If you read my last post, you know that I recently had my crypto wallet drained by a fake Polymarket copy-trading bot. The attackers used a supply chain attack, hiding malicious NPM packages deep inside the project by hijacking the resolved URL in the package-lock.json file.

Writing the technical post-mortem was satisfying, but I knew I couldn’t just stop there.

Today, I am excited to announce the release of my new open-source security tool: Registry Bouncer, now live on the GitHub Actions Marketplace!

The Problem: npm install is a Trap

The core issue with these supply chain attacks is how CI/CD pipelines traditionally handle dependencies. Attackers use techniques like typo-squatting or dependency confusion to alter a project’s package-lock.json. They change the registry URL of a legitimate-looking package to point to their own malicious server.

If your GitHub Actions workflow simply runs npm install or npm ci to build the project, it is already too late. The malicious package is downloaded, and any malicious postinstall scripts are immediately executed on your CI runner with access to your environment variables.

We need a way to inspect the lockfile before any installation happens.

The Solution: Meet Registry Bouncer

Registry Bouncer is a zero-configuration GitHub Action that stands at the gate of your repository and blocks malicious NPM packages from ever entering your codebase.

Instead of relying on complex vulnerability scanners that only look for known CVEs, Registry Bouncer takes a zero-trust approach to package registries.

✨ Key Features

• Pre-Install Execution: It parses your package-lock.json natively without running npm install. Malicious scripts never get the chance to execute.
• Strict Whitelisting: It extracts every resolved URL in your dependency tree and cross-references them against a strict list of trusted registries (like the official NPM registry, Yarn, and GitHub Packages).
• Automated PR Blocking: If a rogue URL is detected (e.g., https://scammer-domain.com/malware.tgz), the Action immediately exits with a failure code, turning the CI check red and blocking the Pull Request from being merged.
• Beautiful UI Reports: It generates a clean, detailed Markdown table directly in your GitHub Actions Job Summary showing exactly which packages failed the check.
• Automated Security Advisories: If you enable the create_pages_report parameter, the Action will automatically generate and commit a Jekyll-formatted security advisory to your repository’s _posts directory to publish on GitHub Pages!

How to Use It

Using Registry Bouncer is incredibly simple. You don’t need to configure any complex rules. Just drop this step into your existing GitHub Actions workflow (e.g., .github/workflows/security.yml):

Copy to clipboard
name: Security Checks

on:
  push:
    branches: [ "main" ]
  pull_request:
    branches: [ "main" ]

jobs:
  scan-lockfile:
    name: Scan NPM Registries
    runs-on: ubuntu-latest
    steps:
      - name: Checkout Code
        uses: actions/checkout@v4

      - name: Run Registry Bouncer
        uses: carlesloriente/registry-bouncer@v1.1.0

Make sure to check the Marketplace for the latest version tag!

Check the Demo

Want to see exactly how Registry Bouncer stops an attack in a real CI/CD pipeline?

I have set up a Live Demo Repository. This demo uses a recreated, defanged version of the original malicious Polymarket bot that inspired this tool. Head over to the Pull Requests or Actions tab in that repo to see Registry Bouncer catching the rogue keccak256-helper and encrypt-layout-helper dependencies, blocking the merge (if PR), and generating the automated report!

Securing third-party dependencies

Open source doesn’t always mean safe. We have to be vigilant about auditing our dependency trees.

I built Registry Bouncer to make that vigilance automatic. It is completely free and open-source. If you are building Node.js applications —whether they are crypto bots, enterprise backends, or simple side projects— I highly encourage you to add it to your CI/CD pipelines.

You can find the action on the GitHub Marketplace here.

Stay safe out there, and let’s keep building!

If you found this tool helpful, please consider starring the repository on GitHub and sponsor me for more security deep-dives and tools.

Last week, I decided I wanted to learn more about Polymarket copy trading bots. Like many of us do, I headed over to GitHub and found a repository called polymarket-copy-bot-ts that looked promising. It had over 800 stars, 600 forks, and a slick, well-done README. I downloaded it, built it, look briefly at the code and configured all the required settings and parameters—including my wallet credentials (address and private key) in a .env file—and fired it up. At first glance, everything was looking good.

A few hours later, I checked my balance. All my open positions were closed, and my funds from my Polymarket wallet were stolen. Drained completely.

It’s an incredibly frustrating experience, but as a security champion, I knew I couldn’t just walk away. I decided to dig into the source code, figure out exactly how and when they did it, and write this post to warn potential new users. Here is the step-by-step technical breakdown of how this Web3 supply chain attack works, and how I finally caught the malware in the act.

1. Initial Triage: Hunting for the Trap

My first instinct was to check the root directory of the bot. I immediately found a massive red flag: a file named audit_algorithm.sh.

Why would a standard Node.js TypeScript trading bot include a standalone bash script? It shouldn’t.

When you follow the bot’s setup instructions and run npm run build or npm run health-check, the attacker uses package.json hooks to silently execute this shell script in the background. But that wasn’t the only trap. The real devastating payload was hiding in the NPM dependencies.

I started auditing the package.json and noticed an obscure package called keccak256-helper. I then went straight to the package-lock.json file to investigate further and found something deeply concerning: the package’s resolved URL pointed to a suspicious domain. This meant the package wasn’t even being downloaded or distributed by the official NPM registry! However, it had been published there for a short period, being downloaded at least 56 times.

Until the registry’s automated security tools banned it.

2. The Lure (Social Engineering & Impersonation)

Attackers know that Web3 developers use keccak256 (a popular hashing algorithm) all the time. The attacker published a malicious package named keccak256-helper to blend in.

If you look at the package’s README.md and package.json, it looks completely legitimate:

Copy to clipboard
{
  "name": "keccak256-helper",
  "version": "1.3.2",
  "description": "Tools for secure encryption and format validation",
  "main": "index.js",
  "types": "index.d.ts",
  "author": "rabby",
  "license": "MIT"
}

They even included an index.d.ts file exporting a fake initializeSession(key: any) function so that TypeScript compilers wouldn’t throw any errors during development!

3. Evading Detection (Obfuscation)

When I opened the actual index.js file of the package, it was a total mess. It was an unreadable wall of mathematical operations and arrays.

The attacker used a heavy obfuscation technique called Control Flow Flattening. Instead of code running logically from top to bottom, the execution is scrambled into massive, infinite-looking while loops containing switch statements (e.g., while(e+P+d+h!=43)H:switch...).

This is deliberately done to confuse human analysts and bypass automated static antivirus scanners that look for known malicious code signatures. But if you look closely, you can spot it checking process.argv.slice(2) for execution flags like --version or -v. If it detects it’s running in an automated security sandbox, it halts entirely to stay hidden.

4. The Malicious Payload: Extracting the Secrets

Once the malware confirms it’s running in a real environment, the true payload activates and aggressively hunts for your keys.

Instead of the traditional attack vectors used by older trading bots in the past, my analysis showed that this malware directly reads .env variables, parses process.env.PRIVATE_KEY, and sends the stolen data as a payload via an HTTP POST request to a remote server.

To execute this, the attacker invokes the malicious function (carefully hidden with excessive spacing in the bot’s source files) silently like this:

Copy to clipboard
try {
  require('keccak256-helper').initializeSession(PRIVATE_KEY);
} catch (_) {}

Because of the try/catch block, if the malware crashes (for example, if window is undefined in a pure Node environment, or if the network request fails), the error is swallowed entirely. You would never even know the exfiltration attempt happened until your funds were already gone.

5. Dynamic Analysis: Catching the Thief

I wanted to deobfuscate the HTTP server address where my credentials were sent. Because the strings were heavily encrypted at runtime, static analysis wasn’t enough. I had to use Dynamic Analysis—tricking the malware into decrypting the URL itself and intercepting it right before it sent the data.

I wrote an interceptor script (analyzer.js) to mock the browser environment and hook into Node’s native http and https modules. At first, I was getting a weird error (throw new Error('Blocked')), and no URLs were printing. The hacker was actually overriding console.log inside their obfuscated script to blind me!

To beat this, I updated my script to write the intercepted HTTP request directly to a file on my disk before intentionally crashing the process to prevent the data from escaping:

Copy to clipboard
// A snippet of my final dynamic analysis script
https.request = function(...args) {
    const targetUrl = parseRequestTarget(args);
    const options = JSON.stringify(args[0], null, 2);

    // Write the stolen URL directly to a file to bypass console.log manipulation!
    const output = `[🚨 HTTPS INTERCEPT 🚨]\nTarget URL: ${targetUrl}\nOptions: ${options}\n`;
    fs.writeFileSync('./exfiltration_data.txt', output, 'utf8');

    throw new Error('Successfully blocked HTTPS exfiltration');
};

By feeding the script a fake DUMMY_PRIVATE_KEY_DEADBEEF, I finally forced the malware to reveal its Command and Control (C2) server inside my exfiltration_data.txt file!

6. Indicators of Compromise (IoCs)

If you have downloaded any Web3 bots recently, check your repositories for these:

• Malicious NPM Package: keccak256-helper (Version: 1.3.2)

• Malicious GitHub Repo: polymarket-copy-bot-ts

• Suspicious Files: audit_algorithm.sh

• Suspicious Functions: Hidden in the code with a ton of spacing

7. Lessons Learned

1. Never use your primary wallet. If you want to test a new crypto bot, use a burner wallet with only the absolute minimum funds required (just enough for gas).

2. Beware of GitHub “Star Farming”. The repo that got me had 871 Stars and 635 Forks, but only 35 Watchers and 7 Issues without any PRs. This is the classic footprint of a bot-farmed repository meant to create fake trust.

3. Open Source doesn’t always mean safe. Just because you can read the source code files doesn’t mean there aren’t malicious dependencies lurking in the package.json, package-lock.json, or shell scripts waiting to trigger on the execution of code.

Be careful! There is currently a ton of these fake Polymarket/crypto trading bots flooding GitHub. Always audit your dependencies, and never hand over your private keys.

If you found this breakdown helpful, feel free to share it to warn others, and sponsor me for more security deep-dives and tools.

Kudos to GitHub Trust & Safety team

P.S. After compiling these findings, I immediately reported the repository and the malicious user account to GitHub’s Trust & Safety team. I’m happy to report that a few hours later, they took action and deleted the entire repository and the scammer’s account from the platform. While my funds are unfortunately gone, at least this specific trap has been dismantled and can’t harm anyone else!

Ladybird is a web browser that is designed to be fast and lightweight. It is built on top of the Chromium browser engine, which means that it is compatible with all of the latest web technologies. Ladybird is designed to be easy to use and to provide a clean and simple user interface.

Andreas Kling the creator of Ladybird, is also the creator of the SerenityOS.

Download and Install on Fedora

Ladybird it’s on development, so you can download the latest version from the official GitHub repo.

Feel free to clone the repository or download the full source code as a zip file.

Dependencies

Copy to clipboard
sudo dnf install autoconf-archive automake ccache cmake curl liberation-sans-fonts libglvnd-devel nasm ninja-build perl-FindBin perl-IPC-Cmd perl-lib qt6-qtbase-devel qt6-qtmultimedia-devel qt6-qttools-devel qt6-qtwayland-devel tar unzip zip zlib-ng-compat-static

ⓘ These are the dependencies required to build Ladybird from source

Build Ladybird

1. Open a terminal window.
2. Navigate to the directory where you downloaded the Ladybird package.
3. Run the following command to install Ladybird:

Copy to clipboard
sh Meta/ladybird.sh install

Copy the Ladybird binary to a directory in your PATH:

Copy to clipboard
sudo cp Build/release/bin/Ladybird /usr/local/bin

Run Ladybird

You can now run Ladybird like an standard application or by typing ladybird in a terminal window.

Copy to clipboard
Ladybird

Troubleshooting

If you encounter any errors during the build process, you can run the following command to clean up the build directory and start over:

Copy to clipboard
sh Meta/ladybird.sh clean

ⓘ Check the official Ladybird documentation for more information

Conclusion

Ladybird it’s on development, so you can expect some bugs and missing features. But it’s a good alternative to the mainstream browsers, and it’s worth to give it a try.

Consider supporting the Ladybird project donating on donorbox. Donors can also contribute to the development of the browser.

If you have any questions or suggestions, feel free to leave a comment below, and sponsor me for more security deep-dives and tools.

This error message indicates that the libruby.so.3.2 shared object file is missing or inaccessible. This file is a crucial component of the Ruby runtime, responsible for providing core Ruby functionalities. When this file is missing, any Ruby command, including gem and applications like Jekyll, will fail. This issue typically arises from a broken or incomplete Ruby installation, a misconfigured Ruby environment, or when switching between Ruby versions.

This guide will walk you through the steps to resolve this error on various operating systems.

Reinstalling Ruby

The most common solution is to reinstall Ruby.I recommend to use a version manager like rbenv or rvm. Alternatively, you can reinstall Ruby directly from your operating system’s package manager.

Ubuntu/Debian

Copy to clipboard
sudo apt update
sudo apt-get install ruby-full

ⓘ ruby-full provides a comprehensive Ruby installation. For install a specific Ruby version use rbenv or rvm.

Fedora/CentOS

Copy to clipboard
sudo dnf install ruby-build ruby-build-rbenv ruby-devel
rbenv --version # Check rbenv installation

ⓘ ruby-build and rbenv are installed for managing multiple Ruby versions. The package ruby-devel provides the development headers.

Windows

1. Download the RubyInstaller from the official RubyInstaller website.
2. Ensure you download the installer that includes DevKit. The DevKit is essential for compiling native extensions.
3. Follow the installer’s instructions.

macOS

Homebrew is required, if missing, please install it:

Copy to clipboard
/bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/master/install.sh)"

Install Ruby stuff:

Copy to clipboard
brew update
brew install rbenv ruby-build
rbenv install 3.2 # Install Ruby version 3.2 using rbenv and set as default
rbenv versions # Check if install was successful
rbenv global 3.2
rbenv rehash # Update rbenv shims
echo ‘eval "$(rbenv init -)"’ >> ~/.zshrc source ~/.zshrc # Add rbenv to your shell configuration

ⓘ The ZSH shell installation is optional and only needed if you use Oh My Zsh.

• rbenv rehash updates rbenv’s shims, which are used to find and execute Ruby executables.
• Adding eval ”$(rbenv init -)” to your shell configuration ensures rbenv is initialized when you open a new terminal.

Dependencies

Copy to clipboard
gem install ffi

The FFI (Foreign Function Interface) gem allows Ruby to interact with native libraries. It’s often required by other gems.

• If you encounter issues installing the ffi gem, you may need to install the build-essential package (on Debian-based systems) or the equivalent for your operating system.

Copy to clipboard
gem install bundler
bundle update

Bundler manages gem dependencies. bundle update updates all gems listed in your Gemfile to their latest compatible versions. If you do not have a Gemfile, bundle update will have no effect:

Check Ruby installation

Ensure that the correct version of Ruby is being used.

Copy to clipboard
ruby -v # Verify the active Ruby version
which ruby # Show which Ruby binary is being used

After these steps, you should be able to run Ruby commands without issues.

Try running the command that initially produced the error. For example, if you encountered the error while running Jekyll, execute jekyll serve.

Troubleshooting

• Same error after reinstalling Ruby, double-check your shell configuration files for any conflicting Ruby paths.
• If using a version manager, ensure that the correct Ruby version is selected.
• If gem install commands are failing due to network problems, verify internet connectivity.
• If you have recently updated your operating system, try reinstalling ruby.

Introduction

Your GitHub profile is your digital resume. It showcases your skills, projects, and contributions to the community. However, keeping it up-to-date can be time-consuming and often leads to outdated information. Using GitHub Actions, you can automate the display of your latest contributions, project statistics, blog articles and more. Keeping your profile fresh and relevant with automated updates.

GitHub Profile README

To get started, we need a GitHub repository with the same name as your GitHub username. The GitHub profile is a special repository that allows you to showcase your skills, projects, and contributions. By creating a custom README file. You can add content to your profile page, such as an introduction, links to your social media profiles, and a list of your projects.

Create a new repository if you don’t have one

1. Go to GitHub and click the + icon in the top right corner and select New repository.
2. Enter the repository name carlesloriente/carlesloriente (replace carlesloriente with your GitHub username).
3. Select Public as the visibility option and check the box Initialize this repository with a README. Click Create repository.
4. Clone the repository to your local machine and create a new branch named main and push it to the remote repository:

Copy to clipboard
git clone git@github.com:carlesloriente/carlesloriente
cd carlesloriente
git checkout -b main
git push origin main

Create a GitHub profile README

You can use markdown syntax in the README file that will be displayed on your profile page.

Edit the README.md file and add the following content:

Copy to clipboard
## Check my latest articles 👋

<!-- BLOG-POST-LIST:START -->
<!-- BLOG-POST-LIST:END -->

ⓘ This includes a heading and a placeholder to put the articles from your blog.

Save the file and commit the changes to the repository.

Copy to clipboard
git add README.md
git commit -m 'Add README.md'
git push origin main

Go to your GitHub profile page and you will see the README file displayed.

Update file content automatically

Let’s set a GitHub Action workflow that runs on a schedule. This workflow will fetch data from our personal blog and update the README file with the latest posts.

1.- Make a new folder named .github/workflows in the root of your repository.

Copy to clipboard
mkdir -p .github/workflows

2.- Create a new file named update-readme.yml in the .github/workflows folder.

Copy to clipboard
touch .github/workflows/update-readme.yml

3.- Add the following content to the update-readme.yml file:

Copy to clipboard
name: Update README
on:
  schedule:
    - cron: "0 * * * *"
  workflow_dispatch: # Run workflow manually (without waiting for the cron to be called), through the GitHub Actions Workflow page directly
permissions:
  contents: write

jobs:
  update-readme-with-blog:
    name: Update README with latest blog posts
    runs-on: ubuntu-24.04
    steps:
      - name: Checkout
        uses: actions/checkout@v4
      - name: Pull in notesoncloudcomputing.com posts
        uses: gautamkrishnar/blog-post-workflow@v1
        with:
          feed_list: "https://www.notesoncloudcomputing.com/feed.xml"

The gautamkrishnar/blog-post-workflow action created by Gautam krishna fetches the latest blog posts from a feed URL and updates the file with post titles and links.

⚠ Remember to replace the feed_list value with the URL of your blog feed.

4.- Commit the changes:

Copy to clipboard
git add .github/workflows/update-readme.yml
git commit -m "Add update-readme.yml"
git push origin main

Configure GitHub Actions permissions

Go to repository settings, Click on Actions-> General and enable the following permissions:

• Click the checkbox “Read and write permissions” button.
• Click the checkbox “Allow Github Actions to create and approve pull requests”.

And click on the “Save changes” button.

Workflow explanation

• The workflow is triggered every hour using the cron syntax 0 * * * *, and also includes a manual trigger using workflow_dispatch.
• The actions/checkout@v4 action is used to check out the repository.
• The gautamkrishnar/blog-post-workflow@v1 action is used to fetch the information.
• The feed_list specifies the URL of the feed.
• The permissions section grants write access to the contents of the repository.

Testing the workflow

Go to the Actions tab of your repository and you will see the workflow Update README running, or you can trigger it manually by clicking the Run workflow button.

After the workflow finishes, go to the main branch of your repository and you the README file will be updated with the latest blog posts list.

Bonus: GitHub Stats

You can also add your GitHub stats to your profile README. This includes your GitHub activity, top languages, and more. The anuraghazra/github-readme-stats action created by Anurag Hazra fetches the data from the GitHub API and generates a dynamic image that you can include in your README file.

Add GitHub Stats to your profile

Edit the README.md file and add the following content:

Copy to clipboard
## GitHub Stats
[![My Stats](https://github-readme-stats.vercel.app/api?username=myusername)](https://github.com/anuraghazra/github-readme-stats)

ⓘ Replace myusername with your GitHub username.

Save and commit the changes to the repository.

Copy to clipboard
git add README.md
git commit -m 'Add GitHub stats'
git push origin main

Now, your GitHub profile page will show the GitHub stats.

Conclusion

Enhancing your GitHub profile with dynamic updates brings several advantages. It showcases your latest contributions, projects, or blog posts, making your profile more engaging and informative. By automating the update process, you save time and effort, ensuring that your profile is always up-to-date.

If you found this valuable, consider starring the project’s consider starring the project’s GitHub repository 🌟. Share this knowledge with your network by spreading the word about this post! 🌍

Thanks for reading! 🚀

What’s Next?

• Customize your GitHub profile with additional features and integrations.
• Explore other GitHub Actions workflows to automate different tasks.
• Share your GitHub profile with the community and receive feedback.
• Stay updated with the latest GitHub Actions updates and best practices.

Additional Resources

• GitHub Profile README Documentation
• GitHub Actions Documentation

Introduction

Git submodules allow you to integrate code from a separate Git repository (in this case, a public repository) into your main project (a private repository). This is valuable for managing reusable components or external libraries. However, keeping these submodules up-to-date can be challenging.

In this post I will guide you through updating a submodule within a private repository whenever the corresponding public repository is updated. We’ll leverage GitHub Actions workflows and explore the necessary configurations in both repositories, including the use of secrets for secure authentication.

Key aspects covered:

• Setting up a public repository on GitHub.
• Creating a private repository with a submodule pointing to the public repository.
• Configuring a GitHub Actions workflow in the private repository to trigger on pushes to the public repository.
• Implementing the submodule update logic within the workflow using Git commands.
• Defining and utilizing necessary secrets in both repositories for secure access and authentication.

Let’s get started

Public repository setup

Create your public repo, in this guide i created my-public-repo at github.com, you can check it out here.

Clone it to your local machine:

Copy to clipboard
git clone git@github.com:carlesloriente/my-public-repo.git

Create the folder files and create a new file file.txt and do your first commit:

Copy to clipboard
git checkout -b main
mkdir files
touch files/file.txt
git add .
git commit -m "Add file.txt"
git push -u origin main

Action sending repository event

Back to your local machine, go to my-public-repo and create the github workflows folder:

Copy to clipboard
mkdir -p .github/workflows

To send and receive events from one repo to another, we are going to use the action repository-dispatch by Peter Evans, create the workflow file .github/workflows/updates_dispatch.yml, with the following content (replace carlesloriente/my-private-repo with your private repo):

Copy to clipboard
name: Dispatch Updates
on:
  push:
    branches:
      - main
jobs:
  dispatch:
    runs-on: ubuntu-24.04
    steps:
      - uses: peter-evans/repository-dispatch@v3
        with:
          token: ${{ secrets.PAT }}
          repository: carlesloriente/my-private-repo
          event-type: updating

Commit the changes:

Copy to clipboard
git add .github/workflows/updates_dispatch.yml
git commit -m "[skip actions] Add updates_dispatch.yml"
git push origin main

ⓘ The [skip actions] in the commit message is used to avoid triggering the workflow when pushing changes to the public repository.

Now, go to your public repo at github.com and click the Actions tab, you will see the new workflow Dispatch Updates.

Updates_dispatch action explanation

The workflow is triggered by a push event specifically to the main branch of the current repository (my-public-repo).

• Job named “dispatch” is executed.
• Steps
  • Dispatch Update Event:
    • The peter-evans/repository-dispatch@v3 action is used to dispatch a custom event.
    • The token input utilizes the secrets.PAT repository secret for authentication.
    • The repository input specifies the target repository for the dispatched event (carlesloriente/my-private-repo).
    • The event-type input defines the name of the custom event as “updating”.

Key Considerations:

• This workflow relies on the secrets.PAT repository secret for authentication.
• The target repository for the dispatched event (carlesloriente/my-private-repo) needs to be configured appropriately.
• The event-type (“updating”) can be customized to any desired value.

Private repository setup

Create the private repo, I created my-private-repo at github.com, you can check it out here.

Now, clone the my-private-repo to your local machine (replace carlesloriente with your username):

Copy to clipboard
git clone git@github.com:carlesloriente/my-private-repo

Create the new branches main and develop, and commit the main branch:

Copy to clipboard
git checkout -b main
touch README.md
git add .
git commit -m 'Initial commit'
git push -u origin main
git checkout -b develop

Add the my-public-repo as a submodule to my-private-repo, create a folder named submodules and run the following command:

Copy to clipboard
mkdir submodules
git submodule add git@github.com:carlesloriente/my-public-repo submodules/my-public-repo
git submodule update --init --recursive

It will add the my-public-repo as a submodule to the folder submodules/my-public-repo.

Create a symlink to the folder files in the root of my-private-repo:

Copy to clipboard
ln -ns submodules/my-public-repo/files files

Commit the changes:

Copy to clipboard
git add .
git commit -m "Add my-public-repo as a submodule"

Push the changes to the remote repository:

Copy to clipboard
git push -u origin develop

You can check the changes at the branch develop of my-private-repo, you will see the my-public-repo as a submodule.

After the pull request is merged, go to Settings-> Personal access tokens and create a new token with the following permissions:

• Read access to:
  • actions
  • metadata
  • repo
• Read and write access to:
  • workflows
  • commit statuses
  • pull requests

Copy the token and go to Settings-> Secrets and Variables-> Actions of m̀y-private-repo on github.com:

• Add a new secret named PAT with the previously copied token value
• Add a new secret named OWNER_EMAIL with your email

Now, go to Settings-> Secrets and Variables-> Actions of my-public-repo and add the same secrets.

Action triggered by repository event

Go to Settings-> Actions-> General of my-private-repo on github.com and enable the following permissions:

• Click the checkbox “Read and write permissions” button.
• Click the checkbox “Allow Github Actions to create and approve pull requests”.

Back to your local machine (my-private-repo), create the github workflows folder:

Copy to clipboard
mkdir -p .github/workflows

We are going to use the action checkout provided by github, so create the workflow file .github/workflows/update_on_event.yml, with the following content (replace ENV variable; MODULE_PATH with your value):

Copy to clipboard
name: Updating Submodule

on:
  repository_dispatch:
    types:
      - updating

jobs:
  update:
    runs-on: ubuntu-24.04
    permissions:
      contents: write
      pull-requests: write
    steps:
      - name: Checkout repository
        uses: actions/checkout@v3
        with:
          token: ${{ secrets.PAT }}
          submodules: recursive

      - name: Configure git user
        env:
          OWNER_EMAIL: ${{ secrets.OWNER_EMAIL }}
        run: |
          git config --global user.email "$OWNER_EMAIL"
          git config --global user.name "PRBot"

      - name: Generate Unique variable based on timestamp
        run: echo BRANCH=$(date +%s) >> $GITHUB_ENV

      - name: Update submodules
        run: |
          git submodule update --init --recursive --remote

      - name: Commit changes
        run: |
          git add .
          git commit -m "Update submodules"

      - name: Create and push new branch
        run: |
          git checkout -b ${{ env.BRANCH }}
          git push origin ${{ env.BRANCH }}

      - name: Create pull request
        env:
          GITHUB_TOKEN: ${{ secrets.PAT }}
        run: |
          gh pr create -B develop -H ${{ env.BRANCH }} --title "PR: Submodule update to develop" --body "Created by Github action"

Commit the changes:

Copy to clipboard
git add .github/workflows/update_on_event.yml
git commit -m "Add update_on_event.yml workflow"
git push origin develop

Go to github.com and create a pull request to merge the branch develop to main. Click the Actions tab, you will see the new workflow Updating Submodule.

Update_on_event action explanation

The workflow is triggered by a custom repository_dispatch event named “updating”. This allows you to manually initiate the update process from within your repository (my-private-repo).

• The job named “build” is executed and requires write permissions to both; repository contents and pull requests.
• Steps
  • Checkout: actions/checkout@v4 will check out the repository code, including the submodule, using a Personal Access Token (PAT) stored in secrets.PAT repository secret.
  • Updates Submodule:
    • Navigates to the submodule directory.
    • Sets the Git user email to a value retrieved from the secrets.OWNER_EMAIL repository secret.
    • Fetches and pulls the latest changes from the submodule’s remote repository.
    • Navigates back to the main repository directory.
    • Stages the updated submodule.
    • Commits the changes with a message indicating the submodule update.
    • Pushes the changes creating a new branch.
    • Creates a pull request from the new branch to the main branch using the GitHub CLI (gh).

Testing Workflows and Synchronization

Make a change to my-public-repo and push the changes to the main branch.

Copy to clipboard
touch files/file2.txt
git add .
git commit -m "Add file2.txt"
git push origin main

After the push, go to the Actions tab of my-public-repo and you will see the workflow Dispatch Updates running.

After the workflow finishes, go to the Actions tab of my-private-repo and you will see the workflow Updating Submodule running.

After the workflow finishes, go to the Pull requests tab of my-private-repo and you will see a new pull request created by the workflow.

When the pull request is merged, the submodule will be updated to the latest commit of the public repository.

Conclusion

GitHub Actions offers a vast array of features and capabilities beyond what we’ve covered here. Dive deeper into the documentation and explore its potential to further automate your workflows.

If you found this valuable, consider starring the project’s consider starring the project’s GitHub repository 🌟. Share this knowledge with your network by spreading the word about this post! 🌍

Thanks for reading! 🚀

What’s Next?

• Explore advanced GitHub Actions features and capabilities to further optimize your workflows.
• Experiment
• Share your feedback and experiences with the GitHub community.
• Stay updated with the latest GitHub Actions updates and best practices.

Additional Resources

• GitHub Actions Documentation
• GitHub Actions for CI/CD
• GitHub Actions for Git Submodules

I’m excited to announce the release of a major update for TopJekyllThemes! Bringing a significant number of improvements, fixes and a extensive refactoring and rebuilding.

Key Enhancements

Improved Deployment & Building

• Streamlined build and deploy processes with enhanced efficiency and reliability, including the removal of unnecessary files.

Enhanced Documentation

• Standardized theme submission instructions for better clarity.
• Added a prominent License badge for transparency.
• Corrected footer links for improved navigation.

Fixes

• Corrected sitemap pagination URLs.
• Fixed the offline.html page for a more seamless user experience.
• Improved theme search functionality.
• Resolved issues with template page metas.
• Addressed HTML markup errors in submission instructions.
• Corrected CORS cross-origin errors.
• Fixed various JavaScript and CSS errors.
• Standardized screenshot image types.
• Eliminated JavaScript console errors.
• Removed unused code and components for better performance.
• Corrected sitemap.xml template for improved search engine indexing.
• Improved build and deploy action configuration.
• Standardized og:image meta values for enhanced social media sharing.
• Removed inline CSS styles for better maintainability.

Refactored File and Structure

• Moved count.js to local storage for improved performance and security.
• Implemented a placeholder image for screenshots.
• Removed the debug Nav for a cleaner user interface.

Enhanced Branding & Aesthetics

• Refined the overall look and feel of the project with a more polished design.
• Improved navigation and CSS styles for a more intuitive user experience.
• Redesigned the themes index page for better presentation and discoverability.
• Updated the offline page with an improved user experience.
• Set default image dimensions for consistency and visual appeal.
• Updated thumbnail image types for higher quality visuals.
• Enabled Disqus comments through the valuable contribution of @carlesloriente.

Improved Dependencies

• Addressed missing packages in the Build and Deploy action.
• Corrected global installation of NPM packages.
• Enabled harmony packages for broader compatibility.

Enhanced Security

• Thoroughly tested CORS headers to ensure secure data exchange.

This release represents a significant step forward for TopJekyllThemes. We are confident that these improvements will enhance the user experience, improve performance, and strengthen the overall stability of the project.

We encourage you to explore the new version and experience the enhancements firsthand.

her, let’s make TopJekyllThemes the ultimate destination for building breathtaking static and dynamic websites with Jekyll! ✨

Related articles

• BestJekyllThemes has been moved to TopJekyllThemes
• BestJekyllThemes project launch

Exciting News! I’m happy to announce that BestJekyllThemes has been rebranded and moved to a new domain. Say hello to TopJekyllThemes, and you can find it at topjekyllthemes.com. This rebranding reflects the commitment to providing a positive experience for all the users. This change was made to distance ourselves from the previous domain. The domain was registered in the past, and unfortunately, there’s some lingering information and negative reviews associated with. I want to ensure that users have a positive experience and can trust the information provided on the site.

So, you’re diving into the web and need a digital home for your project? Choosing the right domain name is like picking the perfect street address – it sets the tone, influences how people find you, and impacts your brand. Let’s break down some common pitfalls to avoid:

First off, research is key. Don’t just grab “yourproject.com” and call it a day. Check if “yourproject.net,” “.org,” or any country-specific versions are already taken. You don’t want to confuse people or accidentally step on someone else’s toes.

Next, keep it simple. Long, complicated names are a nightmare to remember and prone to typos. Imagine trying to explain “[invalid URL removed]” to someone – not fun! Short, catchy names are easier to share and build brand recognition.

Hyphens and numbers? Not your friends. They make your name harder to read, type, and remember. Plus, it adds an extra layer of complexity that can confuse people.

Generic names are a no-go. “MyCloudSolution” or “TheCloudCompany” – yawn! You want a name that stands out and clearly reflects what makes your project unique.

Keywords can be helpful, but don’t go overboard. Including a relevant keyword can boost your search engine visibility, but don’t stuff it in! Focus on a name that’s memorable and easy to understand.

Trademarks are serious business. Make sure your chosen name doesn’t infringe on any existing trademarks. It could lead to legal trouble and damage your reputation.

Don’t limit yourself to .com. Explore other TLDs like .net, .org, or even country-specific options. It might open up some great possibilities.

Finally, get some feedback. Have friends or colleagues test your name and see if they can remember it or if they spot any potential typos.

Choosing the right domain name is an important step in your internet journey. By avoiding these common pitfalls and focusing on a clear, concise, and memorable name, you’ll set yourself up for success.

Do you dream in clean code and crave the simplicity of static websites? Then buckle up, because I’ve got some exciting news for you!

For years, JekyllThemes has been the go-to resource for stunning Jekyll themes. But sadly, it went a bit quiet. However, fear not! As a long-time Jekyll user (and huge admirer of Matt Harzewski’s work!), I couldn’t let this treasure trove fade away.

ⓘ This post was edited due to a later change of domain name, in favour of TopJekyllThemes. The original domain was BestJekyllThemes.

That’s why I’m thrilled to announce the launch of BestTopJekyllThemes, the reborn and revamped directory featuring over 500 of the BEST Jekyll themes, templates, and resources to supercharge your website building experience!

BestTopJekyllThemes, the best resource to find top-quality Jekyll templates for static and dynamic websites

Building on a Legacy

The amazing work of the previous maintainers is the foundation for BestTopJekyllThemes. Now, we’re taking things to the next level with some exciting new goals:

• Constant Curation: We’ll be actively seeking out the freshest, most innovative Jekyll themes to keep your website looking ahead of the curve.
• Community Corner: We’re building a vibrant community hub where you can share ideas, get support, and collaborate with fellow Jekyll wizards!
• Contributor Cavalry: We welcome passionate Jekyll enthusiasts to join the cause! If you’ve got a theme or resource to share, we’d love to hear from you!

Ready to Dive In?

The first iteration of TopJekyllThemes is already live at [shortened URL]. We’d be absolutely ecstatic to hear your feedback on the design and see what you think!

Head over to the official project on GitHub: BestTopJekyllThemes

Don’t be shy – share your thoughts, suggestions, and contributions! Together, let’s make TopJekyllThemes the ultimate destination for building breathtaking static and dynamic websites with Jekyll! ✨

Related articles

• BestJekyllThemes has been moved to TopJekyllThemes
• Domain Name Dilemma: Avoiding Common Pitfalls