Gathering detailed insights and metrics for @ampproject/toolbox-validator-rules
Gathering detailed insights and metrics for @ampproject/toolbox-validator-rules
A collection of AMP tools making it easier to publish and host AMP pages.
Installations
npm install @ampproject/toolbox-validator-rulesDeveloper
ampproject
Developer Guide
BETA
Module System
CommonJS
Min. Node Version
Typescript Support
No
Node Version
20.12.2
NPM Version
10.8.1
Statistics
450 Stars
1,312 Commits
243 Forks
43 Watching
61 Branches
110 Contributors
Updated on 15 Nov 2024
Languages
HTML (78.83%)
JavaScript (15.43%)
TypeScript (3.36%)
CSS (2.36%)
Handlebars (0.01%)
Dockerfile (0.01%)
Total Downloads
Cumulative downloads
Total Downloads
62,314,626
Last day
22.9%
9,353
Compared to previous day
Last week
19%
54,249
Compared to previous week
Last month
15%
185,180
Compared to previous month
Last year
-45.3%
2,195,083
Compared to previous year
Daily Downloads
Weekly Downloads
Monthly Downloads
Yearly Downloads
Dependencies
1
Versions
AMP Toolbox
A collection of AMP tools making it easier to publish and host AMP pages. The following tools are part of this project:
- amp-cache-url: a javascript library for translating origin URLs to the AMP Cache URL format.
- amp-cache-list: a javascript library for listing the known AMP Caches.
- amp-cli: a command line version of AMP Toolbox
- amp-cors: a connect/express middleware to automatically add AMP Cors headers.
- amp-linter: a javascript library for linting AMP documents (includes CLI mode).
- amp-optimizer: a javascript library implementing server-side-rendering for AMP pages.
- amp-optimizer-express an express middleware that applies AMP server-side-rendering on the fly.
- amp-optimizer-docker a Docker container that exposes an API for AMP server-side-rendering on the fly.
- amp-runtime-fetch: a javascript library for downloading the AMP runtime.
- amp-runtime-version: a javascript library for querying the current AMP runtime version.
- amp-script-csp: a javascript library for calculating
amp-scriptcompatible CSP hashes. - amp-update-cache: a javascript library for updating AMP documents in AMP Caches.
- amp-validator-rules: a javascript library for querying AMP validator rules.
Development
Setting up your environment
After forking amp-toolbox to your own github org, do the following steps to get started:
# clone your fork to your local machine
git clone https://github.com/your-fork/amp-toolbox.git
# step into local repo
cd amp-toolbox
# install dependencies
npm install
# run tests
npm test
Adding new dependencies
amp-toolbox uses Lerna to manage it's packages. To keep build times low, devDependencies (but not CLI dependencies) must be added to the root package.json file. Runtime dependencies are managed for each package individually.
When adding a new package inside the packages directory, register the package via:
npm run bootstrap
Running Tests
The test suite runs for all packages and must be run from the root directory.
# run tests on node and browser
npm test
# run only in node (fastest)
npm run test:node
# run only in browser
npm run test:browser
Using additional arguments the node tests can generate a coverage report or run only for a specific package.
# generate a coverage report
npm run test:node -- --collectCoverage
# run only tests for AMP Optimizer
npm run test:node -- packages/optimizer
Style & Linting
This codebase adheres to the Google Javascript Styleguide and is enforced using ESLint. ESLint is run as part of the test suite, but you can also explicity run it via:
# run ESLint
npm run lint
# run ESLint with `--fix` option to automatically fix errors (if possible)
npm run lint:fix
Making a Release
Before publishing a release, make sure to have the lates changes from master and the changelog is up-to-date:
$ npm run changelog
This will print all changes since the previous release. For this to work, all PRs need to be correctly labeled as:
breaking(💥 Breaking Change)enhancement(🚀 Enhancement)bug(🐛 Bug Fix)documentation(📝 Documentation)internal(🏠 Internal)
Copy and prepend the new changes to CHANGELOG.md when you're about to make a release. Don't forget to update the version. Commit the updated changelog and run:
$ npm publish
to publish all changed packages to NPM. Pick the new version according to SemVer.
Contributing
Please see the CONTRIBUTING file for information on contributing to the AMP Project.
License
AMP Toolbox is made by the AMP Project, and is licensed under the Apache License, Version 2.0.
No vulnerabilities found.
Reason
no dangerous workflow patterns detected
Reason
no binaries found in the repo
Reason
license file detected
Details
- Info: project has a license file: LICENSE:0
- Info: FSF or OSI recognized license: Apache License 2.0: LICENSE:0
Reason
Found 13/19 approved changesets -- score normalized to 6
Reason
0 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 0
Reason
detected GitHub workflow tokens with excessive permissions
Details
- Warn: no topLevel permission defined: .github/workflows/CI.yml:1
- Info: no jobLevel write permissions found
Reason
no effort to earn an OpenSSF best practices badge detected
Reason
security policy file not detected
Details
- Warn: no security policy file detected
- Warn: no security file to analyze
- Warn: no security file to analyze
- Warn: no security file to analyze
Reason
project is not fuzzed
Details
- Warn: no fuzzer integrations found
Reason
dependency not pinned by hash detected -- score normalized to 0
Details
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/CI.yml:18: update your workflow using https://app.stepsecurity.io/secureworkflow/ampproject/amp-toolbox/CI.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/CI.yml:20: update your workflow using https://app.stepsecurity.io/secureworkflow/ampproject/amp-toolbox/CI.yml/main?enable=pin
- Warn: containerImage not pinned by hash: packages/optimizer-docker/Dockerfile:1: pin your Docker image by updating node:lts-alpine3.12 to node:lts-alpine3.12@sha256:c2ed3b2b36b726980474f8bf80025ca3a1aeb90c76286953f9f4b9b1dc3001b0
- Warn: npmCommand not pinned by hash: .github/workflows/CI.yml:26
- Info: 0 out of 2 GitHub-owned GitHubAction dependencies pinned
- Info: 0 out of 1 containerImage dependencies pinned
- Info: 0 out of 1 npmCommand dependencies pinned
Reason
SAST tool is not run on all commits -- score normalized to 0
Details
- Warn: 0 commits out of 27 are checked with a SAST tool
Reason
87 existing vulnerabilities detected
Details
- Warn: Project is vulnerable to: GHSA-8hc4-vh64-cxmj
- Warn: Project is vulnerable to: GHSA-qwcr-r2fm-qrc7
- Warn: Project is vulnerable to: GHSA-pxg6-pf52-xh8x
- Warn: Project is vulnerable to: GHSA-3xgq-45jj-v275
- Warn: Project is vulnerable to: GHSA-r7qp-cfhv-p84w
- Warn: Project is vulnerable to: GHSA-q9mw-68c2-j6m5
- Warn: Project is vulnerable to: GHSA-pfq8-rq6v-vf5m
- Warn: Project is vulnerable to: GHSA-xvf7-4v9q-58w6
- Warn: Project is vulnerable to: GHSA-rh63-9qcf-83gf
- Warn: Project is vulnerable to: GHSA-p6mc-m468-83gw
- Warn: Project is vulnerable to: GHSA-952p-6rrq-rcjv
- Warn: Project is vulnerable to: GHSA-qrpm-p2h7-hrv2
- Warn: Project is vulnerable to: GHSA-9wv6-86v2-598j
- Warn: Project is vulnerable to: GHSA-x565-32qp-m3vf
- Warn: Project is vulnerable to: GHSA-7fh5-64p2-3v2j
- Warn: Project is vulnerable to: GHSA-hwj9-h5mp-3pm3
- Warn: Project is vulnerable to: GHSA-566m-qj78-rww5
- Warn: Project is vulnerable to: GHSA-hrpp-h998-j3pp
- Warn: Project is vulnerable to: GHSA-p8p7-x288-28g6
- Warn: Project is vulnerable to: GHSA-gcx4-mw62-g8wm
- Warn: Project is vulnerable to: GHSA-c2qf-rxjj-qqgw
- Warn: Project is vulnerable to: GHSA-m6fv-jmcg-4jfg
- Warn: Project is vulnerable to: GHSA-25hc-qcg6-38wj
- Warn: Project is vulnerable to: GHSA-qm95-pgcg-qqfq
- Warn: Project is vulnerable to: GHSA-cqmj-92xf-r6r9
- Warn: Project is vulnerable to: GHSA-f5x3-32g6-xq36
- Warn: Project is vulnerable to: GHSA-4wf5-vphf-c2xc
- Warn: Project is vulnerable to: GHSA-29xr-v42j-r956
- Warn: Project is vulnerable to: GHSA-72xf-g2v4-qvf3
- Warn: Project is vulnerable to: GHSA-fhg7-m89q-25r3
- Warn: Project is vulnerable to: GHSA-3h5v-q93c-6h6q
- Warn: Project is vulnerable to: GHSA-776f-qx25-q3cc
- Warn: Project is vulnerable to: GHSA-93q8-gq69-wqmw
- Warn: Project is vulnerable to: GHSA-cph5-m8f7-6c5x
- Warn: Project is vulnerable to: GHSA-wf5p-g6vw-rhxx
- Warn: Project is vulnerable to: GHSA-74fj-2j2h-c42q
- Warn: Project is vulnerable to: GHSA-pw2r-vq6v-hr8c
- Warn: Project is vulnerable to: GHSA-jchw-25xp-jwwc
- Warn: Project is vulnerable to: GHSA-cxjh-pqwp-8mfp
- Warn: Project is vulnerable to: GHSA-pfrx-2q88-qq97
- Warn: Project is vulnerable to: GHSA-rc47-6667-2j5j
- Warn: Project is vulnerable to: GHSA-896r-f27r-55mw
- Warn: Project is vulnerable to: GHSA-f8q6-p94x-37v3
- Warn: Project is vulnerable to: GHSA-vh95-rmgr-6w4m / GHSA-xvch-5gv4-984h
- Warn: Project is vulnerable to: GHSA-r683-j2x4-v87g
- Warn: Project is vulnerable to: GHSA-px4h-xg32-q955
- Warn: Project is vulnerable to: GHSA-6fc8-4gx4-v693
- Warn: Project is vulnerable to: GHSA-rv95-896h-c2vc
- Warn: Project is vulnerable to: GHSA-qw6h-vgh9-j6wx
- Warn: Project is vulnerable to: GHSA-cm22-4g7w-348p
- Warn: Project is vulnerable to: GHSA-gxpj-cx7g-858c
- Warn: Project is vulnerable to: GHSA-2m96-9w4j-wgv7
- Warn: Project is vulnerable to: GHSA-h726-x36v-rx45
- Warn: Project is vulnerable to: GHSA-42xw-2xvc-qx8m
- Warn: Project is vulnerable to: GHSA-4w2v-q235-vp99
- Warn: Project is vulnerable to: GHSA-p28h-cc7q-c4fg
- Warn: Project is vulnerable to: GHSA-w7q9-p3jq-fmhm
- Warn: Project is vulnerable to: GHSA-jf85-cpcp-j695
- Warn: Project is vulnerable to: GHSA-29mw-wpgm-hmr9
- Warn: Project is vulnerable to: GHSA-35jh-r3h4-6jhm
- Warn: Project is vulnerable to: GHSA-rp65-9cf3-cjxr
- Warn: Project is vulnerable to: GHSA-w8qv-6jwh-64r5
- Warn: Project is vulnerable to: GHSA-257v-vj4p-3w2h
- Warn: Project is vulnerable to: GHSA-7gc6-qh9x-w6h8
- Warn: Project is vulnerable to: GHSA-62gr-4qp9-h98f
- Warn: Project is vulnerable to: GHSA-f52g-6jhx-586p
- Warn: Project is vulnerable to: GHSA-2cf5-4w76-r9qv
- Warn: Project is vulnerable to: GHSA-3cqr-58rm-57f8
- Warn: Project is vulnerable to: GHSA-g9r4-xpmj-mj65
- Warn: Project is vulnerable to: GHSA-q2c6-c6pm-g3gh
- Warn: Project is vulnerable to: GHSA-765h-qjxv-5f44
- Warn: Project is vulnerable to: GHSA-f2jv-r9rf-7988
- Warn: Project is vulnerable to: GHSA-7f5c-rpf4-86p8
- Warn: Project is vulnerable to: GHSA-7r28-3m3f-r2pr
- Warn: Project is vulnerable to: GHSA-r8j5-h5cx-65gg
- Warn: Project is vulnerable to: GHSA-w7rc-rwvf-8q5r
- Warn: Project is vulnerable to: GHSA-grv7-fg5c-xmjg
- Warn: Project is vulnerable to: GHSA-897m-rjf5-jp39
- Warn: Project is vulnerable to: GHSA-w573-4hg7-7wgq
- Warn: Project is vulnerable to: GHSA-4gmj-3p3h-gm8h
- Warn: Project is vulnerable to: GHSA-43f8-2h32-f4cj
- Warn: Project is vulnerable to: GHSA-qqgx-2p2h-9c37
- Warn: Project is vulnerable to: GHSA-hj48-42vr-x3v9
- Warn: Project is vulnerable to: GHSA-c4w7-xm78-47vh
- Warn: Project is vulnerable to: GHSA-p9pc-299p-vxgp
- Warn: Project is vulnerable to: GHSA-v88g-cgmw-v5xw
- Warn: Project is vulnerable to: GHSA-6vfc-qv3f-vr6c
Score
3.4
/10
Last Scanned on 2024-11-25
The Open Source Security Foundation is a cross-industry collaboration to improve the security of open source software (OSS). The Scorecard provides security health metrics for open source projects.
Learn More