Skip to content

Commit e5450b0

Browse files
sdn4zsdn4z
committed
feat: initial version
1 parent 2473cf2 commit e5450b0

File tree

11 files changed

+467
-0
lines changed

11 files changed

+467
-0
lines changed

‎.github/release.yml‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
changelog:
2+
exclude:
3+
labels:
4+
- ignore-for-release
5+
authors:
6+
- octocat
7+
categories:
8+
- title: Breaking Changes 🛠
9+
labels:
10+
- breaking
11+
- title: New Features 🎉
12+
labels:
13+
- feature
14+
- title: Fixes 🔧
15+
labels:
16+
- fix
17+
- title: Other Changes
18+
labels:
19+
- "*"

‎.github/workflows/bump-version.yml‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
name: Bump version
2+
3+
on:
4+
workflow_dispatch:
5+
jobs:
6+
bump_version:
7+
if: "!startsWith(github.event.head_commit.message, 'bump:') && github.ref == 'refs/heads/main'"
8+
runs-on: ubuntu-latest
9+
name: "Bump version and create changelog with commitizen"
10+
steps:
11+
- uses: actions/create-github-app-token@67018539274d69449ef7c02e8e71183d1719ab42 # v2.1.4
12+
id: app-token
13+
with:
14+
app-id: ${{ vars.ELEMENTSINTERACTIVE_BOT_APP_ID }}
15+
private-key: ${{ secrets.ELEMENTSINTERACTIVE_BOT_PRIVATE_KEY }}
16+
- uses: actions/checkout@@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
17+
with:
18+
fetch-depth: 0
19+
token: ${{ steps.app-token.outputs.token }}
20+
ref: ${{ github.head_ref }}
21+
# Make sure the value of GITHUB_TOKEN will not be persisted in repo's config
22+
persist-credentials: false
23+
- id: cz
24+
name: Create bump and changelog
25+
uses: commitizen-tools/commitizen-action@5b0848cd060263e24602d1eba03710e056ef7711 # v0.24.0
26+
with:
27+
github_token: ${{ steps.app-token.outputs.token }}
28+
- name: Print Version
29+
run: echo "Bumped to version ${{ steps.cz.outputs.version }}"

‎.github/workflows/conventional-label.yaml‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
on:
2+
pull_request_target:
3+
branches: ["main"]
4+
5+
name: conventional-release-labels
6+
jobs:
7+
label:
8+
runs-on: ubuntu-latest
9+
steps:
10+
- uses: bcoe/conventional-release-labels@886f696738527c7be444262c327c89436dfb95a8 #v1.3.1
11+
with:
12+
type_labels: '{"feat": "feature", "fix": "fix", "BREAKING CHANGE": "breaking", "ci": "CI", "build": "build", "refactor": "refactor", "test": "test"}'

‎.github/workflows/lint.yml‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
# This workflow will check our code for having a proper format, as well as the commit message to meet the expected ones
2+
3+
name: Lint
4+
5+
on:
6+
push:
7+
branches: ["main"]
8+
pull_request:
9+
branches: ["main"]
10+
11+
jobs:
12+
lint-commit:
13+
runs-on: ubuntu-latest
14+
name: "Lint commit message"
15+
container:
16+
image: commitizen/commitizen:4.8.3@sha256:08a078c52b368f85f34257a66e10645ee74d8cbe9b471930b80b2b4e95a9bd4a
17+
steps:
18+
- name: Check out
19+
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
20+
- name: Check commit message
21+
run: |
22+
git config --global --add safe.directory .
23+
cz check --rev-range HEAD

‎.github/workflows/publish.yml‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
name: Publish
2+
3+
on:
4+
push:
5+
tags:
6+
- "v*.*.*"
7+
8+
permissions:
9+
contents: write
10+
11+
jobs:
12+
release:
13+
runs-on: ubuntu-latest
14+
steps:
15+
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
16+
17+
- name: Release
18+
uses: softprops/action-gh-release@6da8fa9354ddfdc4aeace5fc48d7f679b5214090 # v2.4.1
19+
with:
20+
generate_release_notes: true
21+
make_latest: true
22+
token: "${{ secrets.GITHUB_TOKEN }}"

‎.github/workflows/test.yml‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
name: Test Twyn Action
2+
3+
on:
4+
push:
5+
branches: ["main"]
6+
pull_request:
7+
branches: ["main"]
8+
9+
jobs:
10+
test-basic:
11+
name: Basic Test
12+
runs-on: ubuntu-latest
13+
steps:
14+
- name: Checkout code
15+
uses: actions/checkout@v4
16+
17+
- name: Test Basic Action (JSON output)
18+
uses: ./
19+
with:
20+
publish: true
21+
github-token: ${{secrets.GITHUB_TOKEN}}

‎CODEOWNERS‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
@sdn4z @scastlara

‎README.md‎

Lines changed: 77 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,77 @@
1+
# Twyn Action
2+
3+
A GitHub Action that runs security checks against dependency typosquatting attacks using [Twyn](https://github.com/elementsinteractive/twyn).
4+
5+
![Twyn Action Results](assets/twyn-action-results.png)
6+
7+
8+
## What is Twyn?
9+
10+
Twyn is a security tool that analyzes your project dependencies to detect potential typosquatting attacks - when malicious packages have names similar to legitimate ones to trick developers into installing them.
11+
12+
## Examples
13+
14+
### Basic Security Check
15+
16+
```yaml
17+
- name: Run Twyn Security Check
18+
uses: elementsinteractive/twyn-action@v1
19+
```
20+
21+
### With Table Output and PR Comments
22+
23+
```yaml
24+
- name: Run Twyn Security Check
25+
uses: elementsinteractive/twyn-action@v1
26+
with:
27+
table: true
28+
version: v6
29+
publish: true
30+
github-token: ${{ secrets.GITHUB_TOKEN }}
31+
```
32+
33+
### Analyze Specific Files
34+
35+
```yaml
36+
- name: Run Twyn Security Check
37+
uses: elementsinteractive/twyn-action@v1
38+
with:
39+
dependency-file: "requirements.txt,package.json"
40+
table: true
41+
recursive: true
42+
```
43+
44+
45+
## Inputs
46+
47+
| Input | Description | Required | Default |
48+
|-------|-------------|----------|---------|
49+
| `dependency-file` | Dependency file(s) to analyze (comma-separated) | No | Auto-detect |
50+
| `table` | Display results in table format (requires version >=v6) | No | `false` |
51+
| `json` | Display results in JSON format | No | `false` |
52+
| `publish` | Publish results as PR comments | No | `false` |
53+
| `github-token` | GitHub token for publishing comments | No | - |
54+
| `recursive` | Recursively search for dependency files | No | `false` |
55+
| `selector-method` | Method for selecting typosquats (`first-letter`, `nearby-letter`, `all`) | No | - |
56+
| `v` | Enable verbose output | No | `false` |
57+
| `vv` | Enable extra verbose output | No | `false` |
58+
| `version` | Twyn version to use | No | `latest` |
59+
60+
## Outputs
61+
62+
| Output | Description |
63+
|--------|-------------|
64+
| `results` | Raw output from twyn scan |
65+
| `exit-code` | Exit code (0=no issues, 1=issues found, >1=error) |
66+
| `has-findings` | Boolean indicating if issues were found |
67+
68+
## Publishing Results to PR
69+
70+
When `publish: true` is enabled, the action will automatically post a comment to the Pull Request with a formatted table showing any security findings. This requires:
71+
- `table: true` (automatically enabled when publish is true)
72+
- `version: "v6"` or higher (table format requires Twyn v6+)
73+
- `github-token` to be provided
74+
- The workflow to run on a Pull Request event
75+
76+
The PR comment will include a detailed table with information about potential typosquatting packages found.
77+

0 commit comments

Comments
 (0)