Poolside, a startup creating artificial intelligence to write software, is in talks to raise a new round of funding that would give it a $3 billion valuation even before releasing an initial product, according to people familiar with the deal.

AI Startup Poolside Nears $3 Billion Valuation to Rival Microsoft’s GitHub - Bloomberg

Contribute to huggingface/cosmopedia development by creating an account on GitHub.

GitHub - huggingface/cosmopedia

A modern dashboard exploit for the original Microsoft Xbox. - XboxDev/endgame-exploit

GitHub - XboxDev/endgame-exploit: A modern dashboard exploit for the original Microsoft Xbox.

Contribute to carlini/yet-another-applied-llm-benchmark development by creating an account on GitHub.

GitHub - carlini/yet-another-applied-llm-benchmark

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Farewell to the .NET Foundation · AvaloniaUI/Avalonia · Discussion #14666

Blazingly 🔥 fast 🚀 memory vulnerabilities, written in 100% safe Rust. 🦀 - Speykious/cve-rs

GitHub - Speykious/cve-rs: Blazingly 🔥 fast 🚀 memory vulnerabilities, written in 100% safe Rust. 🦀

An extremely fast Python package installer and resolver, written in Rust. - astral-sh/uv

GitHub - astral-sh/uv: An extremely fast Python package installer and resolver, written in Rust.

I-SOON/Anxun leak related stuff. Contribute to soufianetahiri/Anxun-isoon development by creating an account on GitHub.

GitHub - soufianetahiri/Anxun-isoon: I-SOON/Anxun leak related stuff

Contribute to LargeWorldModel/LWM development by creating an account on GitHub.

GitHub - LargeWorldModel/LWM

Minimal, clean, code for the Byte Pair Encoding (BPE) algorithm commonly used in LLM tokenization. - karpathy/minbpe

GitHub - karpathy/minbpe: Minimal, clean, code for the Byte Pair Encoding (BPE) algorithm commonly used in LLM tokenization.

GitHub

github

Fetch Commits Like a Pro With This Rust Meets GitHub Guide

Hello JavaScript Enthusiasts! Welcome to another edition of "This Week in JavaScript"! Today, we’ll be looking at the State of JavaScript 2024 report, unpacking Tailwind CSS 4 updates that’ll make your styles fly, and serving up fresh tools to streamline your dev grind. Oh, and did we mention that GitHub Copilot is now free? Buckle up! The Rise of TypeScript The State of JavaScript 2024 survey results are in, and TypeScript is officially dominating the JavaScript landscape. 67% of developers now use TypeScript more than traditional JavaScript. Type safety, better tooling, and cleaner code are driving its widespread adoption.
Vite is leading the pack when it comes to build tools, with developers loving its simplicity and speed over older tools like webpack. It’s clear that while JavaScript itself remains stable, TypeScript and modern build tools like Vite are shaping the future of how we build apps. GitHub Copilot is now Free GitHub has made a major move by offering its Copilot AI for free—well, with a few limits. If you have a GitHub account, you can now access 2,000 code completions and 50 chat messages per month, all within Visual Studio Code and GitHub. Here's how you can take advantage of it: Speed up your coding: Copilot offers AI-driven code completion that saves time and effort.
Multi-file edits: Easily make edits across multiple files.
Model options: Choose from models like Anthropic’s Claude 3.5 Sonnet for tailored results.
Copilot Chat: Ask questions, generate code snippets, and get real-time help with your codebase. This new offering is amazing for streamlining your workflow and boosting productivity. New Tailwind CSS 4 Developments We’ve already talked about the Tailwind CSS 4 Beta Release before, but you need to know about these features! Lightning CSS: Tailwind has moved to Lightning CSS, which speeds up builds and reduces the need for PostCSS configurations.
CSS-first configuration: With native CSS variables for theming, styling has become more streamlined, although you might miss the type safety from the JavaScript-based config.
Descendant Variants: A new double-star feature lets you style elements deep in the hierarchy. However, while this might help with CMS content, it could bring back maintainability challenges.
Radial and Conic Gradients: The new gradients are great but come with complex syntax, better suited for design systems than HTML.
Class Name Changes: Class names like grow (instead of flex-grow) are making tools like Tailwind Merge less efficient. While there’s a lot to love about the new update, be mindful of potential pitfalls with maintainability! Tools & Releases YOU Should Know About Now, let’s take a quick look at the latest tools and updates that can boost your workflow: JerryScript 3.0: A super lightweight JavaScript engine for IoT with 84% Test262 compliance. It introduces ES2020 features like optional chaining and dynamic imports—great for embedded systems.
Transformers.js v3.2: Bringing machine learning to the browser! Features include real-time speech recognition with Moonshine, image analysis with Phi-3.5 Vision, and bilingual text generation with EXAONE. Perfect for integrating AI directly into web projects.
Bun 1.1.39 & 1.1.40: With bun.lock for better tooling compatibility, 30% faster cached installations, and WebSocket improvements, Bun keeps optimizing the JavaScript ecosystem.
pnpm Update: The pnpm link command now adds dependency overrides to package.json, simplifying global and workspace linking. SHA256 hashing has been introduced, improving security.
ESLint v9.17.0: A major update! The no-unused-vars rule now auto-fixes unused variables, and crashes from nullish values are resolved. This update will keep your codebase cleaner and more efficient. If you found these JavaScript updates useful, give this post an upvote to help others discover it. Don’t forget to share it with your fellow developers, and keep an eye out for more insights in the JavaScript world. Until next time, keep coding and stay curious! Hello JavaScript Enthusiasts! Welcome to another edition of " This Week in JavaScript "! This Week in JavaScript Today, we’ll be looking at the State of JavaScript 2024 report, unpacking Tailwind CSS 4 updates that’ll make your styles fly, and serving up fresh tools to streamline your dev grind. Oh, and did we mention that GitHub Copilot is now free? Buckle up! The Rise of TypeScript The Rise of TypeScript The State of JavaScript 2024 survey results are in, and TypeScript is officially dominating the JavaScript landscape. The State of JavaScript 2024 TypeScript 67% of developers now use TypeScript more than traditional JavaScript. Type safety, better tooling, and cleaner code are driving its widespread adoption. Vite is leading the pack when it comes to build tools, with developers loving its simplicity and speed over older tools like webpack. 67% of developers now use TypeScript more than traditional JavaScript. Type safety, better tooling, and cleaner code are driving its widespread adoption. 67% of developers Vite is leading the pack when it comes to build tools, with developers loving its simplicity and speed over older tools like webpack. Vite It’s clear that while JavaScript itself remains stable, TypeScript and modern build tools like Vite are shaping the future of how we build apps. GitHub Copilot is now Free GitHub Copilot is now Free GitHub has made a major move by offering its Copilot AI for free —well, with a few limits. If you have a GitHub account, you can now access 2,000 code completions and 50 chat messages per month, all within Visual Studio Code and GitHub. GitHub Copilot AI free Here's how you can take advantage of it: Speed up your coding: Copilot offers AI-driven code completion that saves time and effort. Multi-file edits: Easily make edits across multiple files. Model options: Choose from models like Anthropic’s Claude 3.5 Sonnet for tailored results. Copilot Chat: Ask questions, generate code snippets, and get real-time help with your codebase. Speed up your coding: Copilot offers AI-driven code completion that saves time and effort. Speed up your coding: Multi-file edits: Easily make edits across multiple files. Multi-file edits: Model options: Choose from models like Anthropic’s Claude 3.5 Sonnet for tailored results. Model options: Copilot Chat: Ask questions, generate code snippets, and get real-time help with your codebase. Copilot Chat: This new offering is amazing for streamlining your workflow and boosting productivity. New Tailwind CSS 4 Developments New Tailwind CSS 4 Developments We’ve already talked about the Tailwind CSS 4 Beta Release before, but you need to know about these features! Tailwind CSS 4 Beta Release Lightning CSS: Tailwind has moved to Lightning CSS, which speeds up builds and reduces the need for PostCSS configurations. CSS-first configuration: With native CSS variables for theming, styling has become more streamlined, although you might miss the type safety from the JavaScript-based config. Descendant Variants: A new double-star feature lets you style elements deep in the hierarchy. However, while this might help with CMS content, it could bring back maintainability challenges. Radial and Conic Gradients: The new gradients are great but come with complex syntax, better suited for design systems than HTML. Class Name Changes: Class names like grow (instead of flex-grow) are making tools like Tailwind Merge less efficient. Lightning CSS: Tailwind has moved to Lightning CSS, which speeds up builds and reduces the need for PostCSS configurations. Lightning CSS: CSS-first configuration: With native CSS variables for theming, styling has become more streamlined, although you might miss the type safety from the JavaScript-based config. CSS-first configuration: Descendant Variants: A new double-star feature lets you style elements deep in the hierarchy. However, while this might help with CMS content, it could bring back maintainability challenges. Descendant Variants: Radial and Conic Gradients: The new gradients are great but come with complex syntax, better suited for design systems than HTML. Radial and Conic Gradients: Class Name Changes: Class names like grow (instead of flex-grow) are making tools like Tailwind Merge less efficient. Class Name Changes: While there’s a lot to love about the new update, be mindful of potential pitfalls with maintainability! Tools & Releases YOU Should Know About Tools & Releases YOU Should Know About Now, let’s take a quick look at the latest tools and updates that can boost your workflow: JerryScript 3.0: A super lightweight JavaScript engine for IoT with 84% Test262 compliance. It introduces ES2020 features like optional chaining and dynamic imports—great for embedded systems. Transformers.js v3.2: Bringing machine learning to the browser! Features include real-time speech recognition with Moonshine, image analysis with Phi-3.5 Vision, and bilingual text generation with EXAONE. Perfect for integrating AI directly into web projects. Bun 1.1.39 & 1.1.40: With bun.lock for better tooling compatibility, 30% faster cached installations, and WebSocket improvements, Bun keeps optimizing the JavaScript ecosystem. pnpm Update: The pnpm link command now adds dependency overrides to package.json, simplifying global and workspace linking. SHA256 hashing has been introduced, improving security. ESLint v9.17.0: A major update! The no-unused-vars rule now auto-fixes unused variables, and crashes from nullish values are resolved. This update will keep your codebase cleaner and more efficient. JerryScript 3.0: A super lightweight JavaScript engine for IoT with 84% Test262 compliance. It introduces ES2020 features like optional chaining and dynamic imports—great for embedded systems. JerryScript 3.0: Transformers.js v3.2: Bringing machine learning to the browser! Features include real-time speech recognition with Moonshine, image analysis with Phi-3.5 Vision, and bilingual text generation with EXAONE. Perfect for integrating AI directly into web projects. Transformers.js v3.2: Bun 1.1.39 & 1.1.40: With bun.lock for better tooling compatibility, 30% faster cached installations, and WebSocket improvements, Bun keeps optimizing the JavaScript ecosystem. Bun 1.1.39 & 1.1.40: pnpm Update: The pnpm link command now adds dependency overrides to package.json, simplifying global and workspace linking. SHA256 hashing has been introduced, improving security. pnpm Update: ESLint v9.17.0: A major update! The no-unused-vars rule now auto-fixes unused variables, and crashes from nullish values are resolved. This update will keep your codebase cleaner and more efficient. ESLint v9.17.0: If you found these JavaScript updates useful, give this post an upvote to help others discover it. Don’t forget to share it with your fellow developers, and keep an eye out for more insights in the JavaScript world. Until next time, keep coding and stay curious!

December Brings Free GitHub Copilot

How to Automatically Publish Your NPM Package Using GitHub Actions

Hoe om u NPM-pakket outomaties met GitHub-aksies te publiseer

Jak automaticky publikovat svůj balíček NPM pomocí akcí GitHub

Cómo publicar automáticamente su paquete NPM mediante GitHub Actions

Como publicar automaticamente o teu paquete NPM usando accións de GitHub

Ինչպես ավտոմատ կերպով հրապարակել ձեր NPM փաթեթը՝ օգտագործելով GitHub գործողությունները

Come pubblicare automaticamente il tuo pacchetto NPM utilizzando le azioni GitHub

כיצד לפרסם באופן אוטומטי את חבילת ה-NPM שלך באמצעות פעולות GitHub

GitHub Actions を使用して NPM パッケージを自動的に公開する方法

Cara Menerbitkan Pakej NPM Anda Secara Automatik Menggunakan Tindakan GitHub

Como publicar automaticamente seu pacote NPM usando ações do GitHub

Ako automaticky publikovať svoj balík NPM pomocou akcií GitHub

Hur du automatiskt publicerar ditt NPM-paket med hjälp av GitHub-åtgärder

While GitHub is primarily known for version control and hosting code, it also hides some of the best resources for tech jobs and internships. I manually curated 9 of my favorite repositories with amazing career opportunities, divided across categories and with application links for each. From software engineering roles to AI-focused internships, remote jobs, and open-source opportunities, both beginners and seasoned devs are welcome! I hope that this article will be useful for you to land your dream job or secure an internship role! Wishing you the best of luck in your tech career journey! 1. Summer Internships 2025 ⭐ GitHub stars: 35.2K+ A curated list of computer science, software, tech, and quant internships for Summer 2025, updated collaboratively by the community. 👉 https://github.com/SimplifyJobs/Summer2025-Internships Who is it for: College students and recent graduates in technical fields seeking internship opportunities across various companies. How to apply: Browse the list, identify roles of interest, and follow the application links provided for each opportunity. 2. Open Source Internships Programs ⭐ GitHub stars: 3.8K+ A comprehensive directory of open-source internship programs, with timeline, eligibility, stipend, and tech stack focus details. 👉 https://github.com/deepanshu1422/List-Of-Open-Source-Internships-Programs Who is it for: Beginners and seasoned developers interested in contributing to open-source projects and gaining industry experience. How to apply: Check the deadlines and program details listed, and follow the official application instructions provided for each program. 3. SWE College Jobs 2025 ⭐ GitHub stars: 1.8K+ A collection of software engineering internships and new graduate positions. Daily updated roles for both the US and international scope. 👉 https://github.com/speedyapply/2025-SWE-College-Jobs Who is it for: Perfect for students pursuing computer science or related degrees looking for hands-on software engineering roles. How to apply: Use the provided apply links and follow the instructions to submit your application for the role. 4. AI College Jobs 2025 ⭐ GitHub stars: 400+ A dedicated list of artificial intelligence, machine learning, and data science jobs. Available roles for both the US and internationally, and updated daily. 👉 https://github.com/speedyapply/2025-AI-College-Jobs Who is it for: Well suited for college students interested in AI technologies and looking for internships in this growing field. How to apply: Find the company and niche of your interest and follow the direct application links for AI internship positions. 5. Remote Jobs ⭐ GitHub stars: 30K+ A comprehensive list of remote-friendly companies that offer tech roles globally. 👉 https://github.com/remoteintech/remote-jobs Who is it for: Developers, designers, and other tech professionals of various experience levels looking for fully remote job opportunities. How to apply: Explore the companies to read more about their tech stacks, size, and mission, and apply via the links provided. 6. Tech Jobs with Relocation ⭐ GitHub stars: 3.2K+ A collection of tech jobs and internships that offer relocation support, helping you find roles in cities or countries of your choice. 👉 https://github.com/AndrewStetsenko/tech-jobs-with-relocation Who is it for: Professionals open to moving internationally for tech roles, looking to expand their horizons, and seeking new adventures. How to apply: Follow the links to company career pages, and apply directly for relevant roles. Also, lots of valuable info about work permits, visas, etc. 7. Easy Application ⭐ GitHub stars: 7.8K+ A collection of job applications that require minimal to apply. This lets candidates focus on their application, rather than meticulously fill out lengthy forms. 👉 https://github.com/j-delaney/easy-application Who is it for: Job seekers who prefer simple application processes by uploading their resume and experience straight-forward UX. How to apply: Leverage the provided links to the company career pages. 8. Hiring Without Whiteboards ⭐ GitHub stars: 46.4K+ A directory of companies that evaluate technical candidates through non-traditional methods, often avoiding whiteboard interviews. 👉 https://github.com/poteto/hiring-without-whiteboards Who is it for: Developers who value practical coding challenges and real-world problem-solving over theoretical interviews. How to apply: Use the list to find companies, read more about their interview process, and follow their specific application guidelines. 9. Community Writer Programs ⭐ GitHub stars: 3.9K+ A list of programs that reward technical writers for creating content, including blog posts in the IT field, tech reviews, and tutorials. 👉 https://github.com/malgamves/CommunityWriterPrograms Who is it for: Developers and writers looking to earn money and recognition through technical writing by sharing their expertise and insights. How to apply: Select a program, read the guidelines, and submit content proposals directly. You might be required to provide a blog link or sample work. Did You Like The Resources? Here Is More 👇 Join 6000+ others to receive the best DEV resources, tools, productivity tips, and career growth advice I discover by subscribing to my newsletter! Also, connect with me on Twitter, LinkedIn, and GitHub! Writing has always been my passion and it gives me pleasure to help and inspire people. If you want to get featured or partner up, feel free to get in touch! Also published here. While GitHub is primarily known for version control and hosting code, it also hides some of the best resources for tech jobs and internships. I manually curated 9 of my favorite repositories with amazing career opportunities, divided across categories and with application links for each. From software engineering roles to AI-focused internships, remote jobs, and open-source opportunities, both beginners and seasoned devs are welcome! I hope that this article will be useful for you to land your dream job or secure an internship role! Wishing you the best of luck in your tech career journey! 1. Summer Internships 2025 Summer Internships 2025 ⭐ GitHub stars: 35.2K+ ⭐ GitHub stars: 35.2K+ A curated list of computer science, software, tech, and quant internships for Summer 2025, updated collaboratively by the community. 👉 https://github.com/SimplifyJobs/Summer2025-Internships https://github.com/SimplifyJobs/Summer2025-Internships Who is it for: College students and recent graduates in technical fields seeking internship opportunities across various companies. Who is it for: How to apply: Browse the list, identify roles of interest, and follow the application links provided for each opportunity. How to apply: 2. Open Source Internships Programs Open Source Internships Programs ⭐ GitHub stars: 3.8K+ ⭐ GitHub stars: 3.8K+ A comprehensive directory of open-source internship programs, with timeline, eligibility, stipend, and tech stack focus details. 👉 https://github.com/deepanshu1422/List-Of-Open-Source-Internships-Programs https://github.com/deepanshu1422/List-Of-Open-Source-Internships-Programs Who is it for: Beginners and seasoned developers interested in contributing to open-source projects and gaining industry experience. Who is it for: How to apply: Check the deadlines and program details listed, and follow the official application instructions provided for each program. How to apply: 3. SWE College Jobs 2025 SWE College Jobs 2025 ⭐ GitHub stars: 1.8K+ ⭐ GitHub stars: 1.8K+ A collection of software engineering internships and new graduate positions. Daily updated roles for both the US and international scope. 👉 https://github.com/speedyapply/2025-SWE-College-Jobs https://github.com/speedyapply/2025-SWE-College-Jobs Who is it for: Perfect for students pursuing computer science or related degrees looking for hands-on software engineering roles. Who is it for: How to apply: Use the provided apply links and follow the instructions to submit your application for the role. How to apply: 4. AI College Jobs 2025 AI College Jobs 2025 ⭐ GitHub stars: 400+ ⭐ GitHub stars: 400+ A dedicated list of artificial intelligence, machine learning, and data science jobs. Available roles for both the US and internationally, and updated daily. 👉 https://github.com/speedyapply/2025-AI-College-Jobs https://github.com/speedyapply/2025-AI-College-Jobs Who is it for: Well suited for college students interested in AI technologies and looking for internships in this growing field. Who is it for: How to apply: Find the company and niche of your interest and follow the direct application links for AI internship positions. How to apply: 5. Remote Jobs Remote Jobs ⭐ GitHub stars: 30K+ ⭐ GitHub stars: 30K+ A comprehensive list of remote-friendly companies that offer tech roles globally. 👉 https://github.com/remoteintech/remote-jobs https://github.com/remoteintech/remote-jobs Who is it for: Developers, designers, and other tech professionals of various experience levels looking for fully remote job opportunities. Who is it for: How to apply: Explore the companies to read more about their tech stacks, size, and mission, and apply via the links provided. How to apply: 6. Tech Jobs with Relocation Tech Jobs with Relocation ⭐ GitHub stars: 3.2K+ ⭐ GitHub stars: 3.2K+ A collection of tech jobs and internships that offer relocation support, helping you find roles in cities or countries of your choice. 👉 https://github.com/AndrewStetsenko/tech-jobs-with-relocation https://github.com/AndrewStetsenko/tech-jobs-with-relocation Who is it for: Professionals open to moving internationally for tech roles, looking to expand their horizons, and seeking new adventures. Who is it for: How to apply: Follow the links to company career pages, and apply directly for relevant roles. Also, lots of valuable info about work permits, visas, etc. How to apply: 7. Easy Application Easy Application ⭐ GitHub stars: 7.8K+ ⭐ GitHub stars: 7.8K+ A collection of job applications that require minimal to apply. This lets candidates focus on their application, rather than meticulously fill out lengthy forms. 👉 https://github.com/j-delaney/easy-application https://github.com/j-delaney/easy-application Who is it for: Job seekers who prefer simple application processes by uploading their resume and experience straight-forward UX. Who is it for: How to apply: Leverage the provided links to the company career pages. How to apply: 8. Hiring Without Whiteboards Hiring Without Whiteboards ⭐ GitHub stars: 46.4K+ ⭐ GitHub stars: 46.4K+ A directory of companies that evaluate technical candidates through non-traditional methods, often avoiding whiteboard interviews. 👉 https://github.com/poteto/hiring-without-whiteboards https://github.com/poteto/hiring-without-whiteboards Who is it for: Developers who value practical coding challenges and real-world problem-solving over theoretical interviews. Who is it for: How to apply: Use the list to find companies, read more about their interview process, and follow their specific application guidelines. How to apply: 9. Community Writer Programs Community Writer Programs ⭐ GitHub stars: 3.9K+ ⭐ GitHub stars: 3.9K+ A list of programs that reward technical writers for creating content, including blog posts in the IT field, tech reviews, and tutorials. 👉 https://github.com/malgamves/CommunityWriterPrograms https://github.com/malgamves/CommunityWriterPrograms Who is it for: Developers and writers looking to earn money and recognition through technical writing by sharing their expertise and insights. Who is it for: How to apply: Select a program, read the guidelines, and submit content proposals directly. You might be required to provide a blog link or sample work. How to apply: Did You Like The Resources? Here Is More 👇 Join 6000+ others to receive the best DEV resources, tools, productivity tips, and career growth advice I discover by subscribing to my newsletter! my newsletter ! my newsletter Also, connect with me on Twitter , LinkedIn , and GitHub ! Twitter Twitter LinkedIn LinkedIn GitHub GitHub Writing has always been my passion and it gives me pleasure to help and inspire people. If you want to get featured or partner up, feel free to get in touch ! get in touch get in touch Also published here . here

How to Find a Job or Internship in Tech With These 9 GitHub Repositories (2025 Guide)📚🔥

এই 9টি গিটহাব রিপোজিটরি (2025 গাইড) 📚🔥 দিয়ে কীভাবে প্রযুক্তিতে চাকরি বা ইন্টার্নশিপ খুঁজে পাবেন

So finden Sie mit diesen 9 GitHub-Repositories einen Job oder ein Praktikum im technischen Bereich (Leitfaden 2025)📚🔥

Cómo encontrar un trabajo o una pasantía en tecnología con estos 9 repositorios de GitHub (guía 2025)📚🔥

Comment trouver un emploi ou un stage dans le domaine des technologies avec ces 9 référentiels GitHub (Guide 2025)📚🔥

इन 9 GitHub रिपॉजिटरी के साथ टेक में नौकरी या इंटर्नशिप कैसे खोजें (2025 गाइड)📚🔥

9 つの GitHub リポジトリを使ってテクノロジー分野の仕事やインターンシップを見つける方法 (2025 年ガイド)📚🔥

이 9개의 GitHub 저장소로 기술 분야에서 일자리나 인턴십을 찾는 방법(2025년 가이드)📚🔥

Como encontrar um emprego ou estágio em tecnologia com estes 9 repositórios do GitHub (guia 2025)📚🔥

Как найти работу или стажировку в сфере технологий с помощью этих 9 репозиториев GitHub (руководство 2025 года)📚🔥

Bu 9 GitHub Deposuyla Teknoloji Alanında İş veya Staj Nasıl Bulunur (2025 Rehberi)📚🔥

Cách tìm việc làm hoặc thực tập trong lĩnh vực công nghệ với 9 kho lưu trữ GitHub này (Hướng dẫn năm 2025)📚🔥

如何利用这 9 个 GitHub 存储库找到技术工作或实习机会（2025 年指南）📚🔥

How to Learn Web Development: HTML, CSS, MERN, and Python - 22 GitHub Repositories to Help You

Recently, I haven’t been updating my open-source articles as frequently — not because I’ve stopped writing, but because the progress on open-source commercialization has been great, and the endless task of drafting proposals has consumed my time. As a native open-source commercial company, WhaleOps employs mostly engineers. Asking these open-source contributors to write proposals wastes their development time, and their proposals don’t always meet the quality standard. Unlike managing in a big company, being a startup CEO means stepping into any role the company needs. After every strategic meeting, I’m the first to roll up my sleeves and tackle the most urgent tasks. As a result, I haven’t had time to write articles, as my limited time is mostly taken up with creating proposals that follow the formal template style. Especially recently, with one bid after another, I’ve found myself questioning my sanity. The existing large models can’t solve my problem, so I’ll build my own As a tech person, I always look to tools to solve my problems. Naturally, I thought of large models, but they can’t fully grasp the nuances of our products and often produce unreliable outputs. Plus, you’re the one delivering the work, not the model. So, I decided to develop a tool for proposal generation based on large models using Python and a compatible large model (compatible with ChatGPT). This tool automatically generates a proposal from your product documentation, breaking down product manuals into feature points. Based on a human-created mapping of these points to the requirements, it generates a Word version of the proposal and an Excel deviation table. The model can condense or expand content or simply copy relevant functionality as needed. Features of the open-source proposal tool The functionality of this tool is simple, with the most challenging part being the Word formatting (formatting in Word is always a pain). I experimented with several methods to make sure it follows the correct Title 1, Title 2, Title 3, body text, table, and image formats in the Word template. Staying true to the open-source spirit, I’ve uploaded the tool to my personal GitHub under an Apache License, so feel free to use it if you need. Here’s what it does: Get it here: https://github.com/William-GuoWei/ProposalLLM Breaks down your product manual into a set of reusable detail documents, reducing the need to repeatedly reference the source document when drafting a proposal. You can also customize specific functionality (the default file name is “Template.docx”).
Based on the requirements table filled in by a person, it automatically generates a proposal in a point-to-point response format, including all headings and content, with the correct Title 1, 2, 3 formatting, and automatically organizes body text, images, and bullet points (the default requirements table is “requirements_table.xlsx,” and the generated content is in “proposal_content.docx”).
For any product requirements in the corresponding functionality section, it automatically copies the product manual content into the point-to-point response section, retaining images, tables, and bullet points. You can also rewrite the product description to suit different proposal needs. If there’s no matching functionality, the model automatically generates relevant content (review and modify as needed).
Completes the technical requirements deviation table by automatically filling in responses in the “requirements_table.xlsx,” with responses formatted as “Answer: Fully supports, {Model-generated text based on project requirements}” and includes the section number corresponding to the proposal. With this tool, you can quickly modify and generate proposals at will. Proposal generation process Start by running Extract_Word.py to generate your product feature points as a Word document, then run Generate.py. If a feature point is missing, you can enter “X” in the Excel file, and the model will generate content that meets the requirements. However, I strongly recommend a manual review. After generation, you’ll see the proposal formatted with a table of contents, body text, images, tables, and bullet points, all automatically organized. The entire proposal is structured according to the client’s requirements in sequential format, with subheadings, content, images, and point-to-point responses. This takes care of all the repetitive work. The automatically generated deviation table includes everything, whether the content was generated by the model or not, along with the corresponding section numbers. You only need to finalize the deviation table with “&” symbols based on the final requirements — the model has written it all for you. For me, this tool has reduced what used to be 8 hours of work to around 30 minutes, and even our business team can generate the business proposal sections using the template. In total, this has cut down our time for a week-long proposal to 1–2 days, reducing the manpower required by 80%. How to use it? First, download all the code to a single directory from GitHub at https://github.com/William-GuoWei/ProposalLLM: Proposal Large Model (Chinese version). Install the Python environment and packages: pip install openpyxl, docx, openai, requests, docx, python-docx.
Apply for a ChatGPT or Baidu Qianfan large model key (I used ERNIE-Speed-8K, which is free), record the token, and place it in the relevant code section.
Copy your product manual to Template.docx. Be sure to use the body text, Title 1, Title 2, and Title 3 styles provided; other formats may cause issues.
Run Extract_Word.py to generate the feature point document from the product manual (supports up to 3 heading levels). If the list formatting appears off, don’t worry; the final format will align properly.
Fill in Columns B and C (which will generate secondary and tertiary headings automatically) and Column G (the corresponding product manual chapter). If a chapter is missing, enter “X.” Note that if there is no corresponding chapter or an “X” is entered, the model will generate content automatically.
Review the “proposal_content.docx” document and keep the chapter for which you want to start generating the proposal. You can modify the body text and heading 1, 2, and 3 styles; just don’t rename the styles, or there may be errors.
Adjust the parameters in Generate.py: API_KEY and SECRET_KEY: Baidu Cloud large model keys.
MAX_WIDTH_CM: Maximum image width; images larger than this will be resized automatically.
The prompts for generating content have been customized for large data scenarios, but feel free to modify them.
MoreSection=1 will read Column C to generate detailed tertiary headings (default is on).
ReGenerateText=0 will re-generate text content automatically for different proposal needs (default is off).
DDDAnswer=1 generates the point-to-point response content at the top of each feature point (default is on).
key_flag=1 adds the importance level of each requirement to the proposal headings (default is on).
last_heading_1=2 specifies the starting chapter for the technical solution in “proposal_content.docx.” 8. Run Generate.py. Summary With this tool, you only need to check the product features against the proposal requirements, and most of the proposal content is generated automatically. The business proposal section can also be generated similarly, so creating a 1,000-page proposal now only takes a few minutes. Recently, I haven’t been updating my open-source articles as frequently — not because I’ve stopped writing, but because the progress on open-source commercialization has been great, and the endless task of drafting proposals has consumed my time. As a native open-source commercial company, WhaleOps employs mostly engineers. Asking these open-source contributors to write proposals wastes their development time, and their proposals don’t always meet the quality standard. Unlike managing in a big company, being a startup CEO means stepping into any role the company needs. After every strategic meeting, I’m the first to roll up my sleeves and tackle the most urgent tasks. As a result, I haven’t had time to write articles, as my limited time is mostly taken up with creating proposals that follow the formal template style. Especially recently, with one bid after another, I’ve found myself questioning my sanity. The existing large models can’t solve my problem, so I’ll build my own As a tech person, I always look to tools to solve my problems. Naturally, I thought of large models, but they can’t fully grasp the nuances of our products and often produce unreliable outputs. Plus, you’re the one delivering the work, not the model. So, I decided to develop a tool for proposal generation based on large models using Python and a compatible large model (compatible with ChatGPT). This tool automatically generates a proposal from your product documentation, breaking down product manuals into feature points. Based on a human-created mapping of these points to the requirements, it generates a Word version of the proposal and an Excel deviation table. The model can condense or expand content or simply copy relevant functionality as needed. Features of the open-source proposal tool The functionality of this tool is simple, with the most challenging part being the Word formatting (formatting in Word is always a pain). I experimented with several methods to make sure it follows the correct Title 1, Title 2, Title 3, body text, table, and image formats in the Word template. Staying true to the open-source spirit, I’ve uploaded the tool to my personal GitHub under an Apache License, so feel free to use it if you need. Here’s what it does: Get it here: https://github.com/William-GuoWei/ProposalLLM Get it here: https://github.com/William-GuoWei/ProposalLLM https://github.com/William-GuoWei/ProposalLLM Breaks down your product manual into a set of reusable detail documents, reducing the need to repeatedly reference the source document when drafting a proposal. You can also customize specific functionality (the default file name is “Template.docx”). Based on the requirements table filled in by a person, it automatically generates a proposal in a point-to-point response format, including all headings and content, with the correct Title 1, 2, 3 formatting, and automatically organizes body text, images, and bullet points (the default requirements table is “requirements_table.xlsx,” and the generated content is in “proposal_content.docx”). For any product requirements in the corresponding functionality section, it automatically copies the product manual content into the point-to-point response section, retaining images, tables, and bullet points. You can also rewrite the product description to suit different proposal needs. If there’s no matching functionality, the model automatically generates relevant content (review and modify as needed). Completes the technical requirements deviation table by automatically filling in responses in the “requirements_table.xlsx,” with responses formatted as “Answer: Fully supports, {Model-generated text based on project requirements}” and includes the section number corresponding to the proposal. Breaks down your product manual into a set of reusable detail documents, reducing the need to repeatedly reference the source document when drafting a proposal. You can also customize specific functionality (the default file name is “Template.docx”). Based on the requirements table filled in by a person, it automatically generates a proposal in a point-to-point response format, including all headings and content, with the correct Title 1, 2, 3 formatting, and automatically organizes body text, images, and bullet points (the default requirements table is “requirements_table.xlsx,” and the generated content is in “proposal_content.docx”). For any product requirements in the corresponding functionality section, it automatically copies the product manual content into the point-to-point response section, retaining images, tables, and bullet points. You can also rewrite the product description to suit different proposal needs. If there’s no matching functionality, the model automatically generates relevant content (review and modify as needed). Completes the technical requirements deviation table by automatically filling in responses in the “requirements_table.xlsx,” with responses formatted as “Answer: Fully supports, {Model-generated text based on project requirements}” and includes the section number corresponding to the proposal. With this tool, you can quickly modify and generate proposals at will. Proposal generation process Start by running Extract_Word.py to generate your product feature points as a Word document, then run Generate.py . If a feature point is missing, you can enter “X” in the Excel file, and the model will generate content that meets the requirements. However, I strongly recommend a manual review. After generation, you’ll see the proposal formatted with a table of contents, body text, images, tables, and bullet points, all automatically organized. Extract_Word.py Generate.py The entire proposal is structured according to the client’s requirements in sequential format, with subheadings, content, images, and point-to-point responses. This takes care of all the repetitive work. The automatically generated deviation table includes everything, whether the content was generated by the model or not, along with the corresponding section numbers. You only need to finalize the deviation table with “&” symbols based on the final requirements — the model has written it all for you. For me, this tool has reduced what used to be 8 hours of work to around 30 minutes, and even our business team can generate the business proposal sections using the template. In total, this has cut down our time for a week-long proposal to 1–2 days, reducing the manpower required by 80%. How to use it? First, download all the code to a single directory from GitHub at https://github.com/William-GuoWei/ProposalLLM : Proposal Large Model (Chinese version). https://github.com/William-GuoWei/ProposalLLM Install the Python environment and packages: pip install openpyxl, docx, openai, requests, docx, python-docx. Apply for a ChatGPT or Baidu Qianfan large model key (I used ERNIE-Speed-8K, which is free), record the token, and place it in the relevant code section. Copy your product manual to Template.docx. Be sure to use the body text, Title 1, Title 2, and Title 3 styles provided; other formats may cause issues. Run Extract_Word.py to generate the feature point document from the product manual (supports up to 3 heading levels). If the list formatting appears off, don’t worry; the final format will align properly. Fill in Columns B and C (which will generate secondary and tertiary headings automatically) and Column G (the corresponding product manual chapter). If a chapter is missing, enter “X.” Note that if there is no corresponding chapter or an “X” is entered, the model will generate content automatically. Review the “proposal_content.docx” document and keep the chapter for which you want to start generating the proposal. You can modify the body text and heading 1, 2, and 3 styles; just don’t rename the styles, or there may be errors. Adjust the parameters in Generate.py: Install the Python environment and packages: pip install openpyxl, docx, openai, requests, docx, python-docx . pip install openpyxl, docx, openai, requests, docx, python-docx Apply for a ChatGPT or Baidu Qianfan large model key (I used ERNIE-Speed-8K, which is free), record the token, and place it in the relevant code section. Copy your product manual to Template.docx . Be sure to use the body text, Title 1, Title 2, and Title 3 styles provided; other formats may cause issues. Template.docx Run Extract_Word.py to generate the feature point document from the product manual (supports up to 3 heading levels). If the list formatting appears off, don’t worry; the final format will align properly. Extract_Word.py Fill in Columns B and C (which will generate secondary and tertiary headings automatically) and Column G (the corresponding product manual chapter). If a chapter is missing, enter “X.” Note that if there is no corresponding chapter or an “X” is entered, the model will generate content automatically. Review the “proposal_content.docx” document and keep the chapter for which you want to start generating the proposal. You can modify the body text and heading 1, 2, and 3 styles; just don’t rename the styles, or there may be errors. Adjust the parameters in Generate.py : Generate.py API_KEY and SECRET_KEY: Baidu Cloud large model keys. MAX_WIDTH_CM: Maximum image width; images larger than this will be resized automatically. The prompts for generating content have been customized for large data scenarios, but feel free to modify them. MoreSection=1 will read Column C to generate detailed tertiary headings (default is on). ReGenerateText=0 will re-generate text content automatically for different proposal needs (default is off). DDDAnswer=1 generates the point-to-point response content at the top of each feature point (default is on). key_flag=1 adds the importance level of each requirement to the proposal headings (default is on). last_heading_1=2 specifies the starting chapter for the technical solution in “proposal_content.docx.” API_KEY and SECRET_KEY : Baidu Cloud large model keys. API_KEY SECRET_KEY MAX_WIDTH_CM : Maximum image width; images larger than this will be resized automatically. MAX_WIDTH_CM The prompts for generating content have been customized for large data scenarios, but feel free to modify them. MoreSection=1 will read Column C to generate detailed tertiary headings (default is on). MoreSection=1 ReGenerateText=0 will re-generate text content automatically for different proposal needs (default is off). ReGenerateText=0 DDDAnswer=1 generates the point-to-point response content at the top of each feature point (default is on). DDDAnswer=1 key_flag=1 adds the importance level of each requirement to the proposal headings (default is on). key_flag=1 last_heading_1=2 specifies the starting chapter for the technical solution in “proposal_content.docx.” last_heading_1=2 8. Run Generate.py . Generate.py Summary With this tool, you only need to check the product features against the proposal requirements, and most of the proposal content is generated automatically. The business proposal section can also be generated similarly, so creating a 1,000-page proposal now only takes a few minutes.

I Built An Automatic Proposal Generation Large Language Model and Open-Sourced It on GitHub

Orchestrating Airflow DAGs with GitHub Actions - A Lightweight Approach to Data Curation Across Spa

 A Deep Dive Into GitHub Actions From Software Development to Data Engineering

In December 2023, it was discovered that an NPM package commonly used by decentralized web applications (dApps) had been compromised. The package in question, @ledgerhq/connect-kit, is maintained by Ledger, a well-known and arguably the most trusted provider of secure hardware wallets. Ironic right? Well, not really, because the compromised package has nothing to do with the ledger's secure hardware wallets. However, the incident understandably raised concerns among users about the security of their assets, despite those assets being stored offline in hardware wallets. While the compromised package posed no immediate threat to Ledger's hardware devices, the situation sparked widespread discussion and speculation. The prevailing theory suggests that the compromise occurred due to a vulnerability in Ledger’s GitHub workflow. It is believed that an attacker exploited a GitHub pull request workflow to gain access to Ledger's NPM keys, enabling them to publish malicious code. The malicious update reportedly caused a secondary window to open when users attempted to connect their wallets. The Experiment The incident piqued my curiosity, prompting me to question whether GitHub workflows were inherently flawed or if there was more nuance to the exploit. To explore this, I conducted an experiment to see if I could replicate the vulnerability. Using an existing open-source repository, I attempted to recreate the exploit. During my testing, I discovered that: 1. A pull request can edit a workflow and the new workflow will run immediately after the pull request is made The screenshot below displays the contents of a pipeline.yml file from the repository I was working with. The pipeline is configured to trigger every push to the main branch, deploying the serverless application to AWS. I proceeded by creating a new branch within the repository and modifying the pipeline file. The updated configuration was set to trigger the workflow on every pull request, regardless of the branch. The screenshot below illustrates the modified state of the file. Along with these modifications, I added an instruction to print the AWS_REGION GitHub secret, which was already present in the repository. I expected to see the value displayed in the workflow logs after the action was executed successfully. I then submitted a pull request to the main branch with these changes, and as expected, the modified workflow was triggered and executed successfully, even though the pull request had not been reviewed, approved, or merged! Interesting. As seen in the screenshot above, the workflows triggered by my pull request were executed successfully. You might notice there are two workflow runs displayed, which I will address in the next section. For now, let's focus on the workflow labeled "test: modified GitHub workflows" at the bottom. Once the workflow was completed, I reviewed the logs, and as expected, the AWS_REGION GitHub secret was masked, as shown in the following image. This outcome was anticipated, as I had previously encountered a similar article detailing this kind of exploit, which informed my approach to this experiment. Now, if the secrets were concealed, how did the attacker manage to access them? This question led to my second key finding: 2. GitHub secrets can be exposed by making curl requests to third-party APIs within a modified workflow Yeah, you read that right! To test this, I further edited the workflow to include a request to a RequestBin I created on Pipedream. The screenshot below illustrates the updated workflow. This explains the second workflow run shown in the earlier screenshot, confirming that both workflows were executed successfully. On Pipedream's RequestBin, I was able to view the GitHub "secret" in plain text. This raised a concerning question: could anyone simply submit a pull request to an open-source project and easily access sensitive keys? Securing Your Workflows Given the potential vulnerabilities uncovered during this experiment, it’s crucial to understand how to secure GitHub workflows to prevent unauthorized access to sensitive data. GitHub provides several settings that can be configured to reduce the risk of exploitation: Actions permissions setting:
By default, all actions are permitted to run, regardless of the author. For enhanced security, this setting should be updated to limit permissions, ensuring that only trusted workflows can execute.


Fork pull-request workflows from outside collaborators setting:
This setting defines which outside collaborators require approval to run workflows in pull requests. Properly configuring this setting is critical, as misconfiguration could expose your repository to potential exploits. Additionally, GitHub’s documentation notes that workflows triggered from forks do not have access to sensitive data like secrets. This emphasizes the importance of reviewing the settings for repositories where sensitive data is handled. By implementing these security measures, repositories can significantly reduce the likelihood of similar vulnerabilities being exploited. Possible Explanations for the Exploit Taking all of the above factors into consideration, if the rumors are accurate and Ledger's NPM secrets were indeed compromised, a few scenarios might explain how this occurred: CASE #1: The package maintainers overlooked the configuration settings and allowed the compromised workflows to run.
CASE #2: The attacker somehow obtained full write access to the repository.
CASE #3: The attacker is, or was, a previous contributor to the project.
CASE #4: The exploit was carried out as an inside job. My Analysis Upon reviewing these scenarios, I believe that CASE #3 is the most plausible explanation. A previous contributor may not need explicit approval to trigger workflows in the repository, making it easier to exploit this vulnerability. I have seen various discussions on social media suggesting that a former employee’s account might have been compromised, which would support CASE #3. However, until an official statement is released by Ledger, the exact cause remains speculative. Final Thoughts Through this experiment, I gained a deeper understanding of how workflow vulnerabilities can be exploited and how developers can protect their repositories from such threats. By implementing the recommended security settings and thoroughly reviewing contributor permissions, open-source maintainers can minimize the risk of unauthorized access. In December 2023, it was discovered that an NPM package commonly used by decentralized web applications (dApps) had been compromised. The package in question, @ledgerhq/connect-kit , is maintained by Ledger, a well-known and arguably the most trusted provider of secure hardware wallets. Ironic right? @ledgerhq/connect-kit Well, not really, because the compromised package has nothing to do with the ledger's secure hardware wallets. However, the incident understandably raised concerns among users about the security of their assets, despite those assets being stored offline in hardware wallets. While the compromised package posed no immediate threat to Ledger's hardware devices, the situation sparked widespread discussion and speculation. The prevailing theory suggests that the compromise occurred due to a vulnerability in Ledger’s GitHub workflow. It is believed that an attacker exploited a GitHub pull request workflow to gain access to Ledger's NPM keys, enabling them to publish malicious code. The malicious update reportedly caused a secondary window to open when users attempted to connect their wallets. The Experiment The Experiment The incident piqued my curiosity, prompting me to question whether GitHub workflows were inherently flawed or if there was more nuance to the exploit. To explore this, I conducted an experiment to see if I could replicate the vulnerability. Using an existing open-source repository, I attempted to recreate the exploit. During my testing, I discovered that: 1. A pull request can edit a workflow and the new workflow will run immediately after the pull request is made 1. A pull request can edit a workflow and the new workflow will run immediately after the pull request is made The screenshot below displays the contents of a pipeline.yml file from the repository I was working with. The pipeline is configured to trigger every push to the main branch, deploying the serverless application to AWS . pipeline.yml AWS I proceeded by creating a new branch within the repository and modifying the pipeline file. The updated configuration was set to trigger the workflow on every pull request, regardless of the branch. The screenshot below illustrates the modified state of the file. Along with these modifications, I added an instruction to print the AWS_REGION GitHub secret, which was already present in the repository. I expected to see the value displayed in the workflow logs after the action was executed successfully. AWS_REGION I then submitted a pull request to the main branch with these changes, and as expected, the modified workflow was triggered and executed successfully, even though the pull request had not been reviewed, approved, or merged! Interesting. As seen in the screenshot above, the workflows triggered by my pull request were executed successfully. You might notice there are two workflow runs displayed, which I will address in the next section. For now, let's focus on the workflow labeled "test: modified GitHub workflows" at the bottom. Once the workflow was completed, I reviewed the logs, and as expected, the AWS_REGION GitHub secret was masked, as shown in the following image. This outcome was anticipated, as I had previously encountered a similar article detailing this kind of exploit, which informed my approach to this experiment. AWS_REGION Now, if the secrets were concealed, how did the attacker manage to access them? This question led to my second key finding: 2. GitHub secrets can be exposed by making curl requests to third-party APIs within a modified workflow 2. GitHub secrets can be exposed by making requests to third-party APIs within a modified workflow Yeah, you read that right! To test this, I further edited the workflow to include a request to a RequestBin I created on Pipedream . The screenshot below illustrates the updated workflow. Pipedream This explains the second workflow run shown in the earlier screenshot, confirming that both workflows were executed successfully. On Pipedream's RequestBin, I was able to view the GitHub "secret" in plain text. This raised a concerning question: could anyone simply submit a pull request to an open-source project and easily access sensitive keys? Securing Your Workflows Securing Your Workflows Given the potential vulnerabilities uncovered during this experiment, it’s crucial to understand how to secure GitHub workflows to prevent unauthorized access to sensitive data. GitHub provides several settings that can be configured to reduce the risk of exploitation: GitHub Actions permissions setting:
By default, all actions are permitted to run, regardless of the author. For enhanced security, this setting should be updated to limit permissions, ensuring that only trusted workflows can execute. Fork pull-request workflows from outside collaborators setting:
This setting defines which outside collaborators require approval to run workflows in pull requests. Properly configuring this setting is critical, as misconfiguration could expose your repository to potential exploits. Actions permissions setting: By default, all actions are permitted to run, regardless of the author. For enhanced security, this setting should be updated to limit permissions, ensuring that only trusted workflows can execute. Actions permissions setting: Actions permissions setting: By default, all actions are permitted to run, regardless of the author. For enhanced security, this setting should be updated to limit permissions, ensuring that only trusted workflows can execute. Fork pull-request workflows from outside collaborators setting: This setting defines which outside collaborators require approval to run workflows in pull requests. Properly configuring this setting is critical, as misconfiguration could expose your repository to potential exploits. Fork pull-request workflows from outside collaborators setting: Fork pull-request workflows from outside collaborators setting: This setting defines which outside collaborators require approval to run workflows in pull requests. Properly configuring this setting is critical, as misconfiguration could expose your repository to potential exploits. Additionally, GitHub’s documentation notes that workflows triggered from forks do not have access to sensitive data like secrets. This emphasizes the importance of reviewing the settings for repositories where sensitive data is handled. By implementing these security measures, repositories can significantly reduce the likelihood of similar vulnerabilities being exploited. Possible Explanations for the Exploit Possible Explanations for the Exploit Taking all of the above factors into consideration, if the rumors are accurate and Ledger's NPM secrets were indeed compromised, a few scenarios might explain how this occurred: CASE #1: The package maintainers overlooked the configuration settings and allowed the compromised workflows to run. CASE #2: The attacker somehow obtained full write access to the repository. CASE #3: The attacker is, or was, a previous contributor to the project. CASE #4: The exploit was carried out as an inside job. CASE #1: The package maintainers overlooked the configuration settings and allowed the compromised workflows to run. CASE #1: CASE #2: The attacker somehow obtained full write access to the repository. CASE #2: CASE #3 : The attacker is, or was, a previous contributor to the project. CASE #3 CASE #4: The exploit was carried out as an inside job. CASE #4: My Analysis My Analysis Upon reviewing these scenarios, I believe that CASE #3 is the most plausible explanation. A previous contributor may not need explicit approval to trigger workflows in the repository, making it easier to exploit this vulnerability. I have seen various discussions on social media suggesting that a former employee’s account might have been compromised, which would support CASE #3. However, until an official statement is released by Ledger, the exact cause remains speculative. Final Thoughts Final Thoughts Through this experiment, I gained a deeper understanding of how workflow vulnerabilities can be exploited and how developers can protect their repositories from such threats. By implementing the recommended security settings and thoroughly reviewing contributor permissions, open-source maintainers can minimize the risk of unauthorized access.

How a Compromised NPM Package Revealed GitHub Workflow Vulnerabilities

Setting up GitHub Actions to automate the publishing of Python packages to the Python Package Index (PyPI) involves creating a workflow that runs when you push changes to your repository. Here’s a step-by-step guide to help you integrate GitHub Actions with PyPI for your Python projects. Step 1: Prepare Your Python Package Ensure your Python package is ready for distribution. You should have the following files in your project directory: setup.py: This file contains metadata about your package.
pyproject.toml: This file is often used for specifying build dependencies.
Your package source code in a directory (e.g., my_package/). Here's a simple example of what your setup.py might look like: from setuptools import setup, find_packages

setup(
    name='my_package',
    version='0.1.0',
    packages=find_packages(),
    install_requires=[
        # List your package dependencies here
    ],
) Step 2: Create a PyPI Account If you haven’t already, create an account on PyPI. Once registered, you can create an API token for authentication. Log in to your PyPI account.
Go to your account settings and create a new API token.
Copy the generated token, as you will need it later. Step 3: Store the PyPI Token in GitHub Secrets To securely use your PyPI token in GitHub Actions, add it to your repository secrets: Go to your GitHub repository.
Click on Settings > Secrets and variables > Actions > New repository secret.
Name the secret PYPI_TOKEN and paste your PyPI API token in the value field. Step 4: Create the GitHub Actions Workflow Create a workflow file in your repository to define the steps for publishing to PyPI. Create a directory .github/workflows/.
Inside that directory, create a file named publish.yml. Here’s a sample publish.yml file: name: Publish to PyPI

on:
  push:
    tags:
      - 'v*'  # Trigger on version tags like v1.0.0

jobs:
  publish:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v2

      - name: Set up Python
        uses: actions/setup-python@v2
        with:
          python-version: '3.8'  # Specify your Python version

      - name: Install dependencies
        run: |
          python -m pip install --upgrade pip
          pip install setuptools wheel twine

      - name: Build package
        run: |
          python setup.py sdist bdist_wheel

      - name: Publish to PyPI
        env:
          TWINE_USERNAME: __token__  # Use the token authentication
          TWINE_PASSWORD: ${{ secrets.PYPI_TOKEN }}
        run: |
          twine upload dist/* Step 5: Create a Tag for the Release To trigger the workflow, you need to create a Git tag that matches the pattern defined in your workflow file (e.g., v1.0.0). You can do this using the following Git commands: git tag v1.0.0
git push origin v1.0.0 Step 6: Check GitHub Actions After pushing the tag, go to your GitHub repository and check the Actions tab. You should see the workflow running. If everything is set up correctly, it will build your package and publish it to PyPI. Conclusion By following these steps, you can successfully set up GitHub Actions to automate the process of publishing your Python development projects to PyPI. This integration not only streamlines your deployment process but also ensures that your package is consistently updated with the latest changes. Setting up GitHub Actions to automate the publishing of Python packages to the Python Package Index (PyPI) involves creating a workflow that runs when you push changes to your repository. Here’s a step-by-step guide to help you integrate GitHub Actions with PyPI for your Python projects. Step 1: Prepare Your Python Package Ensure your Python package is ready for distribution. You should have the following files in your project directory: setup.py: This file contains metadata about your package. pyproject.toml: This file is often used for specifying build dependencies. Your package source code in a directory (e.g., my_package/). setup.py : This file contains metadata about your package. setup.py pyproject.toml : This file is often used for specifying build dependencies. pyproject.toml Your package source code in a directory (e.g., my_package/ ). my_package/ Here's a simple example of what your setup.py might look like: setup.py from setuptools import setup, find_packages

setup(
    name='my_package',
    version='0.1.0',
    packages=find_packages(),
    install_requires=[
        # List your package dependencies here
    ],
) from setuptools import setup, find_packages

setup(
    name='my_package',
    version='0.1.0',
    packages=find_packages(),
    install_requires=[
        # List your package dependencies here
    ],
) Step 2: Create a PyPI Account If you haven’t already, create an account on PyPI . Once registered, you can create an API token for authentication. PyPI Log in to your PyPI account. Go to your account settings and create a new API token. Copy the generated token, as you will need it later. Log in to your PyPI account. Go to your account settings and create a new API token. Copy the generated token, as you will need it later. Step 3: Store the PyPI Token in GitHub Secrets To securely use your PyPI token in GitHub Actions, add it to your repository secrets: Go to your GitHub repository. Click on Settings > Secrets and variables > Actions > New repository secret. Name the secret PYPI_TOKEN and paste your PyPI API token in the value field. Go to your GitHub repository. Click on Settings > Secrets and variables > Actions > New repository secret . Settings Secrets and variables Actions New repository secret Name the secret PYPI_TOKEN and paste your PyPI API token in the value field. PYPI_TOKEN Step 4: Create the GitHub Actions Workflow Create a workflow file in your repository to define the steps for publishing to PyPI. Create a directory .github/workflows/. Inside that directory, create a file named publish.yml. Create a directory .github/workflows/ . .github/workflows/ Inside that directory, create a file named publish.yml . publish.yml Here’s a sample publish.yml file: publish.yml name: Publish to PyPI

on:
  push:
    tags:
      - 'v*'  # Trigger on version tags like v1.0.0

jobs:
  publish:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v2

      - name: Set up Python
        uses: actions/setup-python@v2
        with:
          python-version: '3.8'  # Specify your Python version

      - name: Install dependencies
        run: |
          python -m pip install --upgrade pip
          pip install setuptools wheel twine

      - name: Build package
        run: |
          python setup.py sdist bdist_wheel

      - name: Publish to PyPI
        env:
          TWINE_USERNAME: __token__  # Use the token authentication
          TWINE_PASSWORD: ${{ secrets.PYPI_TOKEN }}
        run: |
          twine upload dist/* name: Publish to PyPI

on:
  push:
    tags:
      - 'v*'  # Trigger on version tags like v1.0.0

jobs:
  publish:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v2

      - name: Set up Python
        uses: actions/setup-python@v2
        with:
          python-version: '3.8'  # Specify your Python version

      - name: Install dependencies
        run: |
          python -m pip install --upgrade pip
          pip install setuptools wheel twine

      - name: Build package
        run: |
          python setup.py sdist bdist_wheel

      - name: Publish to PyPI
        env:
          TWINE_USERNAME: __token__  # Use the token authentication
          TWINE_PASSWORD: ${{ secrets.PYPI_TOKEN }}
        run: |
          twine upload dist/* Step 5: Create a Tag for the Release To trigger the workflow, you need to create a Git tag that matches the pattern defined in your workflow file (e.g., v1.0.0 ). You can do this using the following Git commands: v1.0.0 git tag v1.0.0
git push origin v1.0.0 git tag v1.0.0
git push origin v1.0.0 Step 6: Check GitHub Actions After pushing the tag, go to your GitHub repository and check the Actions tab. You should see the workflow running. If everything is set up correctly, it will build your package and publish it to PyPI. Actions Conclusion By following these steps, you can successfully set up GitHub Actions to automate the process of publishing your Python development projects to PyPI. This integration not only streamlines your deployment process but also ensures that your package is consistently updated with the latest changes. Python development

Stories, News & Mentions about GITHUB

Github’s Stories on HackerNoon

Github's News & Mentions