Security News
PyPI Introduces Digital Attestations to Strengthen Python Package Security
PyPI now supports digital attestations, enhancing security and trust by allowing package maintainers to verify the authenticity of Python packages.
Githooks are powerful tools. Whatever you can script can be triggered from nothing but a git command. PandaHook helps you manage this magic.
PandaHook is designed to not only assist you in generating githook scripts, but also setting them up in a remote server. PandaHook is meant to be your Swiss Army knife, so it features a modular design with multiple sub-commands to keep the codebase manageable and future-friendly.
PandaHook is easily installed as a global npm package. You will need CoffeeScript installed.
npm install -g coffee-script
npm install -g pandahook
To see how PandaHook is used, you'll need a couple things:
.pandahook.cson
, completed for your use-case and placed into your local $HOME
directory (ie, at ~/.pandahook.cson
). See below for more details.You can see a Hello World example of PandaHook usage in this repository.
Reusable configuration data is stored in the dotfile .pandahook.cson
. This keeps you from having to re-type the same data repeatedly into commands. Here is its layout:
# Required Hook-Server Stanza
hookServer:
address: "user@myHookServer.com" # This is an SSH connection, not HTTPS
# Optional Stanzas for Target Services. We will focus on CoreOS here.
coreos:
address: "myCoreOSCluster.com" # This is an SSH connection, not HTTPS
The build sub-command encapsulates script generation functionality and is the most sophisticated. The goal is to abstract some the more common actions you would perform with a githook, and then separate out unique command dependencies into modules with their own code and documentation.
At the moment, we're just starting with the CoreOS dependency fleetctl and a script that produces "restart" githooks that facilitate continuous integration.
FAQs
Githook Script Management Made Easy
The npm package pandahook receives a total of 1 weekly downloads. As such, pandahook popularity was classified as not popular.
We found that pandahook demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
PyPI now supports digital attestations, enhancing security and trust by allowing package maintainers to verify the authenticity of Python packages.
Security News
GitHub removed 27 malicious pull requests attempting to inject harmful code across multiple open source repositories, in another round of low-effort attacks.
Security News
RubyGems.org has added a new "maintainer" role that allows for publishing new versions of gems. This new permission type is aimed at improving security for gem owners and the service overall.