Research
Security News
Malicious npm Package Targets Solana Developers and Hijacks Funds
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
probot-config
Advanced tools
A Probot extension to easily share configs between repositories.
Just put common configuration keys in a common repository within your organization. Then reference this repository from config files with the same name.
# octocat/probot-settings:.github/test.yaml
shared1: will be merged
shared2: will also be merged
# octocat/repo1:.github/test.yaml
_extends: probot-settings
other: AAA
# octocat/repo2:.github/test.yaml
_extends: probot-settings
shared2: overrides shared2
other: BBB
# octocat/repo3:.github/test.yaml
other: CCC # standalone, does not extend other configs
Configs are deeply-merged. Nested objects do not have to be redefined
completely. This is accomplished using deepmerge. When using probot-config in an app, you can pass options through to deepmerge
.
You can also reference configurations from other organizations:
_extends: other/probot-settings
other: DDD
Additionally, you can specify a specific path for the configuration by appending a colon after the project.
_extends: probot-settings:.github/other_test.yaml
other: FFF
Inherited configurations are in the exact same location within the repositories.
# octocat/repo1:.github/test.yaml
_extends: .github
other: GGG
# octocat/.github:test.yaml
other: HHH
Additionally, if there is no config file, but there is a repo in the org named
.github
, it will be used as a base repository.
# octocat/repo1:.github/test.yaml <-- missing!
# octocat/.github:.github/test.yaml
other: III
These recipes are specific to usage of the .github repo name, which is the
recommended place to store your configuration files. Within the .github repository,
your configuration must live in a .github/
folder.
You may want to create a configuration that other projects in your org inherit from on an explicit opt-in basis. Example:
# octocat/.github:.github/_test.yaml
shared1: Will be inherited by repo1 and not repo2
# octocat/repo1:.github/test.yaml
# Inherits from octocat/.github:_test.yaml
_extends: .github:_test.yaml
# octocat/repo3:.github/test.yaml <--missing!
# Is not merged with another config.
Alternatively, you may want to default to the config in your .github
project
and occasionally opt-out. Example:
# octocat/.github:.github/test.yaml
shared1: Will be inherited by repo1 and not repo2
# octocat/repo1:.github/test.yaml <-- missing!
# Uses octocat/.github:test.yaml instead
# octocat/repo3:.github/test.yaml <-- either empty or populated
# Will not inherit shared1, since no _extends field is specified
const getConfig = require('probot-config');
module.exports = robot => {
robot.on('push', async context => {
// Will look for 'test.yml' inside the '.github' folder
const config = await getConfig(context, 'test.yml');
});
};
# Install dependencies
npm install
# Run the bot
npm start
# Run test watchers
npm run test:watch
We use prettier for auto-formatting and eslint as linter. Both tools can automatically fix a lot of issues for you. To invoke them, simply run:
npm run fix
It is highly recommended to use VSCode and install the suggested extensions. They will configure your IDE to match the coding style, invoke auto formatters every time you save and run tests in the background for you. No need to run the watchers manually.
FAQs
A Probot extension that manages shared configs
The npm package probot-config receives a total of 779 weekly downloads. As such, probot-config popularity was classified as not popular.
We found that probot-config demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 15 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
Security News
Research
Socket researchers have discovered malicious npm packages targeting crypto developers, stealing credentials and wallet data using spyware delivered through typosquats of popular cryptographic libraries.
Security News
Socket's package search now displays weekly downloads for npm packages, helping developers quickly assess popularity and make more informed decisions.