unique document for you to give you through this path.
Code released under the MIT license.
FAQs
Publish your libraries to NPM with just one command
The npm package ngx-deploy-npm receives a total of 11,491 weekly downloads. As such, ngx-deploy-npm popularity was classified as popular.
We found that ngx-deploy-npm demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
PEP 770 proposes adding SBOM support to Python packages to improve transparency and catch hidden non-Python dependencies that security tools often miss.
Security News
Socket CEO Feross Aboukhadijeh discusses open source security challenges, including zero-day attacks and supply chain risks, on the Cyber Security Council podcast.
Security News
Research
Socket researchers uncover how threat actors weaponize Out-of-Band Application Security Testing (OAST) techniques across the npm, PyPI, and RubyGems ecosystems to exfiltrate sensitive data.