MarieandGitHub
96aef62ae4
Fixes https://github.com/twentyhq/core-team-issues/issues/1956 **Problem** Within an app, the `.yarn/releases/` folder contains executable Yarn binaries that run when executing any yarn command (`.yarnrc` file indicates yarn path to be `.yarn/releases/yarn-4.9.2.cjs `.) This is a supply chain attack vector: a malicious actor could submit a PR with a compromised `yarn-4.9.2.cjs binary`, which would execute arbitrary code on developers' machines or CI systems. **Fix** Actually, thanks to Corepack, we don't need to store and execute this binary. Corepack can be seen as the manager of a package manager: in `package.json` we indicate a packageManager version like `"packageManager": "yarn@4.9.2"`, and when executing `yarn` Corepack will securely fetch the verified version from npm, avoiding the risk of executing a compromised binary committed to the repository. This was already in our app's package.json template but we were not using it! We can now - remove the folder containing the binary from our app template base-application (that is scaffolded when creating an app through cli), `.yarn/releases/`, and remove `yarnPath: .yarn/releases/yarn-4.9.2.cjs` from its .yarnrc - remove them from the community apps that were already published in the repo - add .yarn to gitignore **Tested** This has been tested and works for app created in the repo, outside the repo, and existing apps in the repo
Hello world
A minimal hello-world application built with an alpha version of the twenty-cli.
⚠️ Since this project uses an early alpha release, expect breaking changes and evolving features.
This example will gradually gain complexity and capabilities as the twenty-cli matures with future updates.
Requirements
- twenty-cli
npm install -g twenty-cli - an
apiKey. Go to/settings/api-webhooksto generate one
Install to your Twenty workspace
cp .env.example .env
- replace
<SET_YOUR_TWENTY_API_KEY>and<SET_YOUR_TWENTY_API_URL>accordingly
twenty auth login
twenty app sync
What it does
- creates a new object
postCardwith anamefield - creates a serverless function
create-new-post-card - two triggers on
create-new-post-card:- one route trigger on
GET/post-card/create?recipient=RecipientName - one databaseEvent trigger on
people.createdevents
- one route trigger on
Development
Run dev mode and see application updates on your workspace instantly
twenty app dev