
Security News
Axios Supply Chain Attack Reaches OpenAI macOS Signing Pipeline, Forces Certificate Rotation
OpenAI rotated macOS signing certificates after a malicious Axios package reached its CI pipeline in a broader software supply chain attack.
release-buddy
Advanced tools
Provide release buddy with a list of bower and/or maven code repositories along with a work directory, and it will pull the projects down, understand how the project dependency graph, and enable querying for commits across linked projects so not only can you ask "what changed in this project", you can ask "what changed in this project and it's dependent projects?".
Important note: release buddy assumes that all provided dependencies are dependent on the 'HEAD' (or SNAPSHOT) version of the repo (rather than a explicit versioning). That's usually ok, because updating and explicit version requires a commit to occur to the project.
var createBuddy = require('release-buddy');
var workDir = '/tmp';
var repos = [{
name: 'popcorn',
packageManager: 'bower',
repoUrl: 'git@github.com:signalfuse/popcorn.git'
},{
name: 'angular-popcorn',
packageManager: 'bower',
repoUrl: 'git@github.com:signalfuse/angular-popcorn.git'
},{
name: 'sf:caramel',
repoUrl: 'git@github.com:signalfuse/caramel.git'
}];
createBuddy(workDir, repos).then(function(buddy){
// fetch and update repos
buddy.update().then(function(){
buddy.diff('popcorn', 'two days ago', 'yesterday').then(function(commits){
commits.forEach(function(commit){
// commit.hash - the commit hash
// commit.authorName
// commit.authorEmail
// commit.time - the commit time
// commit.subject
// commit.details.filesChanged -- number of files changed for commit
// commit.details.insertions -- lines added by commit
// commit.details.deletions -- lines deleted by commit
// commit.project.name -- project name
// commit.project.repoUrl -- project url
// commit.project.dependencies -- projects depended upon by the project of this commit
});
});
})
});
// Create a buddy by giving it a working directory and a list of project repos.
// Repos should have a 'name' and 'repoUrl' property which will be used to git
// clone the repo in the working directory. An additional package manager
// property may be sent to disambiguate when multiple package manager files
// are present in a repository.
var buddyPromise = createBuddy(workDir, repos);
buddyPromise.then(function(buddy){
// Update repos
var updatePromise = buddy.update();
// Get a diff between an approxidate time period
var diffsPromise = buddy.diff(projectName, 'two days ago', 'yesterday');
// Get a diff between two commits
var diffsPromise = buddy.diff(projectName, 'fa8b9034ec71fefca83e9b115e07a7e0d71b8339', '4b9b41f9975502b98869d615832192cecdcc51dd');
// Get the tags for a project repo
var tags = buddy.tags(projectName);
// Get the project object
var project = buddy.get(projectName);
// Get local dependent project which would be searched during diff requests
var dependencies = buddy.localDependencies(projectName);
});
FAQs
Helps you track cross-project and cross-repo changes
We found that release-buddy demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
OpenAI rotated macOS signing certificates after a malicious Axios package reached its CI pipeline in a broader software supply chain attack.

Security News
Open source is under attack because of how much value it creates. It has been the foundation of every major software innovation for the last three decades. This is not the time to walk away from it.

Security News
Socket CEO Feross Aboukhadijeh breaks down how North Korea hijacked Axios and what it means for the future of software supply chain security.