Skip to content

Commit 0a42516

Browse files
sdn4zsdn4z
committed
feat: initial version
1 parent 2473cf2 commit 0a42516

File tree

10 files changed

+463
-0
lines changed

10 files changed

+463
-0
lines changed

‎.github/release.yml‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
changelog:
2+
exclude:
3+
labels:
4+
- ignore-for-release
5+
authors:
6+
- octocat
7+
categories:
8+
- title: Breaking Changes 🛠
9+
labels:
10+
- breaking
11+
- title: New Features 🎉
12+
labels:
13+
- feature
14+
- title: Fixes 🔧
15+
labels:
16+
- fix
17+
- title: Other Changes
18+
labels:
19+
- "*"

‎.github/workflows/bump-version.yml‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
name: Bump version
2+
3+
on:
4+
workflow_dispatch:
5+
jobs:
6+
bump_version:
7+
if: "!startsWith(github.event.head_commit.message, 'bump:') && github.ref == 'refs/heads/main'"
8+
runs-on: ubuntu-latest
9+
name: "Bump version and create changelog with commitizen"
10+
steps:
11+
- uses: actions/create-github-app-token@67018539274d69449ef7c02e8e71183d1719ab42 # v2.1.4
12+
id: app-token
13+
with:
14+
app-id: ${{ vars.ELEMENTSINTERACTIVE_BOT_APP_ID }}
15+
private-key: ${{ secrets.ELEMENTSINTERACTIVE_BOT_PRIVATE_KEY }}
16+
- uses: actions/checkout@@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
17+
with:
18+
fetch-depth: 0
19+
token: ${{ steps.app-token.outputs.token }}
20+
ref: ${{ github.head_ref }}
21+
# Make sure the value of GITHUB_TOKEN will not be persisted in repo's config
22+
persist-credentials: false
23+
- id: cz
24+
name: Create bump and changelog
25+
uses: commitizen-tools/commitizen-action@5b0848cd060263e24602d1eba03710e056ef7711 # v0.24.0
26+
with:
27+
github_token: ${{ steps.app-token.outputs.token }}
28+
- name: Print Version
29+
run: echo "Bumped to version ${{ steps.cz.outputs.version }}"

‎.github/workflows/conventional-label.yaml‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
on:
2+
pull_request_target:
3+
branches: ["main"]
4+
5+
name: conventional-release-labels
6+
jobs:
7+
label:
8+
runs-on: ubuntu-latest
9+
steps:
10+
- uses: bcoe/conventional-release-labels@886f696738527c7be444262c327c89436dfb95a8 #v1.3.1
11+
with:
12+
type_labels: '{"feat": "feature", "fix": "fix", "BREAKING CHANGE": "breaking", "ci": "CI", "build": "build", "refactor": "refactor", "test": "test"}'

‎.github/workflows/lint.yml‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
# This workflow will check our code for having a proper format, as well as the commit message to meet the expected ones
2+
3+
name: Lint
4+
5+
on:
6+
push:
7+
branches: ["main"]
8+
pull_request:
9+
branches: ["main"]
10+
11+
jobs:
12+
lint-commit:
13+
runs-on: ubuntu-latest
14+
name: "Lint commit message"
15+
container:
16+
image: commitizen/commitizen:4.8.3@sha256:08a078c52b368f85f34257a66e10645ee74d8cbe9b471930b80b2b4e95a9bd4a
17+
steps:
18+
- name: Check out
19+
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
20+
- name: Check commit message
21+
run: |
22+
git config --global --add safe.directory .
23+
cz check --rev-range HEAD

‎.github/workflows/publish.yml‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
name: Publish
2+
3+
on:
4+
push:
5+
tags:
6+
- "v*.*.*"
7+
8+
permissions:
9+
contents: write
10+
11+
jobs:
12+
release:
13+
runs-on: ubuntu-latest
14+
steps:
15+
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
16+
17+
- name: Release
18+
uses: softprops/action-gh-release@6da8fa9354ddfdc4aeace5fc48d7f679b5214090 # v2.4.1
19+
with:
20+
generate_release_notes: true
21+
make_latest: true
22+
token: "${{ secrets.GITHUB_TOKEN }}"

‎.github/workflows/simple-test.yml‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
name: Simple Test
2+
3+
on:
4+
workflow_dispatch: # Allow manual triggering
5+
push:
6+
branches: [main, init]
7+
8+
jobs:
9+
test-action:
10+
name: Test Twyn Action
11+
runs-on: ubuntu-latest
12+
steps:
13+
- name: Checkout code
14+
uses: actions/checkout@v4
15+
16+
- name: Run Twyn Security Check
17+
id: twyn
18+
uses: ./
19+
with:
20+
dependency-file: "requirements.txt"
21+
github-token: ${{ secrets.GITHUB_TOKEN }}

‎CODEOWNERS‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
@sdn4z @scastlara

‎README.md‎

Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
# Twyn Action
2+
3+
A GitHub Action that runs security checks against dependency typosquatting attacks using [Twyn](https://github.com/elementsinteractive/twyn).
4+
5+
![Twyn Action Results](assets/twyn-action-results.png)
6+
7+
8+
## What is Twyn?
9+
10+
Twyn is a security tool that analyzes your project dependencies to detect potential typosquatting attacks - when malicious packages have names similar to legitimate ones to trick developers into installing them.
11+
12+
## Examples
13+
14+
### Basic Security Check
15+
16+
```yaml
17+
pull_request:
18+
branches: [ main ]
19+
20+
- name: Run Twyn Security Check
21+
uses: elementsinteractive/twyn-action@v1
22+
with:
23+
publish: true
24+
github-token: ${{ secrets.GITHUB_TOKEN }}
25+
```
26+
27+
## Inputs
28+
29+
| Input | Description | Required | Default |
30+
|-------|-------------|----------|---------|
31+
| `dependency-file` | Dependency file(s) to analyze (comma-separated) | No | Auto-detect |
32+
| `table` | Display results in table format (requires version >=v6) | No | `false` |
33+
| `json` | Display results in JSON format | No | `false` |
34+
| `publish` | Publish results as PR comments. It must run in a PR context | No | `false` |
35+
| `github-token` | GitHub token for publishing comments | No | - |
36+
| `recursive` | Recursively search for dependency files | No | `false` |
37+
| `selector-method` | Method for selecting typosquats (`first-letter`, `nearby-letter`, `all`) | No | - |
38+
| `v` | Enable verbose output | No | `false` |
39+
| `vv` | Enable extra verbose output | No | `false` |
40+
| `version` | Twyn version to use | No | `latest` |
41+
42+
## Outputs
43+
44+
| Output | Description |
45+
|--------|-------------|
46+
| `results` | Raw output from twyn scan |
47+
| `exit-code` | Exit code (0=no issues, 1=issues found, >1=error) |
48+
| `has-findings` | Boolean indicating if issues were found |
49+
50+
## Publishing Results to PR
51+
52+
When `publish: true` is enabled, the action will automatically post a comment to the Pull Request with a formatted table showing any security findings.
53+
54+
**⚠️ Important: Publishing only works when the workflow runs in a Pull Request context.** Make sure your workflow is triggered by `pull_request` events, not just `push` or `workflow_dispatch`.
55+
56+
This requires:
57+
- `table: true` (automatically enabled when publish is true)
58+
- `version: "v6"` or higher (table format requires Twyn v6+)
59+
- `github-token` to be provided
60+
- The workflow to run on a Pull Request event (`on: pull_request`)
61+
62+
The PR comment will include a detailed table with information about potential typosquatting packages found.

0 commit comments

Comments
 (0)