Add Socket Basics security scanning workflow

Runs SAST through OpenGrep, secret scanning through TruffleHog, and
Dockerfile misconfiguration scanning through Trivy, submitting results
to Socket.dev.

  .github/workflows/socket-basics.yml  scheduled weekly + manual dispatch
  .socket-basics.json                  scanner configuration
  .semgrepignore                       SAST path exclusions
  .trivyignore                         Dockerfile lint rules with no
                                       security dimension (only present
                                       where the repo has a Dockerfile)

Separate from socket-scan.yml, which covers dependency CVEs and Tier 1
reachability.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Author: kanwalpreetd

.github/workflows/socket-basics.yml

@@ -0,0 +1,81 @@
+# Socket Basics security scan for stellar-cli.
+# Upstream: https://github.com/SocketDev/socket-basics
+# Scanner settings live in .socket-basics.json; SAST path exclusions live in
+# .semgrepignore.
+#
+# This workflow does SAST through OpenGrep and secret scanning through
+# TruffleHog, and submits results to Socket.dev
+
+name: Socket Basics security scan
+
+on:
+  workflow_dispatch:
+  schedule:
+    - cron: "26 14 * * 6"
+
+permissions:
+  contents: read
+
+jobs:
+  socket-basics:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        with:
+          # Remove the GitHub token from the workspace after checkout, so it is
+          # not mounted into the Socket Basics container, which doesn't need it.
+          persist-credentials: false
+
+      - name: Run Socket Basics
+        env:
+          SOCKET_SECURITY_API_TOKEN: ${{ secrets.SOCKET_SECURITY_API_TOKEN }}
+          SOCKET_ORG: stellar
+        run: |
+          set +e
+          # Socket Basics is pinned by digest since rule tuning is calibrated
+          # to the exact ruleset contained in this image. Automatic updates
+          # could introduce new rules and a sudden increase in false
+          # positives, as these tools are generally noisy without tuning.
+          docker run --rm \
+            -v "$PWD:/github/workspace" \
+            -w /github/workspace \
+            -e SOCKET_SECURITY_API_TOKEN \
+            -e SOCKET_ORG \
+            -e GITHUB_REPOSITORY \
+            -e GITHUB_REF_NAME \
+            -e GITHUB_SHA \
+            ghcr.io/socketdev/socket-basics@sha256:d463bae84f21d0240d5e197acb81e95144a966a20ab7cd05cca3a70e1796a4bb \
+            --config .socket-basics.json 2>&1 | tee /tmp/socket-basics.log
+          rc=${PIPESTATUS[0]}
+
+          # Examine components count in .socket.facts.json to establish if the
+          # scan ran successfully, and count alerts whose action is error or
+          # warn in .socket.facts.json to decide on the warning annotation.
+          components=$(python3 -c 'import json;d=json.load(open(".socket.facts.json"));print(len(d.get("components") or []))' 2>/dev/null || echo 0)
+          findings=$(python3 -c 'import json;d=json.load(open(".socket.facts.json"));print(sum(1 for c in (d.get("components") or []) for a in (c.get("alerts") or []) if a.get("action") in ("error","warn")))' 2>/dev/null || echo 0)
+
+          if [ "${components:-0}" -eq 0 ]; then
+            # ${rc:-1} would not fail here: rc is the string "0", which :- does not substitute.
+            echo "::error::Socket Basics did not complete: no results in .socket.facts.json (docker exit ${rc:-unknown})"
+            if [ "${rc:-0}" -eq 0 ]; then rc=1; fi
+            exit "$rc"
+          fi
+
+          # Submission is detected by matching the scanner's error text. This is
+          # brittle -- a reworded message would stop being detected -- but it is
+          # the only approach available today: socket-basics catches submission
+          # exceptions, logs them and returns normally, so its exit code is
+          # unaffected (that code means "high/critical found", nothing else),
+          # and .socket.facts.json is written BEFORE submission and never
+          # records the outcome. The image is pinned by digest, so the wording
+          # cannot change until someone bumps the pin -- RE-CHECK THIS STRING
+          # WHENEVER THE DIGEST IS BUMPED.
+          if grep -q "Failed to submit socket facts file" /tmp/socket-basics.log; then
+            echo "::error::Socket Basics scan completed but results were not submitted to Socket"
+            exit 1
+          fi
+
+          if [ "${findings:-0}" -gt 0 ]; then
+            echo "::warning::Socket Basics found ${findings} high/critical finding(s)"
+          fi
+          exit 0

.semgrepignore

@@ -0,0 +1,112 @@
+# This file excludes scan paths from Socket Basics SAST scanning (through OpenGrep).
+# It replaces the built-in ignore list for scanning with a more thorough list of paths.
+
+# --- third-party / generated ---
+.git/
+node_modules/
+vendor/
+third_party/
+thirdparty/
+.devcontainer/
+dist/
+build/
+target/
+.venv/
+venv/
+__pycache__/
+.yarn/
+generated/
+*.min.js
+
+# --- test / example / mock code ---
+__fixtures__/
+__mocks__/
+__snapshots__/
+__tests__/
+acceptance-test/
+acceptance-tests/
+acceptance_test/
+acceptance_tests/
+benches/
+browser-test/
+browser-tests/
+browser_test/
+browser_tests/
+e2e/
+e2e-test/
+e2e-tests/
+e2e_test/
+e2e_tests/
+example/
+examples/
+fixtures/
+functional-test/
+functional-tests/
+functional_test/
+functional_tests/
+integration-test/
+integration-tests/
+integration_test/
+integration_tests/
+integrationtest/
+integrationtests/
+mock/
+mock-dapp/
+mocks/
+perf-test/
+perf-tests/
+perf_test/
+perf_tests/
+performance-test/
+performance-tests/
+performance_test/
+performance_tests/
+regression-test/
+regression-tests/
+regression_test/
+regression_tests/
+smoke-test/
+smoke-tests/
+smoke_test/
+smoke_tests/
+spec/
+specs/
+test/
+test-data/
+test-fixtures/
+testFixtures/
+testdata/
+testfixtures/
+tests/
+unit-test/
+unit-tests/
+unit_test/
+unit_tests/
+*.test.js
+*.test.jsx
+*.test.ts
+*.test.tsx
+*.test.mjs
+*.spec.js
+*.spec.jsx
+*.spec.ts
+*.spec.tsx
+*_test.go
+*_test.py
+*_test.rb
+*_test.exs
+test_*.py
+*Test.java
+*Tests.java
+*Test.kt
+*Tests.kt
+*Test.scala
+*Test.cs
+*Tests.cs
+tests.rs
+test.rs
+
+# --- repo-specific third-party (PER_REPO_VENDORED +
+# git submodules); the generic patterns above cannot know these ---
+soroban-test/
+ts-tests/

.socket-basics.json

@@ -0,0 +1,13 @@
+{
+  "workspace": ".",
+  "javascript_sast_enabled": true,
+  "ruby_sast_enabled": true,
+  "rust_sast_enabled": true,
+  "rust_disabled_rules": "rust-env-injection,rust-panic-in-production,rust-sql-injection",
+  "sast_ignore_overrides": "rust-hardcoded-secrets:cmd/crates/stellar-ledger/src/lib.rs,rust-hardcoded-secrets:cmd/soroban-cli/src/commands/container/shared.rs,rust-hardcoded-secrets:cmd/soroban-cli/src/commands/contract/upload.rs,rust-hardcoded-secrets:cmd/soroban-cli/src/commands/keys/add.rs,rust-hardcoded-secrets:cmd/soroban-cli/src/commands/keys/fund.rs,rust-hardcoded-secrets:cmd/soroban-cli/src/commands/keys/public_key.rs,rust-hardcoded-secrets:cmd/soroban-cli/src/commands/message/sign.rs,rust-hardcoded-secrets:cmd/soroban-cli/src/commands/message/verify.rs,rust-hardcoded-secrets:cmd/soroban-cli/src/commands/tx/new/clawback_claimable_balance.rs,rust-hardcoded-secrets:cmd/soroban-cli/src/config/address.rs,rust-hardcoded-secrets:cmd/soroban-cli/src/config/key.rs,rust-hardcoded-secrets:cmd/soroban-cli/src/config/locator.rs,rust-hardcoded-secrets:cmd/soroban-cli/src/config/secret.rs,rust-hardcoded-secrets:cmd/soroban-cli/src/signer/mod.rs,rust-command-injection:cmd/soroban-cli/src/commands/doctor.rs,rust-integer-overflow:cmd/soroban-cli/src/commands/tx/fetch/fee.rs,rust-memory-safety:cmd/crates/soroban-spec-tools/src/contract.rs,rust-memory-safety:cmd/soroban-cli/src/assembled.rs,rust-memory-safety:cmd/soroban-cli/src/commands/contract/arg_parsing.rs,rust-memory-safety:cmd/soroban-cli/src/tx.rs,rust-path-traversal:cmd/crates/soroban-spec-typescript/src/boilerplate.rs,rust-path-traversal:cmd/crates/stellar-ledger/src/emulator_test_support/speculos.rs,rust-path-traversal:cmd/soroban-cli/src/cli.rs,rust-path-traversal:cmd/soroban-cli/src/commands/contract/build.rs,rust-path-traversal:cmd/soroban-cli/src/commands/contract/init.rs,rust-serde-security:cmd/soroban-cli/src/commands/contract/arg_parsing.rs,rust-serde-security:cmd/soroban-cli/src/commands/token/decimals.rs,rust-serde-security:cmd/soroban-cli/src/commands/token/name.rs,rust-serde-security:cmd/soroban-cli/src/commands/token/symbol.rs,rust-unsafe-usage:cmd/soroban-cli/src/commands/contract/invoke.rs,rust-hardcoded-secrets:cmd/soroban-cli/src/config/network.rs,rust-hardcoded-secrets:cmd/soroban-cli/src/utils.rs",
+  "secret_scanning_enabled": true,
+  "console_tabular_enabled": true,
+  "socket_tier_1_enabled": false,
+  "trivy_vuln_enabled": false,
+  "trufflehog_exclude_dir": "node_modules,dist,build,vendor,target,.git,__fixtures__,__mocks__,__snapshots__,__tests__,acceptance-test,acceptance-tests,acceptance_test,acceptance_tests,benches,browser-test,browser-tests,browser_test,browser_tests,e2e,e2e-test,e2e-tests,e2e_test,e2e_tests,example,examples,fixtures,functional-test,functional-tests,functional_test,functional_tests,integration-test,integration-tests,integration_test,integration_tests,integrationtest,integrationtests,mock,mock-dapp,mocks,perf-test,perf-tests,perf_test,perf_tests,performance-test,performance-tests,performance_test,performance_tests,regression-test,regression-tests,regression_test,regression_tests,smoke-test,smoke-tests,smoke_test,smoke_tests,spec,specs,test,test-data,test-fixtures,testFixtures,testdata,testfixtures,tests,unit-test,unit-tests,unit_test,unit_tests,*.test.js,*.test.jsx,*.test.ts,*.test.tsx,*.test.mjs,*.spec.js,*.spec.jsx,*.spec.ts,*.spec.tsx,*_test.go,*_test.py,*_test.rb,*_test.exs,test_*.py,*Test.java,*Tests.java,*Test.kt,*Tests.kt,*Test.scala,*Test.cs,*Tests.cs,tests.rs,test.rs,yarn.lock,package-lock.json,pnpm-lock.yaml,Cargo.lock,go.sum,poetry.lock,Gemfile.lock,composer.lock,cmd/soroban-cli/src/commands/network/ls.rs,cmd/soroban-cli/src/config/data.rs,cmd/soroban-cli/src/config/network.rs,cmd/soroban-cli/src/utils.rs,soroban-test,ts-tests"
+}