
Research
PyPI Package Disguised as Instagram Growth Tool Harvests User Credentials
A deceptive PyPI package posing as an Instagram growth tool collects user credentials and sends them to third-party bot services.
run-shared-scripts
Advanced tools
Define and run shared scripts of a monorepo using Yarn workspaces, Bolt, Lerna or pnpm
run-shared-scripts
Define and run shared scripts of a monorepo using Yarn workspaces, Bolt, Lerna or pnpm
$ npm install --save-dev run-shared-scripts
Using npm-scripts is a convenient way to run our CI/CD tasks, and we may have some similar "scripts"
in a monorepo workspaces. Take the following monorepo for example.
.
āāā lerna.json
āāā package.json
āāā packages
āāā project-a
ā āāā index.js
ā āāā node_modules
ā āāā package.json
āāā project-b
ā āāā index.js
ā āāā node_module
ā āāā package.json
...
The "scripts"
defined in ./packages/project-a/package.json
and ./packages/project-b/package.json
is similar.
"scripts": {
"clean:build": "rimraf dist lib es",
"clean:coverage": "rimraf ./test/coverage",
"clean": "run-p clean:build clean:coverage",
"build:esm": "tsc --module esnext --target es2015 --outDir ./es",
"build:cjs": "tsc --module commonjs --target es5 --outDir ./lib",
"build:umd": "rollup -c",
"build:style": "../../scripts/build-style.js",
"build": "run-p build:style build:cjs build:esm build:umd",
"prebuild": "run-s lint clean",
"test": "jest",
"coveralls": "cat ./test/coverage/lcov.info | coveralls",
"pretest": "run-p clean:coverage",
"prepare": "yarn build"
}
Then we can use run-shared-scripts
to define and run these similar "scripts"
.
rss
config in the monorepo root's ./package.json
file. "rss": {
"clean:build": "rimraf dist lib es",
"clean:coverage": "rimraf ./test/coverage",
"clean": "run-p clean:build clean:coverage",
"build:esm": "tsc --module esnext --target es2015 --outDir ./es",
"build:cjs": "tsc --module commonjs --target es5 --outDir ./lib",
"build:umd": "rollup -c",
"build:style": {
"file": "./scripts/build-style.js" // path relative to monorepo's root directory
},
"build": "run-p build:style build:cjs build:esm build:umd",
"prebuild": "run-s lint clean",
"test": "jest",
"coveralls": "cat ./test/coverage/lcov.info | coveralls",
"pretest": "run-p clean:coverage",
"prepare": "yarn build"
}
Note that the "build:style"
command define the task to run an executable file. The executable file path must be an absolute path or a path relative the monorepo's root directory.
rss
command in ./packages/project-a/package.json
and ./packages/project-b/package.json
. "scripts": {
"clean:build": "rss",
"clean:coverage": "rss",
"clean": "rss",
"build:esm": "rss",
"build:cjs": "rss",
"build:umd": "rss",
"build:style": "rss",
"build": "rss",
"prebuild": "rss",
"test": "rss",
"coveralls": "rss",
"pretest": "rss",
"prepare": "rss"
}
The rss
command run the same named(the key of "scripts"
) task by default. We can pass a task name to specify the task to run.
"scripts": {
"clean": "rss clean:build" // run "clean:build" task defined in the "rss" config
}
Arguments before --
separator are rss
command args.
"scripts": {
"test": "rss --dry-run" // dry-run model
}
Arguments after --
separator will pass to task.
"scripts": {
"test": "rss -- --watch" // => "jest --watch"
}
We can use placeholders to define the "rss"
scripts.
{1}
, {2}
, ... -- An argument. {1}
is the 1st argument. {2}
is the 2nd.{@}
-- All arguments.{*}
-- All arguments as combined.{n=defaultValue}
-- An argument with default value. n
is the n-th argument. "rss": {
"s1": "server --port {1}",
"s2": "server -a {1} --port {2}",
"s3": "server {@}",
"s4": "server {*}",
"s5": "server --port {1=8080}",
"s6": "server --port1 {1=8080} --port2 {1}",
"s7": "server -a {1=0.0.0.0} --port {2=8080}"
}
Then pass your args in the "scripts"
.
"scripts": {
"s1": "rss -- 8080", // => "server --port 8080"
"s2": "rss -- 0.0.0.0 8080", // => "server -a 0.0.0.0 --port 8080"
"s3": "rss -- -a 0.0.0.0 --port 8080", // => "server -a 0.0.0.0 --port 8080"
"s4": "rss -- -a 0.0.0.0 --port 8080", // => "server '-a 0.0.0.0 --port 8080'"
"s5-1": "rss s5", // => "server --port 8080"
"s5-2": "rss s5 -- 9090", // => "server --port 9090"
"s6-1": "rss s6", // => "server --port1 8080 --port2 8080"
"s6-1": "rss s6 -- 9090", // => "server --port1 9090 --port2 9090"
"s7-1": "rss s7", // => "server -a 0.0.0.0 --port 8080"
"s7-2": "rss s7 -- '' 9090", // => "server -a 0.0.0.0 --port 9090"
"s7-3": "rss s7 -- 127.0.0.1 9090", // => "server -a 127.0.0.1 --port 9090"
}
Please let us know how can we help. Do check out issues for bug reports or suggestions first.
To become a contributor, please follow our contributing guide.
The scripts and documentation in this project are released under the MIT License
FAQs
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
A deceptive PyPI package posing as an Instagram growth tool collects user credentials and sends them to third-party bot services.
Product
Socket now supports pylock.toml, enabling secure, reproducible Python builds with advanced scanning and full alignment with PEP 751's new standard.
Security News
Research
Socket uncovered two npm packages that register hidden HTTP endpoints to delete all files on command.