
Security News
PodRocket Podcast: Inside the Recent npm Supply Chain Attacks
Socket CEO Feross Aboukhadijeh discusses the recent npm supply chain attacks on PodRocket, covering novel attack vectors and how developers can protect themselves.
patternfly-eng-release
Advanced tools
A set of release engineering scripts for PatternFly, PatternFly NG, Angular PatternFly, PatternFly Org, and RCUE.
A set of release engineering scripts for PatternFly, Angular PatternFly, PatternFly Org, and RCUE
For normal builds, Travis runs the build/_build.sh script. This script determines if we're building a pull request, simple tag, merge, or release. If a commit is tagged for release, the build/release/_build.sh script takes over. Otherwise, the scripts run npm/bower install, build, npm test, nsp shrinkwrap audit, etc. If the build is ssuccessful, generated build files are pushed to master-dist if applicable -- tags and pull requests are not pushed to master-dist.
At periodic intervals PatternFly, and all repos which utilize PF, must be versioned. Below is a summary of all the steps involved. For more information on each repo, please see PatternFly Documentation.
Where applicable to each repo, the scripts may clone a new GitHub repo, bump the npm/bower version and website home page version numbers. The scripts will also clean the npm/bower cache, run npm install, bower install, grunt build, grunt ngdocs:publish, npm shrinkwrap, npm publish, npm test, nsp shrinkwrap audit, and will verify npm/bower installs.
The automated release build begins with the build/release/release-all.sh script. This script will push a custom release tag to the repo's master branch, which triggers Travis to run the build/release/build.sh script. Version bump changes are pushed back to the master branch. The version bump and generated build changes are pushed to master-dist and tagged (e.g., v3.15.0).
Release builds are chained together by pushing a new custom release tag to the next repo. For example, if the PatternFly RE release is successful, PatternFly is built next. If the PatternFly release is successful, RCUE and Angular PatternFly are built simultaneously. If Angular is successful, PatternFly Org is released as well.
Should a release build fail at any point, it can be fixed and restarted. For example, If Angular PatternFly fails, it can be restarted and the PatternFly Org release will follow. We don't necessarily need to bump the npm version number again or rebuild Patternfy. The npm publish is one of the last steps in the build.
Of course, we still have the ability to run the release manually using the build/release/release.sh script. In fact, the release build uses this script itself.
This script is used to automate and chain releases together. For example, when the PatternFly RE release is complete, PatternFly is built next. When the PatternFly release is complete, the release processes for Angular PatternFly and RCUE are kicked off simultaneously. When the Angular PatternFly release is complete, PatternFly Org shall be released as well.
Although there is no PR to deal with here, creating release notes is still a task which must be performed manually via GitHub.
Builds can only be stopped via the Travis CI.
This script will send community email to the PatternFly and Angular PatternFly mailling lists.
After publishing a release notes via GitHub, this script will pull markup using GitHub APIs. The release note markup is then added to the body of the outgoing message.
It is expected that the following environment variables are set via Travis CI.
For PF 'next' releases (e.g., PF4 aplha, beta, etc.), the following variables may be overridden.
Note: Environment variables must be committed for the automated release, but may be overridden locally for manual releases.
When testing, run the scripts first from a forked repo to avoid accidentally merging and publishing releases.
whoami
command to view your username.whoami
/patternfly.git).If your local user name is not a match, set the following environment variables locally.
owner_name
/repo_name
.git)Alternatively, the following variables may be overridden to test forked repos and skip npm and webjar publish.
owner_name
/patternflyowner_name
/angular-patternflyowner_name
/patternfly-orgowner_name
/patternfly-eng-releaseowner_name
/rcueNote: Testing from a fork may require both master and master-dist branches to simulate npm and bower installs.
When verifying changes, please ensure:
Although many release steps have been automated here, this is more of a manual release process. Releases are not chained together, so creating a PR, release notes, and community email are still tasks which must be performed manually.
These scripts are useful when debugging build issues or publishing individual releases.
Note: The release-all.sh script will run these scripts automatically.
This script will bump version numbers, build, shrinkwrap, test, install, push to GitHub, and publish to npm. These changes are committed to a branch that must be merged via a PR on GitHub.
This script will npm publish from the latest repo clone or Travis build.
FAQs
A set of release engineering scripts for PatternFly, PatternFly NG, Angular PatternFly, PatternFly Org, and RCUE.
The npm package patternfly-eng-release receives a total of 59 weekly downloads. As such, patternfly-eng-release popularity was classified as not popular.
We found that patternfly-eng-release demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 9 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Socket CEO Feross Aboukhadijeh discusses the recent npm supply chain attacks on PodRocket, covering novel attack vectors and how developers can protect themselves.
Security News
Maintainers back GitHub’s npm security overhaul but raise concerns about CI/CD workflows, enterprise support, and token management.
Product
Socket Firewall is a free tool that blocks malicious packages at install time, giving developers proactive protection against rising supply chain attacks.