Security News
pnpm 10.0.0 Blocks Lifecycle Scripts by Default
pnpm 10 blocks lifecycle scripts by default to improve security, addressing supply chain attack risks but sparking debate over compatibility and workflow changes.
pushtodeploy
Advanced tools
pushtodeploy
is a package which allows you to automatically deploy your Node.js application into your production or CI environment.
Builds a source copy:
git pull
to get the latest changes on the server for the master
(or other) branch..pushtodeploy/<commit-hash>
.node_modules
directory from the latest deployed version. This results in faster builds, but can be turned off if required.Builds the project and runs unit tests:
npm install
to install the package. Add stuff to your npm script to take control.npm test
.Deploys the build using symlink
.pushtodeploy/current
symlink to point to .pushtodeploy/<commit-hash>
.npm start
. This is your npm script responsible for starting your server, for example. It should return a value, see below.Can receive webhook events and send email updates
Firstly, install the package:
`npm install pushtodeploy --save`
Then create a pushtodeploy.json
config file, which looks something like this (without the comments):
{
"gitpull": {
"enabled": true // true to git pull before build
},
"buildsrc": {
"copyFromCurrent": [ // array of files to copy from the current build
"node_modules"
],
"secrets": [ // array of secrets that should be symlinked
"../secrets.js"
]
},
"install": {},
"tests": {},
"switchbuild": {},
"start": {},
"cleanup": {
"maxVersions": 5
},
"email": {
"enabled": true, // true to send a success/failure email
"from": "from@example.com",
"to": "to@example.com",
"smtp": {
"host": "smtp.mandrillapp.com", // these options are passed to nodemailer.
"port": 587,
"auth": {
"user": "from@example.com",
"pass": "p@$$w0rd"
}
}
}
}
Now, add
"deploy": "pushtodeploy --config pushtodeploy.json"
to package.json
's scripts:
"scripts": {
"deploy": "pushtodeploy --config pushtodeploy.json"
}
You will also need to have a start
script. This shouldn't block (i.e. it shouldn't be node server.js
). It should do something like start a server, or migrate a database, and then return. I recommend using PM2 to start the app. This is an example:
result=${PWD} && echo \"PWD: $result\" && cd .. && (pm2 reload testapp || pm2 start \"$result/server.js\" -i 4 --name testapp) && pm2 save
This script will change directory (there is a problem with symlinks resolving when inside), reload the application with no downtime (if it is already running) or start it if this the first time. It will also save the configuration.
Clone your repo onto your production server. Run
npm run deploy
Perhaps you want to be automatically deploy whenever your remote is pushed to. This can be achieved using webhooks -- setting up a server which you can POST
to. Whenever the server receives an event, it will simply re-run npm deploy
.
Firstly, create a new script called deploy-listen
as follows:
"scripts": {
"deploy-listen": "(pm2 stop deploylisten; pm2 start \"node_modules/.bin/pushtodeploy-listen --port 3123\" --name deploylisten) && pm2 save"
}
You can run this using npm run deploy-listen
. Or, you can build your own server
and call npm deploy
according to some external stimulus.
FAQs
the simple way to deploy an app
The npm package pushtodeploy receives a total of 23 weekly downloads. As such, pushtodeploy popularity was classified as not popular.
We found that pushtodeploy demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
pnpm 10 blocks lifecycle scripts by default to improve security, addressing supply chain attack risks but sparking debate over compatibility and workflow changes.
Product
Socket now supports uv.lock files to ensure consistent, secure dependency resolution for Python projects and enhance supply chain security.
Research
Security News
Socket researchers have discovered multiple malicious npm packages targeting Solana private keys, abusing Gmail to exfiltrate the data and drain Solana wallets.