Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 4 additions & 2 deletions .eslintrc.json
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,8 @@
"parser": "@typescript-eslint/parser",
"parserOptions": {
"project": [
"./tsconfig.json"
"./tsconfig.json",
"./packages/*/tsconfig.json"
],
"tsconfigRootDir": ".",
"sourceType": "module"
Expand All @@ -16,7 +17,8 @@
},
"ignorePatterns": [
"node_modules/",
"dist/"
"dist/",
"**/example/**"
],
"rules": {
"@typescript-eslint/interface-name-prefix": "off",
Expand Down
112 changes: 112 additions & 0 deletions .github/workflows/release-create-auco.yaml
Original file line number Diff line number Diff line change
@@ -0,0 +1,112 @@
name: Version Bump and Publish Create Auco

on:
pull_request:
types: [closed]
branches: [main]

jobs:
check_commit:
if: github.event.pull_request.merged == true
runs-on: ubuntu-latest
outputs:
SHOULD_RUN: ${{ steps.check_commit.outputs.SHOULD_RUN }}
steps:
- name: Checkout Files
uses: actions/checkout@v4
with:
token: ${{ secrets.ORG_GITHUB_TOKEN }}
fetch-depth: 0 # Need full git history for logs

- name: check if skip ci
id: check_commit
run: |
COMMIT_MESSAGE=$(git log -1 --pretty=%B)
if [[ "$COMMIT_MESSAGE" == *"[skip ci]"* ]]; then
echo "SHOULD_RUN=false" >> "$GITHUB_OUTPUT"
else
echo "SHOULD_RUN=true" >> "$GITHUB_OUTPUT"
fi

version-bump-create-auco:
Comment on lines +10 to +31

Check warning

Code scanning / CodeQL

Workflow does not contain permissions Medium

Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {contents: read}

Copilot Autofix

AI 4 months ago

In general, the fix is to add an explicit permissions block to the workflow (or individual jobs) describing the minimal scopes the workflow needs. This ensures the GITHUB_TOKEN is not over‑privileged even if repo/org defaults are broad, and documents the workflow’s needs.

For this workflow:

  • It checks out code and reads commit messages in check_commit → needs only contents: read.
  • It checks out code, bumps npm version, and pushes commits/tags to main in version-bump-create-auco → needs contents: write.
  • It doesn’t use Actions APIs, issues, pull requests, or other GitHub features directly; Slack and npm use their own secrets, not GITHUB_TOKEN.

The simplest, least‑privilege change without altering functionality is:

  • Add a root‑level permissions: contents: read so that all jobs default to read‑only.
  • Override this for the version-bump-create-auco job with permissions: contents: write.

Concretely:

  • Edit .github/workflows/release-create-auco.yaml.
  • Insert a root permissions: block after the on: section (e.g., after line 6).
  • Add a permissions: block under the version-bump-create-auco job definition (after its runs-on line).

No additional imports or external dependencies are needed.

Suggested changeset 1
.github/workflows/release-create-auco.yaml

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/.github/workflows/release-create-auco.yaml b/.github/workflows/release-create-auco.yaml
--- a/.github/workflows/release-create-auco.yaml
+++ b/.github/workflows/release-create-auco.yaml
@@ -5,6 +5,9 @@
     types: [closed]
     branches: [main]
 
+permissions:
+  contents: read
+
 jobs:
   check_commit:
     if: github.event.pull_request.merged == true
@@ -32,6 +35,8 @@
     needs: check_commit
     if: ${{ needs.check_commit.outputs.SHOULD_RUN != 'false' }}
     runs-on: ubuntu-22.04
+    permissions:
+      contents: write
     defaults:
       run:
         working-directory: packages/create-auco
EOF
@@ -5,6 +5,9 @@
types: [closed]
branches: [main]

permissions:
contents: read

jobs:
check_commit:
if: github.event.pull_request.merged == true
@@ -32,6 +35,8 @@
needs: check_commit
if: ${{ needs.check_commit.outputs.SHOULD_RUN != 'false' }}
runs-on: ubuntu-22.04
permissions:
contents: write
defaults:
run:
working-directory: packages/create-auco
Copilot is powered by AI and may make mistakes. Always verify output.
needs: check_commit
if: ${{ needs.check_commit.outputs.SHOULD_RUN != 'false' }}
runs-on: ubuntu-22.04
defaults:
run:
working-directory: packages/create-auco
steps:
- name: Checkout code
uses: actions/checkout@v4
with:
token: ${{ secrets.ORG_GITHUB_TOKEN }}
fetch-depth: 0 # Need full git history for version bumping

- name: Determine version bump type
id: version
run: |
commit_message=$(git log -1 --pretty=%B)
if [[ "$commit_message" == *"[major]"* ]]; then
echo "type=major" >> "$GITHUB_ENV"
elif [[ "$commit_message" == *"[minor]"* ]]; then
echo "type=minor" >> "$GITHUB_ENV"
elif [[ "$commit_message" == *"[prerelease]"* ]]; then
echo "type=prerelease --preid=rc" >> "$GITHUB_ENV"
else
echo "type=patch" >> "$GITHUB_ENV"
fi

- name: Set up Node.js
uses: actions/setup-node@v4
with:
node-version: '20'
registry-url: 'https://registry.npmjs.org/'

- name: Install dependencies
working-directory: .
run: npm install

- name: Bump version and commit (create-auco)
run: |
# Ensure we are on main and up to date
git reset --hard HEAD
git pull origin main --no-rebase --strategy=ort --no-edit

# Configure git user
git config --global user.name 'github-actions[bot]'
git config --global user.email 'github-actions[bot]@users.noreply.github.com'

# Bump version for create-auco package
new_version=$(npm version ${{ env.type }} -m "chore(release:create-auco): %s [skip ci]")
echo "NEW_VERSION=${new_version}" >> "$GITHUB_ENV"

# Push the version bump commit and tag
git push origin main --follow-tags

- name: Build create-auco
run: npm run build

- name: Publish create-auco to NPM
run: npm publish
env:
NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

- name: Notify Slack on Success
if: success()
uses: slackapi/slack-github-action@v1.26.0
with:
channel-id: ${{ secrets.SLACK_CHANNEL_ID }}
slack-message: '✅ Version bump & publish successful for create-auco: ${{ env.NEW_VERSION }}'
env:
SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }}

- name: Notify Slack on Failure
if: failure()
uses: slackapi/slack-github-action@v1.26.0
with:
channel-id: ${{ secrets.SLACK_CHANNEL_ID }}
slack-message: '❌ Version bump or publish failed for create-auco on main: ${{ github.ref_name }}'
env:
SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }}
Comment on lines +32 to +110

Check warning

Code scanning / CodeQL

Workflow does not contain permissions Medium

Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {contents: read}

Copilot Autofix

AI 4 months ago

In general, the fix is to add an explicit permissions block either at the workflow root (to apply to all jobs) or within each job, granting only what that job needs. Here, the check_commit job only reads commit messages, so it can use contents: read. The version-bump-create-auco job performs repository writes (commits/tags and pushes) and therefore needs contents: write. No other GitHub-specific scopes (issues, pull-requests, etc.) are used, so they can be omitted.

The single best fix without changing behavior is to add a workflow-level permissions block that sets a safe default of contents: read, and then override it for the version-bump-create-auco job with permissions: contents: write. This clearly documents that only the version bump job can write to the repo, while all jobs retain the ability to read contents. Concretely:

  • In .github/workflows/release-create-auco.yaml, add:
permissions:
  contents: read

right after the on: block (around line 7–8).

  • In the version-bump-create-auco job definition (around line 31–34), add:
permissions:
  contents: write

between runs-on: ubuntu-22.04 and defaults:.

No imports or external libraries are needed; this is purely a YAML configuration change in the workflow file.

Suggested changeset 1
.github/workflows/release-create-auco.yaml

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/.github/workflows/release-create-auco.yaml b/.github/workflows/release-create-auco.yaml
--- a/.github/workflows/release-create-auco.yaml
+++ b/.github/workflows/release-create-auco.yaml
@@ -5,6 +5,9 @@
     types: [closed]
     branches: [main]
 
+permissions:
+  contents: read
+
 jobs:
   check_commit:
     if: github.event.pull_request.merged == true
@@ -32,6 +35,8 @@
     needs: check_commit
     if: ${{ needs.check_commit.outputs.SHOULD_RUN != 'false' }}
     runs-on: ubuntu-22.04
+    permissions:
+      contents: write
     defaults:
       run:
         working-directory: packages/create-auco
EOF
@@ -5,6 +5,9 @@
types: [closed]
branches: [main]

permissions:
contents: read

jobs:
check_commit:
if: github.event.pull_request.merged == true
@@ -32,6 +35,8 @@
needs: check_commit
if: ${{ needs.check_commit.outputs.SHOULD_RUN != 'false' }}
runs-on: ubuntu-22.04
permissions:
contents: write
defaults:
run:
working-directory: packages/create-auco
Copilot is powered by AI and may make mistakes. Always verify output.


7 changes: 5 additions & 2 deletions .gitignore
Original file line number Diff line number Diff line change
@@ -1,5 +1,8 @@
node_modules/
dist
dist/
**/dist/
.env
*.log
*.db
*.db
*.tsbuildinfo
**/*.tsbuildinfo
56 changes: 55 additions & 1 deletion README.md
Original file line number Diff line number Diff line change
Expand Up @@ -23,7 +23,61 @@ Read [our documentation](https://scaffoldstark.com/auco)

## Installation

### From npm (Recommended)
### Create a New Project

The quickest way to create a new Auco project is using the create command:

```bash
# Using npm (recommended - works once published)
npm create auco

# Using yarn
yarn create auco

# Using pnpm
pnpm create auco

# Using bun
bun create auco

# Using npx (also works once published)
npx create-auco
```

On installation, you'll see a few prompts:
- ✓ What's the name of your project? › my-starknet-indexer
- ✓ Which template would you like to use? › Default
- ✓ Installed packages
- ✓ Initialized git repository

You can skip prompts by using the `--yes` flag:
```bash
npm create auco my-project --yes
# or
npx create-auco my-project --yes
```

**For Local Development/Testing:**

If you're developing the `create-auco` script locally, you can test it using:

```bash
# Option 1: Run directly from the built file
node dist/scripts/create-auco.js my-project

# Option 2: Link the package globally first, then use npx
npm link
npx create-auco my-project

# Option 3: Use npm create with the local package
npm create auco@file:.
```

**Note:** For `npm create auco` / `yarn create auco` to work for end users, the package needs to be published as `create-auco` on npm (in addition to the main `auco` package).

### Install as a Library

If you want to use Auco as a library in an existing project:

```bash
npm install auco
Expand Down
Loading