travis-github-status

travis-github-status

This package tacks on additional status "checks" with meaningful messages to your builds as displayed on Github (in PRs, commits, etc). That way developers can see all that went wrong (or right) with the build without leaving Github.

Use this as your primary means of running tests, linting and flow type checking. You will can list the services you want in your .travis.yml file as shown below.

Supported Tools:

• jest
• eslint
• flow
• snyk (vulernabilities reporting)
• codeclimate (test coverage)

note: all tools will get a chance to run even if an earlier one fails--that way you have as much information as available within github.

Installation

yarn add --dev travis-github-status

• 1 ) To allow 3rd party PRs to post post status checks to github, we have created a runkit endpoint you have to clone: https://runkit.com/faceyspacey/github-status-reporter-4-travis

• 2 ) Clone it, and connect with Github on the "environment variables" page: https://runkit.com/settings/environment

• 3 ) Then publish your runkit endpoint, and copy/paste its URL to your Travis repo's RUN_KIT_URL environment variable.

Usage

Simply pass as args the names of checks to run (do not trigger your npm test script another way):

language: node_js

node_js:
  - stable

cache: yarn

script:
  - node_modules/.bin/travis-github-status lint flow jest snyk codeclimate #omit tools you don't want statuses for

note: codeclimate uploads the coverage report to codeclimate.com, rather than reports a status

Notes

As for security, yes anyone can now create a status on a build by pinging your end point. But nothing more. If they clone it, the way Runkit works is the clone will use that person's environment variables. So if they edit the code, whatever they do will only affect their account.

So as for creating statuses on your builds, it's basically harmless and not going to happen. A sneaky individual would need to go get your commit shas, etc, and fake it. Then when they do, what happens? An extra message appears in a PR on github. Who cares. Likely never going to happen since it's so useless outside of its precise purpose. But if I've missed something security-related, please let me know.

Contributing

We use commitizen, so run npm run cm to make commits. A command-line form will appear, requiring you answer a few questions to automatically produce a nicely formatted commit. Releases, semantic version numbers, tags and changelogs will automatically be generated based on these commits thanks to semantic-release.

TO DO:

• Feel free to add more services such as Typescript, other test runners, etc.

Tests

Yea, it's pretty much self-testing. It runs itself in the CI server (Travis), and if it can't run itself, it's failing, but feel free to add some official unit tests.