
Research
Malicious npm Packages Impersonate Flashbots SDKs, Targeting Ethereum Wallet Credentials
Four npm packages disguised as cryptographic tools steal developer credentials and send them to attacker-controlled Telegram infrastructure.
This project packages the clang-tidy
utility as a Python package. It allows you to install clang-tidy
directly from PyPI:
python -m pip install clang-tidy
This projects intends to release a new PyPI package for each major and minor release of clang-tidy
.
You can use pipx
to run clang-tidy, as well. For example, pipx run clang-tidy <args>
will run clang-tidy without any previous install required on any machine with pipx (including all default GitHub Actions / Azure runners, avoiding requiring a pre-install step or even actions/setup-python
).
The clang-tidy-wheel repository provides the logic to build and publish binary wheels of the clang-tidy
utility.
In order to add a new release, the following steps are necessary:
On manual triggers, the following input variables are available:
use_qemu
: Whether to build targets that require emulation (default: true
)llvm_version
: Override the LLVM version (default: ""
)wheel_version
: Override the wheel packaging version (default "0"
)deploy_to_testpypi
: Whether to deploy to TestPyPI instead of PyPI (default: false
)The repository with the precommit hook is automatically updated using a scheduled Github Actions workflow.
This repository extends the great work of several other projects:
clang-tidy
itself is provided by the LLVM project under the Apache 2.0 License with LLVM exceptions.clang-tidy
.scikit-build
packaging examples of CMake and Ninja were very helpful in packaging clang-tidy
.We are grateful for the generous provisioning with CI resources that GitHub currently offers to Open Source projects.
To see which clang-tidy binary the package is using
you can set CLANG_TIDY_WHEEL_VERBOSE
to 1
in your environment.
FAQs
Clang-tidy is an LLVM-based code analyser tool
We found that clang-tidy demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Four npm packages disguised as cryptographic tools steal developer credentials and send them to attacker-controlled Telegram infrastructure.
Security News
Ruby maintainers from Bundler and rbenv teams are building rv to bring Python uv's speed and unified tooling approach to Ruby development.
Security News
Following last week’s supply chain attack, Nx published findings on the GitHub Actions exploit and moved npm publishing to Trusted Publishers.