
Security News
Follow-up and Clarification on Recent Malicious Ruby Gems Campaign
A clarification on our recent research investigating 60 malicious Ruby gems.
⚡ A Pronto runner that highlights uncovered Rust lines in GitHub pull requests using LCOV reports from cargo llvm-cov
.
Add to your Gemfile
in the :development
group:
gem 'pronto-rustcov', group: :development
Then install:
bundle install
Alternatively, install the gem globally:
gem install pronto-rustcov
Make sure you've generated an LCOV file using cargo llvm-cov
:
cargo install cargo-llvm-cov
cargo llvm-cov clean
cargo llvm-cov --no-report
cargo llvm-cov report --lcov > target/lcov.info
name: Tests
permissions:
contents: read
pull-requests: write
checks: write
statuses: write
on:
pull_request:
branches:
- main
jobs:
tests:
runs-on: ubuntu-latest
steps:
- name: Rust Toolchain Setup
uses: actions-rust-lang/setup-rust-toolchain@v1
with:
components: llvm-tools-preview
- uses: ruby/setup-ruby@v1
with:
ruby-version: '3.3'
bundler-cache: true
- name: Install rustup component
uses: taiki-e/install-action@cargo-llvm-cov
- name: Run Tests
run: |
cargo llvm-cov clean
cargo llvm-cov --no-report --workspace --no-cfg-coverage --remap-path-prefix
cargo llvm-cov report --html
cargo llvm-cov report --lcov > target/lcov.info
- name: Run Pronto
env:
PRONTO_PULL_REQUEST_ID: ${{ github.event.pull_request.number }}
PRONTO_GITHUB_ACCESS_TOKEN: "${{ github.token }}"
PRONTO_RUSTCOV_FILES_LIMIT: 3
PRONTO_RUSTCOV_MESSAGES_PER_FILE_LIMIT: 3
PRONTO_RUSTCOV_LCOV_PATH: target/lcov.info
run: |
gem install pronto pronto-rustcov
pronto run -f github_status github_pr -c origin/${{ github.base_ref }}
MIT
FAQs
Unknown package
We found that pronto-rustcov demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
A clarification on our recent research investigating 60 malicious Ruby gems.
Security News
ESLint now supports parallel linting with a new --concurrency flag, delivering major speed gains and closing a 10-year-old feature request.
Research
/Security News
A malicious Go module posing as an SSH brute forcer exfiltrates stolen credentials to a Telegram bot controlled by a Russian-speaking threat actor.