gh-issue-tracker 1.0.0 → 1.1.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +39 -1
- package/package.json +6 -2
package/README.md
CHANGED
|
@@ -53,7 +53,7 @@ try {
|
|
|
53
53
|
| `githubRepo` | `string` | — | **Required.** Repository in `owner/repo` format |
|
|
54
54
|
| `environment` | `string` | `"development"` | Environment name shown in issue body |
|
|
55
55
|
| `labels` | `string[]` | `[]` | Additional labels applied to every issue |
|
|
56
|
-
| `enabled` | `boolean` | `true` | Kill switch to disable
|
|
56
|
+
| `enabled` | `boolean` | `true` | Kill switch. Use `enabled: !!process.env.GITHUB_TOKEN` to auto-disable when no token is set (e.g., local dev) |
|
|
57
57
|
| `onError` | `(err) => void` | `console.error` | Called when the GitHub API fails |
|
|
58
58
|
| `rateLimitPerMinute` | `number` | `10` | Max new issues created per minute |
|
|
59
59
|
| `dedupeWindowMs` | `number` | `60000` | Suppress same fingerprint within this window (ms) |
|
|
@@ -117,6 +117,7 @@ interface ErrorContext {
|
|
|
117
117
|
| **Next.js (client errors)** | [`examples/nextjs-error-proxy/`](examples/nextjs-error-proxy/) | Proxy endpoint for browser error boundaries |
|
|
118
118
|
| **Next.js (error UI)** | [`examples/nextjs-error-boundaries/`](examples/nextjs-error-boundaries/) | `error.tsx` and `global-error.tsx` components |
|
|
119
119
|
| **Express** | [`examples/express-middleware/`](examples/express-middleware/) | Error handler middleware |
|
|
120
|
+
| **Standalone proxy** | [`proxy/`](proxy/) | Deploy-once Cloudflare Worker or Vercel Function |
|
|
120
121
|
|
|
121
122
|
### Full Next.js setup (recommended)
|
|
122
123
|
|
|
@@ -137,6 +138,43 @@ For complete Next.js coverage, combine all three Next.js examples:
|
|
|
137
138
|
|
|
138
139
|
> For classic tokens, the `repo` scope works but grants broader access than needed.
|
|
139
140
|
|
|
141
|
+
## Security
|
|
142
|
+
|
|
143
|
+
**The `GITHUB_TOKEN` must NEVER reach the browser.** This token has write access to your repository's issues. If exposed in a client-side JavaScript bundle, anyone can extract it from DevTools and create/modify/close issues in your repo.
|
|
144
|
+
|
|
145
|
+
### The rule
|
|
146
|
+
|
|
147
|
+
`gh-issue-tracker` is a **server-side only** package. Never import it in client components, browser code, or any code that gets bundled for the browser.
|
|
148
|
+
|
|
149
|
+
### Capturing client-side errors safely
|
|
150
|
+
|
|
151
|
+
Browser errors need a **proxy** between the browser and the GitHub API:
|
|
152
|
+
|
|
153
|
+
```
|
|
154
|
+
Browser error boundary
|
|
155
|
+
→ POST { message, stack, url } to YOUR server
|
|
156
|
+
→ Your server calls captureException() with GITHUB_TOKEN
|
|
157
|
+
→ GitHub Issues API
|
|
158
|
+
```
|
|
159
|
+
|
|
160
|
+
Three options for the proxy:
|
|
161
|
+
|
|
162
|
+
| Option | Best for | Setup |
|
|
163
|
+
|--------|----------|-------|
|
|
164
|
+
| **In-app API route** | Single app, custom logic | [`examples/nextjs-error-proxy/`](examples/nextjs-error-proxy/) |
|
|
165
|
+
| **Cloudflare Worker** | Multi-app, global edge | [`proxy/cloudflare-worker/`](proxy/cloudflare-worker/) |
|
|
166
|
+
| **Vercel Function** | Multi-app, Vercel users | [`proxy/vercel-function/`](proxy/vercel-function/) |
|
|
167
|
+
|
|
168
|
+
The standalone proxies in `proxy/` are deploy-once solutions — they hold the secret so your apps don't have to.
|
|
169
|
+
|
|
170
|
+
### Security checklist
|
|
171
|
+
|
|
172
|
+
- [ ] `GITHUB_TOKEN` is NOT prefixed with `NEXT_PUBLIC_` or `VITE_`
|
|
173
|
+
- [ ] `gh-issue-tracker` is NOT imported in any `'use client'` component
|
|
174
|
+
- [ ] `.env` files are in `.gitignore`
|
|
175
|
+
- [ ] If using client error capture, the proxy has origin allowlist + rate limiting
|
|
176
|
+
- [ ] GitHub PAT uses fine-grained permissions (Issues only, single repo)
|
|
177
|
+
|
|
140
178
|
## GitHub Issue structure
|
|
141
179
|
|
|
142
180
|
Issues created by the tracker look like this:
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "gh-issue-tracker",
|
|
3
|
-
"version": "1.
|
|
3
|
+
"version": "1.1.2",
|
|
4
4
|
"description": "Lightweight error tracking that creates GitHub Issues instead of sending to SaaS. Deduplication, fingerprinting, and rate limiting built-in.",
|
|
5
5
|
"type": "module",
|
|
6
6
|
"main": "./dist/index.cjs",
|
|
@@ -35,7 +35,7 @@
|
|
|
35
35
|
],
|
|
36
36
|
"license": "MIT",
|
|
37
37
|
"engines": {
|
|
38
|
-
"node": ">=
|
|
38
|
+
"node": ">=20"
|
|
39
39
|
},
|
|
40
40
|
"dependencies": {
|
|
41
41
|
"octokit": "^4.1.2"
|
|
@@ -45,5 +45,9 @@
|
|
|
45
45
|
"tsup": "^8.0.0",
|
|
46
46
|
"typescript": "^5.7.2",
|
|
47
47
|
"vitest": "^4.0.16"
|
|
48
|
+
},
|
|
49
|
+
"repository": {
|
|
50
|
+
"type": "git",
|
|
51
|
+
"url": "https://github.com/zot24/gh-issue-tracker.git"
|
|
48
52
|
}
|
|
49
53
|
}
|