Installations
npm install @mcfed/business-componentsDeveloper Guide
Typescript
Yes
Module System
CommonJS
Node Version
10.0.0
NPM Version
5.6.0
Score
35.7
Supply Chain
71.2
Quality
75.6
Maintenance
50
Vulnerability
94.8
License
Releases
Contributors
Unable to fetch Contributors
Languages
JavaScript (84.78%)
Less (10.76%)
TypeScript (3.84%)
Dockerfile (0.44%)
CSS (0.19%)
Love this project? Help keep it running — sponsor us today! 🚀
Developer
mcfed
Download Statistics
Total Downloads
1,819
Last Day
1
Last Week
4
Last Month
16
Last Year
229
GitHub Statistics
61 Commits
4 Watchers
5 Branches
4 Contributors
Updated on Aug 17, 2021
Maintainers
Package Meta Information
Latest Version
0.1.9
Package Id
@mcfed/business-components@0.1.9
Unpacked Size
297.46 kB
Size
58.84 kB
File Count
110
NPM Version
5.6.0
Node Version
10.0.0
Total Downloads
Cumulative downloads
Total Downloads
1,819
Last Day
0%
1
Compared to previous day
Last Week
300%
4
Compared to previous week
Last Month
-59%
16
Compared to previous month
Last Year
-23.2%
229
Compared to previous year
Daily Downloads
Weekly Downloads
Monthly Downloads
Yearly Downloads
Dependencies
23
Dev Dependencies
38
Optional Dependencies
1
useage
当前版本已发布 npm 仓库
- 运行命令安装包
npm install @mcfed/business-components
develop 规范要求
-
创建新功能分支来源master统一采用feature/组件英文名称上进行代码开发，开发完成后提交merge_request,合并成功后owner将删除当前分支 -
修改BUG分支来源master统一采用hotfix/已有组件英文名称上进行代码开发，开发完成后提交merge_request合并成功后owner将删除当前分支 -
master与develop不允许直接提交，统一采用 branch 开发后，提交merge_request到develop请求合并代码审核。 -
CI 单元测试能过后才能提交代码合并请求，未通过一概不允许合并
-
合并请求时请 清楚描述 修改内容
add : 新增XXX组件 -
合并请求描述规范格式要求：
ADD:新增XXX组件、MODIFY:XXX组件增加单元测试、BUGFIXED:修改 XXX 组件 YYY bug -
合并 master 规范：
master禁止提交代码，只允许来源develop内容 -
合并 发布版本内容 在
develop分支工作- 修改 changelogs.md 文件 将发布描述版本内容
- 修改 version 号 配置，防止合并到
master后发起发布失败(已发布版本号不允许二次发布) - 合并将要发布的版本内容合并
- 提交
meger_request到master在master合并 CI 自动发版成功
组件规范
- 新增组件源码位于
src目录下，组件采用大驼峰（UpperCamel）命名，以组件名作为目录名，如./src/FormItem/。 - 新增组件目录必须包含 style 用于样式分包。
- 单元测试目录 tests, storybook 目录 stories, 如有需要符合目录规范
- 组件目录下必须具有
index入口文件，入口文件必须具有default导出 - 组建目录下必须具有 style 文件夹 若有需要添加样式 则在 style/index.js/ts 中引入
- 当一个组件目录下存在多个待导出组件时，采用
ComponentA.ComponentB的形式导出非默认组件 - 组件样式可使用下面的样式分包使用或直接引入 dist/style.css 或 dist/style.less 中的全部样式（同 antd 样式用法）
使用说明
请移步至这里
样式分包使用
- 使用 babel-plugin-import
- 配置
1 loader:'babel-loader', 2 options:{ 3 plugins:[ 4 "import",{ 5 libraryName:'@mcf/components', 6 libraryDirectory:"lib", 7 camel2DashComponentName:false, 8 style:true 9 },"@mcf/components" 10 ] 11 } 12
No vulnerabilities found.
Reason
no dangerous workflow patterns detected
Reason
no binaries found in the repo
Reason
Found 2/19 approved changesets -- score normalized to 1
Reason
0 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0
Reason
detected GitHub workflow tokens with excessive permissions
Details
- Warn: no topLevel permission defined: .github/workflows/create_release.yml:1
- Warn: no topLevel permission defined: .github/workflows/npm-publish.yml:1
- Info: no jobLevel write permissions found
Reason
no effort to earn an OpenSSF best practices badge detected
Reason
security policy file not detected
Details
- Warn: no security policy file detected
- Warn: no security file to analyze
- Warn: no security file to analyze
- Warn: no security file to analyze
Reason
license file not detected
Details
- Warn: project does not have a license file
Reason
project is not fuzzed
Details
- Warn: no fuzzer integrations found
Reason
dependency not pinned by hash detected -- score normalized to 0
Details
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/create_release.yml:12: update your workflow using https://app.stepsecurity.io/secureworkflow/mcfed/businessComponents/create_release.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/create_release.yml:15: update your workflow using https://app.stepsecurity.io/secureworkflow/mcfed/businessComponents/create_release.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/npm-publish.yml:12: update your workflow using https://app.stepsecurity.io/secureworkflow/mcfed/businessComponents/npm-publish.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/npm-publish.yml:14: update your workflow using https://app.stepsecurity.io/secureworkflow/mcfed/businessComponents/npm-publish.yml/master?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/npm-publish.yml:24: update your workflow using https://app.stepsecurity.io/secureworkflow/mcfed/businessComponents/npm-publish.yml/master?enable=pin
- Warn: containerImage not pinned by hash: .devcontainer/Dockerfile:5: pin your Docker image by updating mhart/alpine-node:12.18.3 to mhart/alpine-node:12.18.3@sha256:5786e9ce414c01502aa760ad44f76d0e3da09b5629dda176573d959faffcceb2
- Warn: npmCommand not pinned by hash: .github/workflows/npm-publish.yml:19
- Info: 0 out of 4 GitHub-owned GitHubAction dependencies pinned
- Info: 0 out of 1 third-party GitHubAction dependencies pinned
- Info: 0 out of 1 containerImage dependencies pinned
- Info: 0 out of 1 npmCommand dependencies pinned
Reason
SAST tool is not run on all commits -- score normalized to 0
Details
- Warn: 0 commits out of 13 are checked with a SAST tool
Reason
56 existing vulnerabilities detected
Details
- Warn: Project is vulnerable to: GHSA-67hx-6x53-jw92
- Warn: Project is vulnerable to: GHSA-93q8-gq69-wqmw
- Warn: Project is vulnerable to: GHSA-fwr7-v2mv-hh25
- Warn: Project is vulnerable to: GHSA-cwfw-4gq5-mrqx
- Warn: Project is vulnerable to: GHSA-g95f-p29q-9xw4
- Warn: Project is vulnerable to: GHSA-grv7-fg5c-xmjg
- Warn: Project is vulnerable to: GHSA-w8qv-6jwh-64r5
- Warn: Project is vulnerable to: GHSA-7gc6-qh9x-w6h8
- Warn: Project is vulnerable to: GHSA-3xgq-45jj-v275
- Warn: Project is vulnerable to: GHSA-q8pj-2vqx-8ggc
- Warn: Project is vulnerable to: GHSA-w573-4hg7-7wgq
- Warn: Project is vulnerable to: GHSA-ff7x-qrg7-qggm
- Warn: Project is vulnerable to: GHSA-phwq-j96m-2c2q
- Warn: Project is vulnerable to: GHSA-ghr5-ch3p-vcr6
- Warn: Project is vulnerable to: GHSA-9gqr-xp86-f87h
- Warn: Project is vulnerable to: GHSA-765h-qjxv-5f44
- Warn: Project is vulnerable to: GHSA-f2jv-r9rf-7988
- Warn: Project is vulnerable to: GHSA-43f8-2h32-f4cj
- Warn: Project is vulnerable to: GHSA-896r-f27r-55mw
- Warn: Project is vulnerable to: GHSA-9c47-m6qq-7p4h
- Warn: Project is vulnerable to: GHSA-p6mc-m468-83gw
- Warn: Project is vulnerable to: GHSA-29mw-wpgm-hmr9
- Warn: Project is vulnerable to: GHSA-35jh-r3h4-6jhm
- Warn: Project is vulnerable to: GHSA-4xcv-9jjx-gfj3
- Warn: Project is vulnerable to: GHSA-7wpw-2hjm-89gp
- Warn: Project is vulnerable to: GHSA-952p-6rrq-rcjv
- Warn: Project is vulnerable to: GHSA-wrvr-8mpx-r7pp
- Warn: Project is vulnerable to: GHSA-2m53-83f3-562j
- Warn: Project is vulnerable to: GHSA-fm93-fhh2-cg2c
- Warn: Project is vulnerable to: GHSA-f8q6-p94x-37v3
- Warn: Project is vulnerable to: GHSA-xvch-5gv4-984h
- Warn: Project is vulnerable to: GHSA-8hfj-j24r-96c4
- Warn: Project is vulnerable to: GHSA-wc69-rhjr-hc9g
- Warn: Project is vulnerable to: GHSA-r683-j2x4-v87g
- Warn: Project is vulnerable to: GHSA-w7rc-rwvf-8q5r
- Warn: Project is vulnerable to: GHSA-5fw9-fq32-wv5p
- Warn: Project is vulnerable to: GHSA-rp65-9cf3-cjxr
- Warn: Project is vulnerable to: GHSA-hj48-42vr-x3v9
- Warn: Project is vulnerable to: GHSA-9wv6-86v2-598j
- Warn: Project is vulnerable to: GHSA-hrpp-h998-j3pp
- Warn: Project is vulnerable to: GHSA-p8p7-x288-28g6
- Warn: Project is vulnerable to: GHSA-gcx4-mw62-g8wm
- Warn: Project is vulnerable to: GHSA-c2qf-rxjj-qqgw
- Warn: Project is vulnerable to: GHSA-3f95-r44v-8mrg
- Warn: Project is vulnerable to: GHSA-28xr-mwxg-3qc8
- Warn: Project is vulnerable to: GHSA-9p95-fxvg-qgq2
- Warn: Project is vulnerable to: GHSA-9w5j-4mwv-2wj8
- Warn: Project is vulnerable to: GHSA-jgrx-mgxx-jf9v
- Warn: Project is vulnerable to: GHSA-72xf-g2v4-qvf3
- Warn: Project is vulnerable to: GHSA-7p7h-4mm5-852v
- Warn: Project is vulnerable to: GHSA-38fc-wpqx-33j7
- Warn: Project is vulnerable to: GHSA-fhg7-m89q-25r3
- Warn: Project is vulnerable to: GHSA-j8xg-fqg3-53r7
- Warn: Project is vulnerable to: GHSA-6fc8-4gx4-v693
- Warn: Project is vulnerable to: GHSA-3h5v-q93c-6h6q
- Warn: Project is vulnerable to: GHSA-p9pc-299p-vxgp
Score
2.5
/10
Last Scanned on 2025-02-17
The Open Source Security Foundation is a cross-industry collaboration to improve the security of open source software (OSS). The Scorecard provides security health metrics for open source projects.
Learn More