Skip to content

Commit 24d7b79

Browse files
detaindetain
authored
Merge branch 'Kong:master' into master
2 parents 5e22552 + 5b4474d commit 24d7b79

107 files changed

Lines changed: 1995 additions & 370 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.github/workflows/build.yml‎

Lines changed: 57 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,22 +1,45 @@
1-
name: Build
1+
name: Build and Publish Httpsnippet
22

33
on:
44
push:
55
branches:
66
- master
7+
tags:
8+
- '*' # Restrict any specific tag formats
79
pull_request:
810
types:
911
- opened
1012
- synchronize
1113
workflow_dispatch:
1214

1315
jobs:
16+
scan:
17+
permissions:
18+
packages: write
19+
contents: write # publish sbom to GH releases/tag assets
20+
runs-on: ubuntu-latest
21+
steps:
22+
- name: Checkout branch
23+
uses: actions/checkout@v3
24+
with:
25+
path: ${{ github.repository }}
26+
27+
# Perform SCA analysis for the code repository
28+
# Produces SBOM and CVE report
29+
# Helps understand vulnerabilities / license compliance across third party dependencies
30+
- id: sca-project
31+
uses: Kong/public-shared-actions/security-actions/sca@2f02738ecb1670f01391162e43fe3f5d4e7942a1 # v2.2.2
32+
with:
33+
dir: ${{ github.repository }}
34+
upload-sbom-release-assets: true
35+
1436
build:
37+
needs: [scan]
1538
runs-on: ubuntu-latest
1639
strategy:
1740
fail-fast: false
1841
matrix:
19-
node-version: [16, 18]
42+
node-version: [16, 18, 20]
2043
steps:
2144
- name: Checkout branch
2245
uses: actions/checkout@v3
@@ -37,3 +60,35 @@ jobs:
3760

3861
- name: Build
3962
run: npm run build
63+
64+
publish:
65+
runs-on: ubuntu-latest
66+
permissions:
67+
contents: write
68+
id-token: write # For using token to sign images
69+
actions: read # For getting workflow run info to build provenance
70+
packages: write # Required for publishing provenance. Issue: https://github.com/slsa-framework/slsa-github-generator/tree/main/internal/builders/container#known-issues
71+
if: ${{ github.ref_type == 'tag' && github.repository_owner == 'Kong' }}
72+
steps:
73+
# checkout tag
74+
- name: Checkout code
75+
uses: actions/checkout@v4
76+
with:
77+
fetch-depth: 0
78+
79+
- name: Setup Node.js
80+
uses: actions/setup-node@v4
81+
with:
82+
node-version: 20.9.0
83+
registry-url: 'https://registry.npmjs.org'
84+
85+
- name: Install
86+
run: npm ci
87+
88+
- name: Build
89+
run: npm run build
90+
91+
- name: Publish to NPM
92+
run: npm publish --no-git-checks --provenance --tag ${{ github.sha }}
93+
env:
94+
NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

‎.github/workflows/release.yml‎

Lines changed: 58 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,58 @@
1+
name: Release httpsnippet
2+
3+
on:
4+
workflow_dispatch:
5+
inputs:
6+
version:
7+
description: 'Tag version to release'
8+
required: true
9+
10+
env:
11+
# Release Tag to build and publish
12+
TAG: ${{ github.event.inputs.version }}
13+
14+
jobs:
15+
release:
16+
runs-on: ubuntu-latest
17+
steps:
18+
- name: Checkout code
19+
uses: actions/checkout@v4
20+
with:
21+
fetch-depth: 0
22+
token: ${{ secrets.PAT_INSOMNIA_INFRA }}
23+
24+
- name: Configure Git user
25+
uses: Homebrew/actions/git-user-config@master
26+
with:
27+
username: ${{ (github.event_name == 'workflow_dispatch' && github.actor) || 'insomnia-infra' }}
28+
29+
- name: Setup Node
30+
uses: actions/setup-node@v4
31+
with:
32+
node-version: 20
33+
34+
- name: Install
35+
run: npm ci
36+
37+
- name: Create new package version
38+
run: npm version "${{ env.TAG }}"
39+
40+
- name: DEBUG see tags
41+
run: |
42+
git tag --list
43+
git remote -v
44+
45+
- name: Merge version commit into master
46+
run: |
47+
git push origin v${{ env.TAG }}
48+
git push origin master
49+
50+
- name: Create Tag and Release
51+
uses: ncipollo/release-action@v1
52+
id: core_tag_and_release
53+
with:
54+
tag: v${{ env.TAG }}
55+
name: 'httpsnippet v${{ env.TAG }} 📦'
56+
generateReleaseNotes: true
57+
prerelease: false
58+
draft: false

‎.github/workflows/sast.yml‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
name: SAST
2+
3+
on:
4+
pull_request: {}
5+
push:
6+
branches:
7+
- master
8+
workflow_dispatch: {}
9+
10+
jobs:
11+
semgrep:
12+
name: Semgrep SAST
13+
runs-on: ubuntu-latest
14+
permissions:
15+
# required for all workflows
16+
security-events: write
17+
# only required for workflows in private repositories
18+
actions: read
19+
contents: read
20+
21+
if: (github.actor != 'dependabot[bot]')
22+
23+
steps:
24+
- uses: actions/checkout@v4
25+
- uses: Kong/public-shared-actions/security-actions/semgrep@bd3d75259607dd015bea3b3313123f53b80e9d7f

‎.nvmrc‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
20

‎README.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22

33
[![version][npm-version]][npm-url] [![License][npm-license]][license-url]
44

5-
> HTTP Request snippet generator for _many_ languages & tools including: `cURL`, `HTTPie`, `JavaScript`, `Node`, `C`, `Java`, `PHP`, `Objective-C`, `Swift`, `Python`, `Ruby`, `C#`, `Go`, `OCaml` and [more](https://github.com/Kong/httpsnippet/wiki/Targets)!
5+
> HTTP Request snippet generator for _many_ languages & tools including: `cURL`, `HTTPie`, `JavaScript`, `Node`, `C`, `Java`, `PHP`, `Objective-C`, `Swift`, `Python`, `Ruby`, `C#`, `Go`, `OCaml`, `Crystal` and [more](https://github.com/Kong/httpsnippet/wiki/Targets)!
66
77
Relies on the popular [HAR](http://www.softwareishard.com/blog/har-12-spec/#request) format to import data and describe HTTP calls.
88

‎SECURITY.md‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
# Security Policy
2+
3+
## Reporting a Vulnerability
4+
5+
At HTTPSnippet, we take security issues very seriously. If you believe you have found a security vulnerability in our project, we encourage you to disclose it responsibly. Please report any potential security vulnerabilities to us by sending an email to [[email protected]](mailto:[email protected]).
6+
7+
## How to Report
8+
9+
1. **Do not publicly disclose the vulnerability**: Please do not create a GitHub issue or post the vulnerability on public forums. Instead, contact us directly at [[email protected]](mailto:[email protected]).
10+
1. **Provide detailed information**: When reporting a vulnerability, please include as much information as possible to help us understand and reproduce the issue. This may include:
11+
- Description of the vulnerability
12+
- Steps to reproduce the issue
13+
- Potential impact
14+
- Any relevant logs or screenshots
15+
16+
## What to Expect
17+
18+
- **Acknowledgment**: We will acknowledge receipt of your vulnerability report within 48 hours.
19+
- **Investigation**: Our security team will investigate the report and will keep you informed of the progress. We aim to resolve critical vulnerabilities within 30 days of confirmation.
20+
- **Disclosure**: We prefer coordinated disclosure and will work with you to schedule the disclosure of the vulnerability in a way that minimizes the risk to users.
21+
22+
## Bug Bounty Program
23+
24+
We encourage security researchers to participate in our bug bounty program as outlined on the [Kong Vulnerability Disclosure](https://konghq.com/compliance/bug-bounty) page. This program provides rewards for discovering and reporting security vulnerabilities in accordance with our disclosure guidelines.
25+
26+
Thank you for helping to keep HTTPSnippet secure.
27+
28+
For more information on our security policies and guidelines, please visit the [Kong Vulnerability Disclosure](https://konghq.com/compliance/bug-bounty) page.
29+
30+
## Contact
31+
32+
For any questions or further assistance, please contact us at [[email protected]](mailto:[email protected]).

0 commit comments

Comments
 (0)