Bi têkbirina pêvajoya berdana GitHub Actions di depoyên RedHatInsights ên Red Hat de, êrîşkar karîn 64 guhertoyên xerabkar ên 32 pakêtên NPM ji bo platforma Red Hat Cloud Services li navnîşana NPM biweşînin. Du guhertoyên xerabkar ên her pakêta NPM ya xeternak hatin berdan, her yek ji wan kodek dihewîne ku guhertoyek nû ya kurmê mini-shai-hulud çalak dike, ku di hawîrdora heyî de li nîşanekan û bawernameyan digere.
Kurm di pelê index.js de hat bicihkirin û bi rêya destgirekî pêş-sazkirinê ku dema sazkirina pakêtek vegirtî dihat gazîkirin hat çalakirin. Piştî ku hat çalakirin, kurm di pergalê de li nîşanekan ji bo NPM (~/.npmrc), PyPI, CircleCI, AWS, GCP, Docker, Azure, HashiCorp, û KubernetesK8s, û her weha mifteyên taybet ên SSH geriya. Daneyên ku dît ji êrîşkaran re hatin şandin. Ger nîşanek NPM hatiba dîtin, kurm bixweber berdanên nû yên zirardar ji bo pakêtên ku di hawîrdora heyî de têne pêşve xistin weşand, dara girêdayîbûnê enfeksiyon kir.
Gihîştina GitHub Actions bi rêya xerakirina hesabê karmendekî Red Hatê hat bidestxistin, ku rê da êrîşkaran ku rasterast commitan bişînin depoyên javascript-clients, frontend-components, û platform-frontend-ai-toolkit bêyî ku di pêvajoya nirxandinê re derbas bibin. Van commitan pelek ci.yaml xistin nav pergala entegrasyona domdar, ku dema ku avahiyek dimeşand, skrîptê _index.js bi karanîna platforma bun bicîh anî. Skrîptê destûra "id-token: write" bikar anî da ku ji GitHub tokenek OIDC (OpenID Connect) bixwaze, ku dûv re ji bo pejirandinê bi NPM re bi rêya mekanîzmaya "weşana pêbawer" hate bikar anîn.
Pakêtên NPM yên ku koda zirardar dihewînin:
- @redhat-cloud-services/chrome (2.3.1, 2.3.2)
- @redhat-cloud-services/compliance-client (4.0.3, 4.0.4)
- @redhat-cloud-services/config-manager-client (5.0.4, 5.0.5)
- @redhat-cloud-services/entitlements-client (4.0.11, 4.0.12)
- @xizmetên-ewr-redhat/xizmetên-ewr-redhat-ên-eslint (3.2.1, 3.2.2)
- @redhat-cloud-services/frontend-components (7.7.2, 7.7.3)
- @redhat-cloud-services/frontend-components-advisor-components (3.8.2)
- @redhat-cloud-services/frontend-components-config (6.11.3, 6.11.4)
- @redhat-cloud-services/frontend-components-config-utilities (4.11.2, 4.11.3)
- @redhat-ewr-servîs/pêkhateyên-pêş-agahdariyên-rûyê (6.9.2, 6.9.3)
- @redhat-cloud-services/frontend-components-remediations (4.9.2, 4.9.3)
- @redhat-ewr-xizmet/ceribandina-pêkhatên-pêşerojê (1.2.1, 1.2.2)
- @redhat-cloud-services/frontend-components-wergerandin (4.4.1, 4.4.2)
- @redhat-cloud-services/frontend-components-utilities (7.4.1, 7.4.2)
- @redhat-cloud-services/hcc-feo-mcp (0.3.1, 0.3.2)
- @redhat-cloud-services/hcc-kessel-mcp (0.3.1, 0.3.2)
- @redhat-cloud-services/hcc-pf-mcp (0.6.1, 0.6.2)
- @redhat-cloud-services/host-inventory-client (5.0.3, 5.0.4)
- @redhat-ewr-xizmet/insights-client (4.0.4, 4.0.5)
- @redhat-ewr-xizmet/entegrasyon-muwekîl (6.0.4, 6.0.5)
- @redhat-cloud-services/javascript-clients-shared (2.0.8, 2.0.9)
- @redhat-ewr-xizmet/notifications-client (6.1.4, 6.1.5)
- @redhat-cloud-services/patch-client (4.0.4, 4.0.5)
- @redhat-cloud-services/quickstarts-client (4.0.11, 4.0.12)
- @redhat-cloud-services/rbac-client (9.0.3, 9.0.4)
- @redhat-cloud-services/remediations-client (4.0.4, 4.0.5)
- @redhat-cloud-services/rule-components (4.7.2, 4.7.3)
- @redhat-ewr-xizmet/çavkanî-muwekîl (3.0.10, 3.0.11)
- @redhat-cloud-services/topological-inventory-client (3.0.10, 3.0.11)
- @redhat-cloud-services/tsc-transform-imports (1.2.2)
- @redhat-cloud-services/types (3.6.1, 3.6.2, 3.6.4)
- @redhat-cloud-services/vulnerabilities-client (2.1.8, 2.1.9)
Source: opennet.ru
