Security News
GitHub Removes Malicious Pull Requests Targeting Open Source Repositories
GitHub removed 27 malicious pull requests attempting to inject harmful code across multiple open source repositories, in another round of low-effort attacks.
Projen is a tool that helps you manage and maintain project configuration files. It automates the creation and maintenance of project files like package.json, tsconfig.json, and more, ensuring consistency and reducing manual effort.
Project Initialization
This feature allows you to initialize a new Node.js project with predefined settings. The code sample demonstrates how to create a new Node.js project with Projen, specifying the project name, default release branch, and dependencies.
const { NodeProject } = require('projen');
const project = new NodeProject({
name: 'my-node-project',
defaultReleaseBranch: 'main',
deps: ['express'],
});
project.synth();
Automated Dependency Management
Projen can automatically manage your project's dependencies. The code sample shows how to set up a project with both runtime and development dependencies, which Projen will manage for you.
const { NodeProject } = require('projen');
const project = new NodeProject({
name: 'my-node-project',
deps: ['express'],
devDeps: ['jest'],
});
project.synth();
Customizable Project Configuration
Projen allows you to customize various aspects of your project configuration. The code sample demonstrates how to add custom scripts and Jest configuration to a Node.js project.
const { NodeProject } = require('projen');
const project = new NodeProject({
name: 'my-node-project',
scripts: {
start: 'node index.js',
},
jestOptions: {
jestConfig: {
testEnvironment: 'node',
},
},
});
project.synth();
Yeoman Generator is a scaffolding tool that helps you kickstart new projects by providing a generator ecosystem. Unlike Projen, which focuses on maintaining and managing project configurations, Yeoman is more about generating project structures and boilerplate code.
Create React App is a tool to set up a new React project with a single command. While it simplifies the initial setup of a React project, it doesn't offer the same level of ongoing project configuration management that Projen provides.
Nx is a set of extensible dev tools for monorepos, which helps you manage multiple projects within a single repository. While it offers some overlapping features with Projen, such as dependency management, Nx is more focused on monorepo management and optimization.
A new generation of project generators
projen synthesizes project configuration files such as package.json
, tsconfig.json
, .gitignore
, GitHub workflows, eslint, jest, etc from a well-typed definition.
Contrary to templating/scaffolding approaches, projen is not a one-off generator. Synthesized configuration is not expected to ever be maunally edited (in fact, projen enforces that). The source of truth is always .projenrc.js
.
Project types:
Features (contributions are welcome!):
To give you a sense of how it works, let's walk through a simple example.
Create a new local git directory:
$ mkdir my-project && cd my-project
$ git init
Create a file .projenrc.js
:
const { JsiiProject } = require('projen');
const project = new JsiiProject({
name: 'my-project',
authorName: 'Joe Schmo',
authorEmail: 'joe@schno.me',
repository: 'https://github.com/joe/schmo.git',
});
project.synth();
Run:
npx projen && yarn install
From now on, we will refer to this command as pj
(every time you modify .projenrc.js, just run pj
):
alias pj='npx projen && yarn install'
What just happened? This command synthesized a jsii project for you with the following features:
yarn compile
and yarn watch
: compile/watch jsii to jsyarn eslint
: run eslintyarn test
run eslint and jest tests with coverageyarn run package
: jsii-pacmak
yarn build
: compile
+ test
+ package
API.md
with reference docs after compilation (also yarn docgen
).yarn bump
bumps the module version and creates a CHANGELOG entry. yarn release
will bump and push with tags to master
.yarn projen
runs projen
followed by yarn install
(good for updating dependencies)master
and releases new versions to all package managers (default is only npm).gitignore
and .npmignore
are set up to commit only files that must exist in the repo (for example, by default package.json
is ignored)..mergify.yml
will auto-merge approved PRs that pass PR buildsLICENSE
defaults to Apache-2.0
API.md
and the GitHub workflows) have not been chaged out-of-band up-to-date.The JsiiProject
class has a rich API that can be used to configure these features (submit a PR if you are missing a degree of freedom).
Now, let's add a python target. Edit .projenrc.js
and add a python
section:
const { JsiiProject } = require('../../lib');
const project = new JsiiProject({
name: 'my-project',
authorName: 'Joe Schmo',
authorEmail: 'joe@schno.me',
repository: 'https://github.com/joe/schmo.git',
// add this:
python: {
distName: 'my-python-dist-name',
module: 'my_python_module'
}
});
project.synth();
And re-run:
pj
And this will be added:
jsii
section in your package.json
file will now have a python
entry.release.yml
github workflow will include a release job that will release your module to PyPI.Yes, you should commit those files. Although most files don't have to be
committed, there is value in being able to review any changes to these files
when you upgrade projen itself (yarn projen:upgrade
).
Since projen installs an "anti-tamper" check in your CI builds, if these files are manually modified, your CI build will fail.
See API Reference for more details.
Contributions of all kinds are welcome!
To check out a development environment:
$ git clone git@github.com:eladb/projen
$ cd projen
$ yarn boostrap # special boostrapping because projen uses itself
Distributed under the Apache-2.0 license.
FAQs
CDK for software projects
The npm package projen receives a total of 92,352 weekly downloads. As such, projen popularity was classified as popular.
We found that projen demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
GitHub removed 27 malicious pull requests attempting to inject harmful code across multiple open source repositories, in another round of low-effort attacks.
Security News
RubyGems.org has added a new "maintainer" role that allows for publishing new versions of gems. This new permission type is aimed at improving security for gem owners and the service overall.
Security News
Node.js will be enforcing stricter semver-major PR policies a month before major releases to enhance stability and ensure reliable release candidates.