Security News
New Python Packaging Proposal Aims to Solve Phantom Dependency Problem with SBOMs
PEP 770 proposes adding SBOM support to Python packages to improve transparency and catch hidden non-Python dependencies that security tools often miss.
node-core-utils
Advanced tools
CLI tools for Node.js Core collaborators.
git-node
: Custom Git commands for working with Node.js
core, e.g. landing Pull Requests.ncu-config
: Configure variables for node-core-utils
to use.ncu-team
: Listing members of a team, synchronizing
special blocks in files with the list of members.get-metadata
: Retrieving metadata for a Pull Request.
DEPRECATED: use git node metadata
instead.ncu-ci
: Parse the results of a Jenkins CI run and display a summary for all the failures.npm install -g node-core-utils
If you would prefer to build from the source, install and link:
git clone git@github.com:nodejs/node-core-utils.git
cd node-core-utils
npm install
npm link
Most of the tools need your GitHub credentials to work. You can either
If you prefer option 2, follow these instructions to create the token.
When creating the token, the following boxes need to be checked:
user:email
: Used by git-node
and get-metadata
to read the email of the
PR author in order to check if it matches the email of the commit author.read:org
: Used by ncu-team
to read the list of team members.You can also edit the permission of existing tokens later.
After the token is generated, create an rc file with the following content:
(~/.ncurc
or $XDG_CONFIG_HOME/ncurc
):
{
"username": "your_github_username",
"token": "token_that_you_created"
}
Note: you could use ncu-config
to configure these variables, but it's not
recommended to leave your tokens in your command line history.
The git-node
and ncu-ci
commands need to query the Node.js Jenkins API for
CI results, so you'll need to configure the Jenkins API token before using
these commands.
To obtain the Jenkins API token
https://ci.nodejs.org/user/<your-github-id>/configure
(replace
<your-github-id> with your own GitHub ID)ADD NEW TOKEN
button in the API Token
section.node-core-utils
) for this
token in the inbox that appears, and click GENERATE
.ncurc
file (~/.ncurc
or $XDG_CONFIG_HOME/ncurc
)
with jenkins_token
as key, like this{
"username": "your_github_username",
"token": "your_github_token",
"jenkins_token": "your_jenkins_token"
}
Put the following entries into ~/.gitignore_global
# node-core-utils configuration file
.ncurc
# node-core-utils working directory
.ncu
Mind that.ncu/land
could contain your access token since it contains the
serialized configurations.
If you ever accidentally commit your access token on GitHub, you can simply revoke that token and use a new one.
If you encounter an error that you cannot fix by yourself, please
NCU_VERBOSITY=debug
environment variable set and
open an issue at https://github.com/nodejs/node-core-utils/issues with
detailed logs.See CONTRIBUTING.md.
MIT. See LICENSE.
FAQs
Utilities for Node.js core collaborators
The npm package node-core-utils receives a total of 2,008 weekly downloads. As such, node-core-utils popularity was classified as popular.
We found that node-core-utils demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 7 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
PEP 770 proposes adding SBOM support to Python packages to improve transparency and catch hidden non-Python dependencies that security tools often miss.
Security News
Socket CEO Feross Aboukhadijeh discusses open source security challenges, including zero-day attacks and supply chain risks, on the Cyber Security Council podcast.
Security News
Research
Socket researchers uncover how threat actors weaponize Out-of-Band Application Security Testing (OAST) techniques across the npm, PyPI, and RubyGems ecosystems to exfiltrate sensitive data.