Security News
Weekly Downloads Now Available in npm Package Search Results
Socket's package search now displays weekly downloads for npm packages, helping developers quickly assess popularity and make more informed decisions.
NPM auto publisher tool for Travis CI + Git tags commiting new package version
Versiona is an utility for Github NPM projects using Travis CI to automatize:
For example, with versiona activated in your project:
Releasing to NPM this way, your collaborators will be aimed to:
versiona can be launched from any command line environment, but will require to have these environment variables available:
When used in Travis CI, just add these tokens in the Settings of your repo with the secured option to avoid showing the tokens content in the Travis logs
Install versiona:
npm i versiona --save-dev
Create a versiona.js script into your project's root (can be ignored in .npmignore):
const versiona = require('versiona')
versiona({
repoOrg: 'your_repo_org_or_username',
repoName: 'your_repo_name'
})
the versiona function will stop the process with a code != 0 if something goes wrong. Otherwise, it will return:
- true if the publish and commit are done
- false if it has not run (p.ex. when the release tag is not matching the semver format)
versiona accepted parameters:
Example simple usage from a project using versiona:
const versiona = require('versiona')
versiona({
repoOrg: 'alextremp',
repoName: 'brusc'
})
Example usage as an intermediate step from a project using versiona:
const versiona = require('versiona')
const shell = require('shelljs')
versiona({
repoOrg: 'someorg',
repoName: 'somerepo',
publish: 'npm run s3deploy'
})
Add a new script task into your package.json:
"scripts": {
"versiona": "node versiona.js"
}
Call the versiona task from Travis editing your .travis.yml:
dist: trusty
language: node_js
node_js:
- "8"
cache:
directories:
- node_modules
before_install:
- npm config set //registry.npmjs.org/:_authToken=$NPM_TOKEN
script:
- npm run check && TRAVIS_TAG=$TRAVIS_TAG GH_TOKEN=$GH_TOKEN npm run versiona
In this sample:
before_install:
- npm config set //registry.npmjs.org/:_authToken=$NPM_TOKEN
npm run check
TRAVIS_TAG=$TRAVIS_TAG GH_TOKEN=$GH_TOKEN npm run versiona
This library only uses the tokens, does not store / send / ... them to anywhere
Revert a tag locally
git tag -d vX.Y.Z
Revert a tag in Github
git push --delete origin vX.Y.Z
This library uses itself to publish to NPM, so:
This project uses Travis CI for
To create a new Release, take in mind:
FAQs
NPM auto publisher tool for Travis CI + Git tags commiting new package version
We found that versiona demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Socket's package search now displays weekly downloads for npm packages, helping developers quickly assess popularity and make more informed decisions.
Security News
A Stanford study reveals 9.5% of engineers contribute almost nothing, costing tech $90B annually, with remote work fueling the rise of "ghost engineers."
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.