Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
This project provides a set of tools for daily work with GDScript
. At the moment it provides:
To install this project you need python3
and pip
.
Regardless of the target version, installation is done by pip3
command and for stable releases, it downloads the package from PyPI.
pip3 install "gdtoolkit==4.*"
# or
pipx install "gdtoolkit==4.*"
pip3 install "gdtoolkit==3.*"
# or
pipx install "gdtoolkit==3.*"
master
(latest)Latest version (potentially unstable) can be installed directly from git:
pip3 install git+https://github.com/Scony/godot-gdscript-toolkit.git
# or
pipx install git+https://github.com/Scony/godot-gdscript-toolkit.git
To run a linter you need to execute gdlint
command like:
$ gdlint misc/MarkovianPCG.gd
Which outputs messages like:
misc/MarkovianPCG.gd:96: Error: Function argument name "aOrigin" is not valid (function-argument-name)
misc/MarkovianPCG.gd:96: Error: Function argument name "aPos" is not valid (function-argument-name)
Formatting may lead to data loss, so it's highly recommended to use it along with Version Control System (VCS) e.g. git
To run a formatter you need to execute gdformat
on the file you want to format. So, given a test.gd
file:
class X:
var x=[1,2,{'a':1}]
var y=[1,2,3,] # trailing comma
func foo(a:int,b,c=[1,2,3]):
if a in c and \
b > 100:
print('foo')
func bar():
print('bar')
when you execute gdformat test.gd
command, the test.gd
file will be reformatted as follows:
class X:
var x = [1, 2, {'a': 1}]
var y = [
1,
2,
3,
] # trailing comma
func foo(a: int, b, c = [1, 2, 3]):
if a in c and b > 100:
print('foo')
func bar():
print('bar')
To run a parser you need to execute the gdparse
command like:
gdparse tests/valid-gd-scripts/recursive_tool.gd -p
The parser outputs a tree that represents your code's structure:
start
class_def
X
class_body
tool_stmt
signal_stmt sss
class_def
Y
class_body
tool_stmt
signal_stmt sss
tool_stmt
To run cyclomatic complexity calculator you need to execute the gdradon
command like:
gdradon cc tests/formatter/input-output-pairs/simple-function-statements.in.gd tests/gd2py/input-output-pairs/
The command outputs calculated metrics just like Radon cc command does for Python code:
tests/formatter/input-output-pairs/simple-function-statements.in.gd
C 1:0 X - A (2)
F 2:1 foo - A (1)
tests/gd2py/input-output-pairs/class-level-statements.in.gd
F 22:0 foo - A (1)
F 24:0 bar - A (1)
C 18:0 C - A (1)
tests/gd2py/input-output-pairs/func-level-statements.in.gd
F 1:0 foo - B (8)
In order to setup a simple action with gdtoolkit's static checks, the base action from this repo can be used:
name: Static checks
on:
push:
branches: [ "main" ]
pull_request:
branches: [ "main" ]
jobs:
static-checks:
name: 'Static checks'
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: Scony/godot-gdscript-toolkit@master
- run: gdformat --check source/
- run: gdlint source/
See the discussion in https://github.com/Scony/godot-gdscript-toolkit/issues/239 for more details.
Everyone is free to fix bugs or introduce new features. For that, however, please refer to existing issue or create one before starting implementation.
FAQs
Independent set of tools for working with GDScript - parser, linter and formatter
We found that gdtoolkit demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.