Skip to content

Commit 58215a7

Browse files
sdn4zsdn4z
committed
feat: initial version
1 parent 2473cf2 commit 58215a7

File tree

10 files changed

+569
-0
lines changed

10 files changed

+569
-0
lines changed

‎.github/release.yml‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
changelog:
2+
exclude:
3+
labels:
4+
- ignore-for-release
5+
authors:
6+
- octocat
7+
categories:
8+
- title: Breaking Changes 🛠
9+
labels:
10+
- breaking
11+
- title: New Features 🎉
12+
labels:
13+
- feature
14+
- title: Fixes 🔧
15+
labels:
16+
- fix
17+
- title: Other Changes
18+
labels:
19+
- "*"

‎.github/workflows/bump-version.yml‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
name: Bump version
2+
3+
on:
4+
workflow_dispatch:
5+
jobs:
6+
bump_version:
7+
if: "!startsWith(github.event.head_commit.message, 'bump:') && github.ref == 'refs/heads/main'"
8+
runs-on: ubuntu-latest
9+
name: "Bump version and create changelog with commitizen"
10+
steps:
11+
- uses: actions/create-github-app-token@67018539274d69449ef7c02e8e71183d1719ab42 # v2.1.4
12+
id: app-token
13+
with:
14+
app-id: ${{ vars.ELEMENTSINTERACTIVE_BOT_APP_ID }}
15+
private-key: ${{ secrets.ELEMENTSINTERACTIVE_BOT_PRIVATE_KEY }}
16+
- uses: actions/checkout@@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
17+
with:
18+
fetch-depth: 0
19+
token: ${{ steps.app-token.outputs.token }}
20+
ref: ${{ github.head_ref }}
21+
# Make sure the value of GITHUB_TOKEN will not be persisted in repo's config
22+
persist-credentials: false
23+
- id: cz
24+
name: Create bump and changelog
25+
uses: commitizen-tools/commitizen-action@5b0848cd060263e24602d1eba03710e056ef7711 # v0.24.0
26+
with:
27+
github_token: ${{ steps.app-token.outputs.token }}
28+
- name: Print Version
29+
run: echo "Bumped to version ${{ steps.cz.outputs.version }}"

‎.github/workflows/conventional-label.yaml‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
on:
2+
pull_request_target:
3+
branches: ["main"]
4+
5+
name: conventional-release-labels
6+
jobs:
7+
label:
8+
runs-on: ubuntu-latest
9+
steps:
10+
- uses: bcoe/conventional-release-labels@886f696738527c7be444262c327c89436dfb95a8 #v1.3.1
11+
with:
12+
type_labels: '{"feat": "feature", "fix": "fix", "BREAKING CHANGE": "breaking", "ci": "CI", "build": "build", "refactor": "refactor", "test": "test"}'

‎.github/workflows/lint.yml‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
# This workflow will check our code for having a proper format, as well as the commit message to meet the expected ones
2+
3+
name: Lint
4+
5+
on:
6+
push:
7+
branches: ["main"]
8+
pull_request:
9+
branches: ["main"]
10+
11+
jobs:
12+
lint-commit:
13+
runs-on: ubuntu-latest
14+
name: "Lint commit message"
15+
container:
16+
image: commitizen/commitizen:4.8.3@sha256:08a078c52b368f85f34257a66e10645ee74d8cbe9b471930b80b2b4e95a9bd4a
17+
steps:
18+
- name: Check out
19+
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
20+
- name: Check commit message
21+
run: |
22+
git config --global --add safe.directory .
23+
cz check --rev-range HEAD

‎.github/workflows/publish.yml‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
name: Publish
2+
3+
on:
4+
push:
5+
tags:
6+
- "v*.*.*"
7+
8+
permissions:
9+
contents: write
10+
11+
jobs:
12+
release:
13+
runs-on: ubuntu-latest
14+
steps:
15+
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
16+
17+
- name: Release
18+
uses: softprops/action-gh-release@6da8fa9354ddfdc4aeace5fc48d7f679b5214090 # v2.4.1
19+
with:
20+
generate_release_notes: true
21+
make_latest: true
22+
token: "${{ secrets.GITHUB_TOKEN }}"

‎.github/workflows/test.yml‎

Lines changed: 126 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,126 @@
1+
name: Test Twyn Action
2+
3+
on:
4+
push:
5+
branches: [ main, init ]
6+
pull_request:
7+
branches: [ main, init ]
8+
workflow_dispatch: # Allow manual triggering
9+
10+
jobs:
11+
test-basic:
12+
name: Basic Test
13+
runs-on: ubuntu-latest
14+
steps:
15+
- name: Checkout code
16+
uses: actions/checkout@v4
17+
18+
- name: Test Basic Action (JSON output)
19+
uses: ./
20+
with:
21+
json: true
22+
dependency-file: "requirements.txt"
23+
24+
test-table-format:
25+
name: Test Table Format
26+
runs-on: ubuntu-latest
27+
steps:
28+
- name: Checkout code
29+
uses: actions/checkout@v4
30+
31+
- name: Test Table Format (v6)
32+
uses: ./
33+
with:
34+
table: true
35+
version: "v6"
36+
dependency-file: "requirements.txt"
37+
38+
test-version-validation:
39+
name: Test Version Validation
40+
runs-on: ubuntu-latest
41+
steps:
42+
- name: Checkout code
43+
uses: actions/checkout@v4
44+
45+
- name: Test Invalid Version (should fail)
46+
id: invalid-version
47+
continue-on-error: true
48+
uses: ./
49+
with:
50+
table: true
51+
version: "v5.0.0"
52+
dependency-file: "requirements.txt"
53+
54+
- name: Check that invalid version failed
55+
run: |
56+
if [ "${{ steps.invalid-version.outcome }}" != "failure" ]; then
57+
echo "❌ Test failed: Invalid version should have caused failure"
58+
exit 1
59+
else
60+
echo "✅ Test passed: Invalid version correctly rejected"
61+
fi
62+
63+
test-with-outputs:
64+
name: Test Action Outputs
65+
runs-on: ubuntu-latest
66+
steps:
67+
- name: Checkout code
68+
uses: actions/checkout@v4
69+
70+
- name: Run Twyn with outputs
71+
id: twyn-test
72+
uses: ./
73+
with:
74+
json: true
75+
dependency-file: "requirements.txt"
76+
77+
- name: Check outputs
78+
run: |
79+
echo "Exit Code: ${{ steps.twyn-test.outputs.exit-code }}"
80+
echo "Has Findings: ${{ steps.twyn-test.outputs.has-findings }}"
81+
echo "Results (truncated): ${{ steps.twyn-test.outputs.results }}"
82+
83+
# Validate output format
84+
if [ -z "${{ steps.twyn-test.outputs.exit-code }}" ]; then
85+
echo "❌ exit-code output is missing"
86+
exit 1
87+
fi
88+
89+
if [ -z "${{ steps.twyn-test.outputs.has-findings }}" ]; then
90+
echo "❌ has-findings output is missing"
91+
exit 1
92+
fi
93+
94+
echo "✅ All outputs are present"
95+
96+
test-pr-comment:
97+
name: Test PR Comment (simulation)
98+
runs-on: ubuntu-latest
99+
if: github.event_name == 'pull_request'
100+
steps:
101+
- name: Checkout code
102+
uses: actions/checkout@v4
103+
104+
- name: Test PR Comment Publishing
105+
uses: ./
106+
with:
107+
table: true
108+
version: "v6"
109+
publish: true
110+
dependency-file: "requirements.txt"
111+
github-token: ${{ secrets.GITHUB_TOKEN }}
112+
113+
test-verbose-mode:
114+
name: Test Verbose Mode
115+
runs-on: ubuntu-latest
116+
steps:
117+
- name: Checkout code
118+
uses: actions/checkout@v4
119+
120+
- name: Test Verbose Output
121+
uses: ./
122+
with:
123+
vv: true
124+
table: true
125+
version: "v6"
126+
dependency-file: "requirements.txt"

‎CODEOWNERS‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
@sdn4z @scastlara

‎README.md‎

Lines changed: 74 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,74 @@
1+
# Twyn Action
2+
3+
A GitHub Action that runs security checks against dependency typosquatting attacks using [Twyn](https://github.com/elementsinteractive/twyn).
4+
5+
## What is Twyn?
6+
7+
Twyn is a security tool that analyzes your project dependencies to detect potential typosquatting attacks - when malicious packages have names similar to legitimate ones to trick developers into installing them.
8+
9+
## Examples
10+
11+
### Basic Security Check
12+
13+
```yaml
14+
- name: Run Twyn Security Check
15+
uses: elementsinteractive/twyn-action@v1
16+
```
17+
18+
### With Table Output and PR Comments
19+
20+
```yaml
21+
- name: Run Twyn Security Check
22+
uses: elementsinteractive/twyn-action@v1
23+
with:
24+
table: true
25+
version: v6
26+
publish: true
27+
github-token: ${{ secrets.GITHUB_TOKEN }}
28+
```
29+
30+
### Analyze Specific Files
31+
32+
```yaml
33+
- name: Run Twyn Security Check
34+
uses: elementsinteractive/twyn-action@v1
35+
with:
36+
dependency-file: "requirements.txt,package.json"
37+
table: true
38+
recursive: true
39+
```
40+
41+
42+
## Inputs
43+
44+
| Input | Description | Required | Default |
45+
|-------|-------------|----------|---------|
46+
| `dependency-file` | Dependency file(s) to analyze (comma-separated) | No | Auto-detect |
47+
| `table` | Display results in table format (requires version >=v6) | No | `false` |
48+
| `json` | Display results in JSON format | No | `false` |
49+
| `publish` | Publish results as PR comments | No | `false` |
50+
| `github-token` | GitHub token for publishing comments | No | - |
51+
| `recursive` | Recursively search for dependency files | No | `false` |
52+
| `selector-method` | Method for selecting typosquats (`first-letter`, `nearby-letter`, `all`) | No | - |
53+
| `v` | Enable verbose output | No | `false` |
54+
| `vv` | Enable extra verbose output | No | `false` |
55+
| `version` | Twyn version to use | No | `latest` |
56+
57+
## Outputs
58+
59+
| Output | Description |
60+
|--------|-------------|
61+
| `results` | Raw output from twyn scan |
62+
| `exit-code` | Exit code (0=no issues, 1=issues found, >1=error) |
63+
| `has-findings` | Boolean indicating if issues were found |
64+
65+
## Publishing Results to PR
66+
67+
When `publish: true` is enabled, the action will automatically post a comment to the Pull Request with a formatted table showing any security findings. This requires:
68+
- `table: true` (automatically enabled when publish is true)
69+
- `version: "v6"` or higher (table format requires Twyn v6+)
70+
- `github-token` to be provided
71+
- The workflow to run on a Pull Request event
72+
73+
The PR comment will include a detailed table with information about potential typosquatting packages found.
74+

0 commit comments

Comments
 (0)