Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
strapi-plugin-github-action-dispatch
Advanced tools
A strapi plugin to manually trigger github actions from admin panel
This plugin provides a web ui to trigger a Github workflow run from strapi's admin panel as well as a list of the latest run status and results.
yarn add strapi-plugin-github-action-dispatch
The plugin will run without options by default.
When doing so, the generated tarball name will be your package.json name field, and encryption will be disabled.
In your config/plugins.js
you can add:
{
"strapi-plugin-github-action-dispatch": {
enabled: true,
config: {
token: env("GITHUB_TOKEN"),
repository: 'my-username-or-org/my-repo-name',
workflow: "my-workflow.yml",
ref: "main" // optional, defaults to main
}
}
}
token
should be a GitHub PAT with permissions to list workflows and run them (Actions: RW)repository
is your typical ${owner}/${repo}
in one stringworkflow
is either the file name or the workflow id (as per Github API spec)You can go an enable/disable this plugin's actions in the roles section of the admin panel. This should enable/disable endpoints and stop displaying the section according to the permissions you provided.
A boilerplate file for your workflow should be this one:
name: 🚀
run-name: 🚀 (by ${{ inputs.email }})
on:
workflow_dispatch:
inputs:
email:
default: 'unknown@example.com' # used to mark ownership of the run from strapi
jobs:
build-and-deploy:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- run: echo "hello world"
As you can see in the screenshot at the top of this README, there's an Initiator
column which logs which user triggered the workflow run. In order to avoid creating a GitHub account for every Strapi user and ask them to create a PAT, there's an inputs.email
field provided in the workflow run to store the user's identity.
Sadly, due to a limitation in GitHub's APi, we cannot fetch a run's inputs so we have no choice but to leverage run-name
to insert the inputs.email
and later parse it in the APi response.
FAQs
A strapi plugin to manually trigger github actions from admin panel
We found that strapi-plugin-github-action-dispatch demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.