Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
continuous-delivery-scripts
Advanced tools
Project initially forked from ARMmbed/mbed-tools-ci-scripts but modified so that it can be used for any projects and any languages.
Continuous Delivery scripts for any projects:
For release notes and a history of changes of all production releases, please see the following:
For a the list of all available versions please, please see the:
The version scheme used follows PEP440 and Semantic Versioning. For production quality releases the version will look as follows:
<major>.<minor>.<patch>
Beta releases are used to give early access to new functionality, for testing and to get feedback on experimental features. As such these releases may not be stable and should not be used for production. Additionally any interfaces introduced in a beta release may be removed or changed without notice. For beta releases the version will look as follows:
<major>.<minor>.<patch>-beta.<pre-release-number>
It is recommended that a virtual environment such as Pipenv is used for all installations to avoid Python dependency conflicts.
To install the most recent production quality release use:
pip install continuous-delivery-scripts
To install a specific release:
pip install continuous-delivery-scripts==<version>
Code documentation is available for the most recent production release here:
The package follows the Unix tools philosophy:
The tools philosophy was to have small programs to accomplish a particular task instead of trying to develop large monolithic programs to do a large number of tasks. To accomplish more complex tasks, tools would simply be connected together, using pipes.
Therefore, it installs the following tools which can be used anywhere within a project/repository comprising a pyproject.toml file such as the one defining this project:
cd-assert-news
: Asserts that the PR/Branch contains a news file describing the changes introducedcd-determine-version
: Returns the version of the toolcd-generate-news
: Generates a changelog file based on the news files present in the repositorycd-get-config
: Returns project configuration valuescd-tag-and-release
: Releases the project (Language specific actions are run, See plugins)cd-create-news-file
: Generates a news filecd-generate-docs
: Generates project Code documentation which can then be rendered by GitHub pages (See docs folder)cd-generate-spdx
: Generates SPDX documents for the project (3rd party IP reporting/ OpenChain)cd-license-files
: Updates the Licence header and copyright to all the source code filesThe follow described the major aspects of the project structure:
.github
- CI and GitHub configuration files.docs/
- Interface definition and usage documentation.examples/
- Usage examples.continuous-delivery-scripts/
- Python source files.news/
- Collection of news files for unreleased changes.tests/
- Unit and integration tests.FAQs
Continuous Delivery scripts to increase automation
We found that continuous-delivery-scripts demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.