
Security News
Package Maintainers Call for Improvements to GitHub’s New npm Security Plan
Maintainers back GitHub’s npm security overhaul but raise concerns about CI/CD workflows, enterprise support, and token management.
patternfly-eng-publish
Advanced tools
A set of scripts for publishing PatternFly sites.
This script will publish files to the gh-pages branch of your repo.
publish-ghpages.sh [option] folder
Example: publish-ghpages.sh
OPTIONS:
h Display this message
t Perform a deploy from travis, using a travis encrypted key
w Remove non-web files from the SITE_FOLDER/components folder prior to publishing
b Remote branch this script will publish to
default: gh-pages
r Git repo this script will publish to
eg.: origin, upstream, bleathem, git@github.com:bleathem/bleathem.github.io.git
default: origin
npm install --save-dev patternfly-eng-publish
Add a run script to your package.json with appropriate options set:
"scripts": {
"publish": "publish-ghpages.sh public"
},
Use npm run publish
to publish the site.
Add another npm run script:
"scripts": {
"publish-travis": "publish-ghpages.sh -t public"
},
Update the .travis.yml file to invoke the script:
env:
global:
- ENCRYPTION_LABEL: "XXXXXXXXXXXX"
- COMMIT_AUTHOR_EMAIL: "patternfly-build@redhat.com"
- TRIGGER_REPO_SLUG: "patternfly/patternfly-atomic"
- TRIGGER_REPO_BRANCH: "master"
...
after_success:
- npm run publish-travis
We create a new key for every repo. Upload the public key to the repos via the github UI under Settings -> Deploy Keys.
ssh-keygen -t rsa -b 4096 -C "patternfly-build@redhat.com" -f deploy-key_patternfly-design
The private key gets encrypted and placed in the repo itself. gem isntall travis
to use the travis tool to encrypt it. Don't follow the instructions in the output of that command, but you do extract the encryption label from that message.
travis encrypt-file deploy_key
The publish-ghpages cript is written such that it will look for the file called "deploy_key.enc" and use the ENCRYPTION_LABEL env var to decrypt it. It then uses ssh-agent to load the key and use it for git pushes (over ssh).
There is no need to share the keys. We can re-create them more easily than we can manage sharing them.
FAQs
A collection of scripts for publishing PatternFly sites.
We found that patternfly-eng-publish demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Maintainers back GitHub’s npm security overhaul but raise concerns about CI/CD workflows, enterprise support, and token management.
Product
Socket Firewall is a free tool that blocks malicious packages at install time, giving developers proactive protection against rising supply chain attacks.
Research
Socket uncovers malicious Rust crates impersonating fast_log to steal Solana and Ethereum wallet keys from source code.