使用 Homebrew, Nix 安装 yor

项目链接

• 主页
• 仓库
• 软件包管理器页面

命令和别名

• yor

项目历史

Yor was publicly launched on 2021-05-27, shortly after Palo Alto Networks acquired Bridgecrew. Palo Alto's announcement framed it as an open-source IaC tag-and-trace tool for developer workflows, with local CLI, pre-commit, GitHub Actions, and CI/CD usage.

The README describes Yor as an open-source tool that adds informative and consistent tags across IaC frameworks, with built-in support for Terraform, CloudFormation, and Serverless Frameworks, plus custom taggers, skip annotations, dry runs, and Git-based tags.

采用历史

Yor's adoption story is tied to cloud governance rather than app deployment. Help Net Security covered it as a tool for traceability and auditability, noting that organizations can run it retroactively across infrastructure resources or build it into CI/CD so ownership and other tags come from IaC and git history.

Packaging followed developer workflow channels: Homebrew, Chocolatey, Docker, GitHub Actions, Azure DevOps snippets, and pre-commit hooks are all documented entry points.

使用方式

The common command is `yor tag --directory terraform/`, with options to recurse or not, include or skip tag groups, target specific frameworks, add simple custom tags, preview with dry-run, write JSON output, and skip directories or resource types.

The most package-relevant mode is automated CI: Yor can run as a GitHub Action or pre-commit hook that modifies IaC files so trace and owner tags travel from source repositories into provisioned cloud resources.

为什么软件包爱好者会关心

Yor matters because it packages cloud tagging policy as a repeatable source-code transformation. It is a small CLI, but its runtime effect is on Terraform and other IaC files that later become cloud inventory, billing, security, and incident-response metadata.

It is also an example of DevSecOps tooling where the package manager is part of governance distribution: install the CLI in CI, pin the hook/action version, and every repository can apply the same tagging logic.

时间线

• 2021-05-27: Palo Alto Networks announces Yor as an open-source automated IaC tag-and-trace tool.
• 2021-05-27: Security press covers Yor as an IaC traceability and auditability tool built by Bridgecrew.
• 2020s: Yor documents usage as CLI, Docker image, GitHub Action, Azure DevOps step, and pre-commit hook.

Related projects

• Bridgecrew and Prisma Cloud/Cortex Cloud are the commercial ecosystem around the project.
• bridgecrewio/yor-action is the GitHub Action integration.
• Terraform, CloudFormation, Serverless Framework, Kubernetes, pre-commit, Docker, and GitHub Actions are major adjacent technologies in documented workflows.

来源

• https://github.com/bridgecrewio/yor
• https://raw.githubusercontent.com/bridgecrewio/yor/main/README.md
• https://www.helpnetsecurity.com/2021/05/27/yor-tags-iac-resources/
• https://www.paloaltonetworks.com/blog/2021/05/yor-automated-iac-tag-and-trace/
• https://yor.io/1.Welcome/welcome.html