GeezerVison

All reactions

Bundles 8 open Dependabot PRs into one verified change and hardens the
Dependabot config + dependency-review workflows, mirroring the work in
socket-sdk-python#84 and socket-python-cli#207/#217. Adds a supply-chain
watch for the four core OSS tools Dependabot cannot cleanly track.

- uv.lock: idna 3.10->3.18 (CVE-2026-45409), pygments 2.19.2->2.20.0,
  pytest 8.4.2->9.0.3, urllib3 2.6.3->2.7.0
- _docker-pipeline.yml: bump 4 docker/* actions (setup-buildx, login,
  metadata, build-push)
- dependabot.yml: add uv ecosystem, group every ecosystem into
  minor/patch + major bundles, scan composite actions
- dependency-review.yml (was dependabot-review.yml): runs on every PR;
  free/enterprise sfw split; report artifacts; app_tests docker smoke
- core-tool-watch.yml + scripts/check_core_tools.py: discover latest
  versions of opengrep/trufflehog/trivy/socketdev and score them through
  the Socket API (socketdev SDK purl.post); drift issue + report artifact
- python-tests.yml: uv.lock drift guard

Co-Authored-By: Claude Opus 4.8 <[email protected]>

Copy link

Copy Markdown

Copy link

Copy Markdown

… gate

Mirroring the Python CLI/SDK used `environment: socket-firewall` to scope the
SFW token, but that environment can carry a required-reviewers approval gate.
Because the enterprise SFW check can't be a required status check (it would
block Dependabot/fork PRs that only run the free edition), maintainers could
merge without approving the deployment -- the meaningful check silently never
ran, and approvers could rubber-stamp their own PRs. On the scheduled
core-tool-watch job an approval gate would hang the cron run outright.

- Remove `environment:` from python-sfw-smoke-enterprise and core-tool-watch;
  use a plain repo/org SOCKET_SFW_API_TOKEN (zizmor secrets-outside-env is
  already disabled here, so no lint cost). Job split still isolates the token
  to the enterprise job only.
- Add always-on `dependency-review-gate` job: pass when no python deps changed,
  else require the free (Dependabot/fork) or enterprise (maintainer) smoke job
  to have succeeded. Mark THIS as the single required status check -- safe on
  every PR, no manual gate, no bypass.

Co-Authored-By: Claude Opus 4.8 <[email protected]>

Adopt the socket-python-cli#224 pattern uniformly. The environment was never
the problem -- the required-reviewers approval RULE on it was. Keep the
environment for secret scoping; forbid the rule.

- Restore `environment: socket-firewall` on python-sfw-smoke-enterprise and the
  core-tool-watch analyze job so SOCKET_SFW_API_TOKEN is scoped to those jobs.
  Header documents that the environment must have NO reviewers rule, with the
  gh api command to enforce it (reviewers: null).
- dependency-review-gate (Pattern 2 aggregator): now also needs
  docker-smoke-app-tests; fails on any failure/cancelled result (success and
  skipped pass) AND requires the trust-appropriate SFW edition to have
  succeeded when Python deps changed. Runs if: always() so the required context
  is always created -- no Pattern 1 bypass twin needed. Must land on main before
  being added to branch protection.

Signed-off-by: lelia <[email protected]>

lelia temporarily deployed to socket-firewall June 26, 2026 20:54 — with GitHub Actions Inactive

lelia had a problem deploying to socket-firewall June 26, 2026 20:54 — with GitHub Actions Failure

…N report

Live CI exposed two things on the now-enabled Actions:
- socketdev/action firewall-enterprise HARD-ERRORS on an empty token (no
  silent fallback), so a trusted dep PR opened before the SOCKET_SFW_API_TOKEN
  secret exists fails and the required gate blocks merge. setup-sfw now resolves
  the effective mode and falls back to firewall-free when enterprise is
  requested without a token -- still a real supply-chain check, ships green
  today, auto-upgrades to enterprise the moment the secret is added. Token is
  read via env, never interpolated into the script.
- socketdev/action writes a structured report to $SFW_JSON_REPORT_PATH; both
  smoke jobs now capture it and upload it alongside the tee'd log.

Signed-off-by: lelia <[email protected]>

lelia temporarily deployed to socket-firewall June 26, 2026 20:58 — with GitHub Actions Inactive

lelia temporarily deployed to socket-firewall June 26, 2026 20:58 — with GitHub Actions Inactive

lelia temporarily deployed to socket-firewall June 26, 2026 21:06 — with GitHub Actions Inactive

lelia temporarily deployed to socket-firewall June 26, 2026 21:08 — with GitHub Actions Inactive

… scoring

OpenGrep ships as a GitHub-release binary that Socket has no data for under
its pkg:github coordinate, so the watcher reported 'no data' for it. OpenGrep
is a hard fork of Semgrep, so fall back to scoring the upstream Semgrep
lineage (pkg:pypi/semgrep) as a project-health proxy.

The proxy is report-only and never build-failing: it does not analyze
OpenGrep's own release artifacts, so a Semgrep alert must not block an
OpenGrep build. The pinned/latest verdicts show the proxy result labeled
'(via semgrep upstream proxy)' when the primary coordinate has no data, and
the JSON report records it under a separate 'proxy' key.

The npm 'opengrep' package is a single-version squat (not the official
distribution) and is deliberately not used as a coordinate.

Signed-off-by: lelia <[email protected]>

lelia temporarily deployed to socket-firewall June 26, 2026 21:54 — with GitHub Actions Inactive

lelia temporarily deployed to socket-firewall June 26, 2026 21:55 — with GitHub Actions Inactive

lelia temporarily deployed to socket-firewall July 22, 2026 02:34 — with GitHub Actions Inactive

lelia temporarily deployed to socket-firewall July 22, 2026 02:34 — with GitHub Actions Inactive

Copy link

Copy Markdown

Contributor Author

…ore-tool-watch scan env

Dependabot-triggered runs can read a *Dependabot-store* secret (set via
'gh secret set SOCKET_SFW_API_TOKEN --app dependabot'), so the free-tier
routing for Dependabot -- a workaround for the assumption that its runs
could never hold a token -- is gone:

- dependency-review.yml: trusted == any in-repo (non-fork) PR, now
  including Dependabot. Its dep bumps get full org-policy (enterprise)
  enforcement; forks stay on the anonymous free edition. setup-sfw's
  existing empty-token fallback covers the window until the Dependabot
  secret mirror exists.
- core-tool-watch.yml: sync the scan's Python env from the DEFAULT
  BRANCH lockfile (second checkout at .scan-env) so the token-holding
  step never imports packages bumped by the PR under review -- it only
  reads the PR's pins. Makes the Dependabot token mirror safe here too.
- dependency-review.yml: import smokes use 'uv run --no-sync' so the
  post-firewall step can't re-sync outside sfw (Bugbot finding).
- check_core_tools.py: docstring/help now honestly describe the strict
  fail thresholds (curated malware-class list + high/critical), which
  are intentional (Bugbot finding).

Co-Authored-By: Claude Fable 5 <[email protected]>

lelia had a problem deploying to socket-firewall July 22, 2026 03:02 — with GitHub Actions Failure

lelia temporarily deployed to socket-firewall July 22, 2026 03:02 — with GitHub Actions Inactive

Copy link

Copy Markdown

Contributor Author

The scan env checkout of main fails to build the socket-basics package
editable while main carries the LICENSE.md rename breakage (#79, fix
pending in #88). The scan only imports the dependencies (socketdev SDK),
never socket_basics itself, so skip installing the project entirely --
also insulates this guard from any future main-side packaging breakage.

Co-Authored-By: Claude Fable 5 <[email protected]>

Copy link

Copy Markdown

Contributor Author

lelia temporarily deployed to socket-firewall July 22, 2026 03:06 — with GitHub Actions Inactive

cursor Bot left a comment

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 18a01d8. Configure here.}

lelia temporarily deployed to socket-firewall July 22, 2026 03:07 — with GitHub Actions Inactive

cursor Bot left a comment

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 425165e. Configure here.}

Eric Hibbs (flowstate) left a comment

one future-looking nit; LGTM

… API result

Two related hardenings from external review of purl.post() usage:

- Pass org_slug (resolved via client.org.get) when the installed SDK
  supports it: socketdev >= 3.1 (socket-sdk-python#76) deprecates the
  legacy POST /v0/purl in favor of POST /v0/orgs/{slug}/purl, and a
  future major may drop the legacy route. The pinned 3.0.29 predates
  the parameter, so it is signature-gated -- activates automatically
  when the scan env's lockfile bumps the SDK.

- Raise on an empty purl.post result: the SDK swallows ANY non-200
  (expired token, dropped endpoint, outage) into [], which previously
  flowed through as 'no data' verdicts and exit 0 -- fail-open. Every
  run scores coordinates Socket definitely has data for, so empty is
  an API failure; raising routes it into the existing scoring_error
  fail-closed path under --fail-on-malware.

Co-Authored-By: Claude Fable 5 <[email protected]>

Copy link

Copy Markdown

Contributor Author

lelia temporarily deployed to socket-firewall July 22, 2026 23:06 — with GitHub Actions Inactive

lelia temporarily deployed to socket-firewall July 22, 2026 23:06 — with GitHub Actions Inactive

Match socket-python-cli's get_org_id_slug() semantics: pass org_slug to
purl.post only when the token maps to exactly one org; multi-org tokens
fall back to the legacy endpoint with a notice rather than guessing and
scoring under the wrong org's policies.

Co-Authored-By: Claude Fable 5 <[email protected]>

lelia temporarily deployed to socket-firewall July 22, 2026 23:07 — with GitHub Actions Inactive

lelia temporarily deployed to socket-firewall July 22, 2026 23:07 — with GitHub Actions Inactive

Bugbot: a non-empty but incomplete Socket batch (or a pinned coordinate
that never matches a returned analysis row) previously passed as 'no
data' with exit 0 -- the guard could green-light a build without
verifying every pin it exists to gate.

Tools now declare socket_coverage (default True); with a token and a
successful scoring pass, any covered pinned coordinate missing from the
results is collected as unverified and fails a --fail-on-malware run,
listing the exact coordinates. OpenGrep sets socket_coverage=False:
its pkg:github coordinate is the documented no-data case with the
report-only semgrep proxy, and must not perma-fail the guard. The
unverified list is also surfaced in the JSON report.

Co-Authored-By: Claude Fable 5 <[email protected]>

Copy link

Copy Markdown

Contributor Author

lelia temporarily deployed to socket-firewall July 22, 2026 23:12 — with GitHub Actions Inactive

lelia temporarily deployed to socket-firewall July 22, 2026 23:12 — with GitHub Actions Inactive

cursor Bot left a comment

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit cdbfdce. Configure here.}