Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
:toc: macro :toclevels: 5 :figure-caption!:
:pipeable_link: link:https://alchemists.io/projects/pipeable[Pipeable]
= Ghub
Ghub is portmanteau (i.e. [g]it + hub = ghub) that provides a GitHub link:https://docs.github.com/en/rest[API] client using a design which leverages link:https://alchemists.io/articles/ruby_function_composition[function composition] and link:https://dry-rb.org/gems/dry-monads[monads]. This gem is built upon the link:https://github.com/httprb/http[HTTP] gem which provides a nicer Object API instead of link:https://lostisland.github.io/faraday[Faraday] which is what the link:https://github.com/octokit/octokit.rb[Octokit] gem uses.
toc::[]
== Features
== Requirements
. link:https://www.ruby-lang.org[Ruby]. . link:https://github.com[GitHub].
== Setup
To set up the project, run:
== Usage
All usage is via the Ghub::Client
class.
=== Initialization
You can initialize an API client -- using the defaults as described in the Environment section below -- as follows:
Further customization can be done via a block:
=== Environment
Environment variable support can be managed using link:https://direnv.net[direnv]. These are the defaults:
You must provide a value for GITHUB_API_TOKEN
in order to make authenticated API requests. This can be done by creating a link:https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/creating-a-personal-access-token[Personal Access Token (PAT)] for the value.
=== Endpoints
Only partial support of the various API endpoints are supported. Each section below documents usage with additional documentation, usage, parameters, responses, etc. provided by the official GitHub API documentation links.
==== Branch Protection
The following is an example of how to link:https://docs.github.com/en/rest/branches/branch-protection#get-branch-protection[show], link:https://docs.github.com/en/rest/branches/branch-protection#update-branch-protection[update], and link:https://docs.github.com/en/rest/branches/branch-protection#delete-branch-protection[destroy] branch protection:
==== Branch Signature
The following is an example of how to link:https://docs.github.com/en/rest/branches/branch-protection#get-commit-signature-protection[show], link:https://docs.github.com/en/rest/branches/branch-protection#create-commit-signature-protection[create], and link:https://docs.github.com/en/rest/branches/branch-protection#delete-commit-signature-protection[destroy] branch signature protection:
==== Organization Members
The following is how to link:https://docs.github.com/en/rest/orgs/members#list-organization-members[index] organization members.
==== Pulls
The following is how to link:https://docs.github.com/en/rest/pulls/pulls#list-pull-requests[index] and link:https://docs.github.com/en/rest/pulls/pulls#get-a-pull-request[show] pull requests:
==== Repositories
The following documents how to interact with repositories:
client.repositories.index :users, "doe" client.repositories.index :orgs, "acme"
client.repositories.show "acme", "ghub-test"
client.repositories.create :users, {name: "ghub-test", private: true} client.repositories.create :orgs, {name: "ghub-test", private: true}, owner: "acme"
client.repositories.patch "acme", "ghub-test", {description: "For test only."}
GitHub's API design for repositories is awkward and you can see this infect the Object API, especially when creating a repository. Use :users
or :orgs
(can be strings) to distinguish between the two types of repository creation. The only stipulation for organization creation is that you must supply the organization name. This was done so you could use the same Object API for both.
==== Search
The following is how to search link:https://docs.github.com/en/rest/search/search#search-users[users]:
==== Users
The following is how to link:https://docs.github.com/en/rest/users/users#list-users[index] and link:https://docs.github.com/en/rest/users/users#get-a-user[show] users:
== Development
To contribute, run:
You can also use the IRB console for direct access to all objects:
== Tests
To test, run:
== link:https://alchemists.io/policies/license[License]
== link:https://alchemists.io/policies/security[Security]
== link:https://alchemists.io/policies/code_of_conduct[Code of Conduct]
== link:https://alchemists.io/policies/contributions[Contributions]
== link:https://alchemists.io/policies/developer_certificate_of_origin[Developer Certificate of Origin]
== link:https://alchemists.io/projects/ghub/versions[Versions]
== link:https://alchemists.io/community[Community]
== Credits
FAQs
Unknown package
We found that ghub demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.