From f06da8546ff6169b602c586ecc3a8954e094b6f5 Mon Sep 17 00:00:00 2001 From: ariskemper Date: Thu, 26 Mar 2026 09:02:41 +0100 Subject: [PATCH 1/2] chore: add Socket.dev CI integration for automatic PR security scanning Adds a GitHub Actions workflow that runs Socket.dev security review on every PR targeting main. Scans dependency changes for supply chain risks (malware, typosquatting, install scripts, network access, etc.) and posts findings as PR comments. Requires SOCKET_API_KEY secret to be configured in repository settings. Part of supply chain security hardening (Phase 6). --- .github/workflows/socket-security.yml | 22 ++++++++++++++++++++++ 1 file changed, 22 insertions(+) create mode 100644 .github/workflows/socket-security.yml diff --git a/.github/workflows/socket-security.yml b/.github/workflows/socket-security.yml new file mode 100644 index 0000000000..645fda28be --- /dev/null +++ b/.github/workflows/socket-security.yml @@ -0,0 +1,22 @@ +name: Socket Security + +on: + pull_request: + branches: [main] + +permissions: + contents: read + pull-requests: write + issues: write + +jobs: + socket-security: + runs-on: ubuntu-latest + name: Socket.dev Security Review + steps: + - uses: actions/checkout@v4 + + - name: Socket Security Review + uses: SocketDev/socket-sdk-js@v1 + with: + api_key: ${{ secrets.SOCKET_API_KEY }} From 827640c978a9b3c6740ac253d8e5fa8cc3750095 Mon Sep 17 00:00:00 2001 From: ariskemper Date: Thu, 26 Mar 2026 09:26:23 +0100 Subject: [PATCH 2/2] fix: use correct SocketDev/action GitHub Action SocketDev/socket-sdk-js is the JS SDK, not a GitHub Action. The official action is SocketDev/action with socket-token input. --- .github/workflows/socket-security.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/socket-security.yml b/.github/workflows/socket-security.yml index 645fda28be..13d6feccc2 100644 --- a/.github/workflows/socket-security.yml +++ b/.github/workflows/socket-security.yml @@ -17,6 +17,6 @@ jobs: - uses: actions/checkout@v4 - name: Socket Security Review - uses: SocketDev/socket-sdk-js@v1 + uses: SocketDev/action@v1 with: - api_key: ${{ secrets.SOCKET_API_KEY }} + socket-token: ${{ secrets.SOCKET_API_KEY }}