Installations
npm install ja
Developer Guide
Typescript
No
Module System
CommonJS
Node Version
12.16.3
NPM Version
6.14.4
Score
52.1
Supply Chain
97
Quality
75.3
Maintenance
100
Vulnerability
99.6
License
Releases
Unable to fetch releases
Contributors
Unable to fetch Contributors
Languages
JavaScript (100%)
Developer
Download Statistics
Total Downloads
4,844
Last Day
2
Last Week
13
Last Month
56
Last Year
1,069
GitHub Statistics
2 Stars
47 Commits
1 Watching
15 Branches
1 Contributors
Bundle Size
10.41 kB
Minified
4.17 kB
Minified + Gzipped
Package Meta Information
Latest Version
1.2.0
Package Id
ja@1.2.0
Unpacked Size
18.37 kB
Size
6.77 kB
File Count
16
NPM Version
6.14.4
Node Version
12.16.3
Total Downloads
Cumulative downloads
Total Downloads
4,844
Last day
100%
2
Compared to previous day
Last week
-27.8%
13
Compared to previous week
Last month
-64.3%
56
Compared to previous month
Last year
36.9%
1,069
Compared to previous year
Daily Downloads
Weekly Downloads
Monthly Downloads
Yearly Downloads
Introduction
A tiny utility for copying a file from a remote repo into the current one.
Think of it as curl
for Github.
- Supports public/private Github as well as Github Enterprise
- Lightweight
- Descriptive error messages
Use case
Every repo has a few boilerplate files that can be recycled in other repos as is. For example:
.editorconfig
.gitignore
.github/issue_template.md
.github/pull_request_template.md
.eslintrc
.eslintignore
jest.config.js
...
Usually these are copy/pasted as needed but then if the source file changes, all these copies need to be updated as well.
Bugs reproduce by copy/paste and take shelter in human errors. So if you have to copy/paste, at least automate it.
curl
does the job for public Github repos, but what about the private/enterprise ones? Besides, if there is more than one file that needs to be copied, that knowledge needs to live somewhere.- some people use a monorepo to avoid this duplication and deal with
lerna
or other tools - some even use git submodules
Say hello to ja: it stands for just add!
Usage
# You can install it globally
$ npm i -g ja
# Then run it in the destination repo
$ ja
# You can also run it with npx
$ npx ja
It reads its config from a text file named .ja
in the root of the destination repo.
Each line states the source and optionally the destination.
Example:
# Copy the .gitignore from a remote folder to this one
https://github.com/userpixel/micromustache/blob/master/.gitignore
# Copy the issue template to the .github folder
https://github.com/userpixel/micromustache/blob/master/.github/ISSUE_TEMPLATE.md > .github/ISSUE_TEMPLATE.md
When you run ja
:
- It'll look for its config file (
.ja
) in the same directory (it'll exit with an error if it cannot find it). - It parses the config, and validates it.
- It tries to figure out the "raw" address for each source URL. For example if the source URL looks like
https://github.com/userpixel/ja/blob/master/README.md
, it'll try to fetch it fromhttps://raw.githubusercontent.com/userpixel/ja/master/README.md
- If there was no problem fetching the file, it write the file.
- If the destination folder doesn't exist, it creates it
- If you already have the destination file, it'll rewrite it. No file permission will be changed. You can see the diff using
git diff
orgit status
. If the overwritten file has exactly the same content, git doesn't consider them to be changed - Obviously if the fetch step fails, it will not write any files.
- Currently
ja
only supports utf-8 format
Commit all your changes before running ja
because it'll overwrite the local files.
Config file
The config file is named .ja
:
- Each line simply contains a URL and a optionally a relative local file path (separated by
>
). - Currently you need to specify each file explicitly. It's not possible to fetch a whole directory like
.github
. - The local file path is relative to the current directory where the
.ja
file is located and cannot point to a parent directory. - For security reasons no absolute path is allowed.
- For security reasons the local file name cannot point to any directory that is the parent of the directory where the
.ja
file is located. - Empty lines and lines beginning with
#
will be ignored.
Token
If the source is a Github Enterprise or a private repository, you'll need a token.
ja
expects the token in an environment variable named after the host name of the source URL.
For example the token for fetching a file from a private repo on github.com
, should be in the GITHUB_COM_TOKEN
environment variable.
If your Github Enterprise is hosted under github.companyname.io
, the env var is GITHUB_COMPANYNAME_IO_TOKEN
.
There are many ways to pass an environment variable to an application:
- You can put the token in an
.env
file next to your.ja
file (ja
reads./.env
). This is the smoothest method, plus is localizes the knowledge about the token to the repo that uses it. - You can put the token in your
~/.bashrc
(Linux) or~/.bash_profile
(Mac) - You can pass the token directly when running
ja
like this:GITHUB_COM_TOKEN=328948kksjkafhdskjf ja
(note that this will leave a trace in your terminal history. In Bash you can start the command with one space to skip adding it to the history)
Generating a token
This is a one-time process:
- Click on your github profile and go to Settings > Developer settings > Personal access tokens and click Generate new token
- Give your token a name and for the scope, only choose public_repo (that's all that is needed)
- Press the Generate token button. Put this token where
ja
can find it. Make sure to copy your token to a safe place because it's the last time you see it (don't worry you can always go there and make a new one)
Test
We use Jest.
# Install dependencies and run all tests
$ npm it
Debug
We use Debug.
Run the CLI showing debug info:
$ DEBUG=* node cli/ja.js
License
MIT
Made in Sweden 🇸🇪 by @alexewerlof
No vulnerabilities found.
Reason
no binaries found in the repo
Reason
license file detected
Details
- Info: project has a license file: LICENSE.md:0
- Info: FSF or OSI recognized license: MIT License: LICENSE.md:0
Reason
0 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0
Reason
Found 0/9 approved changesets -- score normalized to 0
Reason
no effort to earn an OpenSSF best practices badge detected
Reason
security policy file not detected
Details
- Warn: no security policy file detected
- Warn: no security file to analyze
- Warn: no security file to analyze
- Warn: no security file to analyze
Reason
project is not fuzzed
Details
- Warn: no fuzzer integrations found
Reason
branch protection not enabled on development/release branches
Details
- Warn: branch protection not enabled for branch 'master'
Reason
SAST tool is not run on all commits -- score normalized to 0
Details
- Warn: 0 commits out of 22 are checked with a SAST tool
Reason
26 existing vulnerabilities detected
Details
- Warn: Project is vulnerable to: GHSA-67hx-6x53-jw92
- Warn: Project is vulnerable to: GHSA-93q8-gq69-wqmw
- Warn: Project is vulnerable to: GHSA-grv7-fg5c-xmjg
- Warn: Project is vulnerable to: GHSA-3xgq-45jj-v275
- Warn: Project is vulnerable to: GHSA-gxpj-cx7g-858c
- Warn: Project is vulnerable to: GHSA-w573-4hg7-7wgq
- Warn: Project is vulnerable to: GHSA-43f8-2h32-f4cj
- Warn: Project is vulnerable to: GHSA-896r-f27r-55mw
- Warn: Project is vulnerable to: GHSA-9c47-m6qq-7p4h
- Warn: Project is vulnerable to: GHSA-29mw-wpgm-hmr9
- Warn: Project is vulnerable to: GHSA-35jh-r3h4-6jhm
- Warn: Project is vulnerable to: GHSA-952p-6rrq-rcjv
- Warn: Project is vulnerable to: GHSA-f8q6-p94x-37v3
- Warn: Project is vulnerable to: GHSA-xvch-5gv4-984h
- Warn: Project is vulnerable to: GHSA-r683-j2x4-v87g
- Warn: Project is vulnerable to: GHSA-5fw9-fq32-wv5p
- Warn: Project is vulnerable to: GHSA-hj48-42vr-x3v9
- Warn: Project is vulnerable to: GHSA-hrpp-h998-j3pp
- Warn: Project is vulnerable to: GHSA-p8p7-x288-28g6
- Warn: Project is vulnerable to: GHSA-c2qf-rxjj-qqgw
- Warn: Project is vulnerable to: GHSA-jgrx-mgxx-jf9v
- Warn: Project is vulnerable to: GHSA-72xf-g2v4-qvf3
- Warn: Project is vulnerable to: GHSA-j8xg-fqg3-53r7
- Warn: Project is vulnerable to: GHSA-6fc8-4gx4-v693
- Warn: Project is vulnerable to: GHSA-3h5v-q93c-6h6q
- Warn: Project is vulnerable to: GHSA-c4w7-xm78-47vh
Score
1.7
/10
Last Scanned on 2024-12-16
The Open Source Security Foundation is a cross-industry collaboration to improve the security of open source software (OSS). The Scorecard provides security health metrics for open source projects.
Learn More