GeezerVison

All reactions

Mirrors the Dependabot hardening done in socket-python-cli (#207/#217/#218),
adapted to this SDK (no Dockerfile, no e2e fixtures, hatch/pip build path).

Bundle dependency updates (supersedes 4 open Dependabot PRs):
- idna 3.11 -> 3.17 (security: CVE-2026-45409 quadratic-time DoS fix)
- cryptography 46.0.5 -> 46.0.7
- pygments 2.19.2 -> 2.20.0
- uv 0.9.21 -> 0.11.17

Verified via uv sync --locked, import smoke, and pytest tests/unit (102 passed).

Adds grouped/cooldowned dependabot.yml (uv + github-actions), a
dependabot-review workflow running anonymous Socket Firewall smoke jobs,
Version Check / PR Preview skips for Dependabot PRs, and setup-sfw /
setup-hatch composite actions.

Co-Authored-By: Claude Opus 4.8 <[email protected]>

Copy link

Copy Markdown

Version Check requires a package-version increment on maintainer PRs, and
this PR bundles dependency bumps + Dependabot hardening. Bump version.py,
pyproject.toml, and the uv.lock project version in sync.

Co-Authored-By: Claude Opus 4.8 <[email protected]>

Broaden dependabot-review into dependency-review so the Socket Firewall
guardrail covers maintainer PRs too, not just Dependabot:

- inspect now runs on every PR and computes the SFW edition per-PR:
  enterprise for a trusted SocketDev member (author_association OWNER/
  MEMBER/COLLABORATOR) on an in-repo (non-fork) PR when SOCKET_API_TOKEN
  is present; free (anonymous) for Dependabot, forks, external
  contributors, or when the token is absent.
- The mode degrades to free whenever the token is missing, so this is
  safe to ship before the secret exists and auto-upgrades to enterprise
  once SOCKET_API_TOKEN is added (repo or org level). The SDK has no
  Socket token today (cf. socket-python-cli's SOCKET_CLI_API_TOKEN).
- setup-sfw composite action gains `mode` + `socket-token` inputs,
  forwarded to socketdev/action (same action, firewall-free vs
  firewall-enterprise).
- Rename workflow dependabot-review.yml -> dependency-review.yml to match
  the broadened scope (not a required status check).

Co-Authored-By: Claude Opus 4.8 <[email protected]>

…load

.python-version pins 3.12.7; setup-python provides 3.12.13, so `uv sync`
tried to download the exact managed CPython from GitHub, which Socket
Firewall's TLS interception blocked (UnknownIssuer). Set UV_PYTHON=3.12 +
UV_PYTHON_DOWNLOADS=never so uv uses the runner interpreter and only PyPI
package fetches route through sfw.

Co-Authored-By: Claude Opus 4.8 <[email protected]>

Tighten the enterprise-mode gate to author_association OWNER/MEMBER only.
Outside collaborators (COLLABORATOR) now fall through to the free edition,
same as Dependabot / forks / external contributors.

Co-Authored-By: Claude Opus 4.8 <[email protected]>

…TOKEN

Co-Authored-By: Claude Opus 4.8 <[email protected]>

Resolve zizmor secrets-outside-env (medium) without suppressing it. Split
the single mode-switching smoke job into two:

- python-sfw-smoke-free: untrusted PRs (Dependabot, forks, outside
  collaborators, externals). Anonymous free edition, never references the
  token.
- python-sfw-smoke-enterprise: SocketDev org members (OWNER/MEMBER) on an
  in-repo PR. Authenticated enterprise edition; SOCKET_SFW_API_TOKEN is
  scoped to the `socket-firewall` GitHub environment, so only this job can
  read it.

inspect now classifies PR trust (author_association OWNER/MEMBER, non-fork,
non-Dependabot) and references no secret. No required-reviewer protection
on the environment, so trusted dep PRs still run automatically.

Co-Authored-By: Claude Opus 4.8 <[email protected]>

…ot author_association

author_association only reflects PUBLIC org membership, so private members
(the common case here) show as CONTRIBUTOR and were misclassified -> the
enterprise job always skipped. Switch the trust gate to "non-fork PR and not
Dependabot": only accounts with write access can push an in-repo branch, the
same boundary GitHub uses for secret exposure. No read:org token needed.

Co-Authored-By: Claude Opus 4.8 <[email protected]>

lelia temporarily deployed to socket-firewall June 1, 2026 20:38 — with GitHub Actions Inactive

lelia temporarily deployed to socket-firewall June 1, 2026 20:46 — with GitHub Actions Inactive

lelia temporarily deployed to socket-firewall June 2, 2026 23:10 — with GitHub Actions Inactive

Copy link

Copy Markdown

lelia temporarily deployed to socket-firewall June 2, 2026 23:15 — with GitHub Actions Inactive

Eric Hibbs (flowstate) left a comment

LGTM

… scrape

Match socket-python-cli: discover the firewall report via the
$SFW_JSON_REPORT_PATH env var that socketdev/action exports, instead of
parsing the 'sfw report written to:' line out of stdout.

The two sync steps return to plain 'set -o pipefail' + tee. A new
'Collect SFW JSON report' step (if: always(), before each upload) copies
$SFW_JSON_REPORT_PATH into sfw-artifacts/sfw-report.json -- copy, not
move, since socketdev/action's post step reads that temp path for its job
summary -- and drops a sfw-report-missing.txt breadcrumb when absent.

More robust than scraping an undocumented log string, and keeps the
report-capture pattern uniform across both repos.

Signed-off-by: lelia <[email protected]>

lelia temporarily deployed to socket-firewall June 2, 2026 23:28 — with GitHub Actions Inactive