
Security News
vlt Launches "reproduce": A New Tool Challenging the Limits of Package Provenance
vlt's new "reproduce" tool verifies npm packages against their source code, outperforming traditional provenance adoption in the JavaScript ecosystem.
CLI to deploy ephemeral websites, see smokeshow.helpmanual.io for more information.
pip install smokeshow
To get help on usage, run:
smokeshow --help
To generate an upload key, use:
smokeshow generate-key
You should then set the key as an environment variable with
export SMOKESHOW_AUTH_KEY='...'
With that, you can upload a site with:
smokeshow upload path/to/upload
For more help run smokeshow upload --help
, if you run smokeshow upload
without either
setting the SMOKESHOW_AUTH_KEY
environment variable or using the --auth-key
option, smokeshow will generate
a new upload key before uploading the site.
If you're having trouble with python versions and accessing the CLI, you can also run the smokeshow library module as a script via
python -m smokeshow
I build smokeshow primarily to preview documentation and coverage generate with github actions.
smokeshow therefore integrates directly with github actions to add a status to commits with a link to the newly created ephemeral site.
In addition, smokeshow has custom logic to extract the total coverage figure from coverage.py HTML coverage reports to both annotate commit status updates and decide if the commit status is "success" or "failure".
Example of setting the commit status from a github action:
- run: smokeshow upload cli/htmlcov
env:
SMOKESHOW_GITHUB_STATUS_DESCRIPTION: CLI Coverage {coverage-percentage}
SMOKESHOW_GITHUB_COVERAGE_THRESHOLD: 50
SMOKESHOW_GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
SMOKESHOW_GITHUB_PR_HEAD_SHA: ${{ github.event.pull_request.head.sha }}
(this is taken directly from smokeshow's own CI, see here)
The following environment variables are used when setting commit statuses:
SMOKESHOW_GITHUB_STATUS_DESCRIPTION
(or alternatively the --github-status-description
CLI option) set the description
for the commit status; the string {coverage-percentage}
has a special meaning and will be replaced by the actual
coverage percentage if it can be extract from the root index.html
file being uploaded, this must be set
for smokeshow to set the commit statusSMOKESHOW_GITHUB_COVERAGE_THRESHOLD
(or alternatively the --github-coverage-threshold
CLI option) decide
the "state" of the commit status update; success
is used if either the total coverage number isn't available or it's
above the threshold, failure
is used if the coverage number is below this thresholdSMOKESHOW_GITHUB_TOKEN
this is used to authenticate the status update, more details
hereSMOKESHOW_GITHUB_PR_HEAD_SHA
or if it's omitted or empty GITHUB_SHA
(which is set automatically by github actions)
are used to decide which commit to set the status on.
The SMOKESHOW_GITHUB_PR_HEAD_SHA: ${{ github.event.pull_request.head.sha }}
trick shown above is required since
github set the GITHUB_SHA
env var to a merge commit on pull requests which isn't what you wantSMOKESHOW_GITHUB_CONTEXT
suffix for github status contextGITHUB_REPOSITORY
is set automatically by github actions, it's used to choose the repo to set the status onFAQs
Deploy ephemeral websites.
We found that smokeshow demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
vlt's new "reproduce" tool verifies npm packages against their source code, outperforming traditional provenance adoption in the JavaScript ecosystem.
Research
Security News
Socket researchers uncovered a malicious PyPI package exploiting Deezer’s API to enable coordinated music piracy through API abuse and C2 server control.
Research
The Socket Research Team discovered a malicious npm package, '@ton-wallet/create', stealing cryptocurrency wallet keys from developers and users in the TON ecosystem.