Add Socket Basics security scanning workflow

Runs SAST through OpenGrep, secret scanning through TruffleHog, and
Dockerfile misconfiguration scanning through Trivy, submitting results
to Socket.dev.

  .github/workflows/socket-basics.yml  scheduled weekly + manual dispatch
  .socket-basics.json                  scanner configuration
  .semgrepignore                       SAST path exclusions
  .trivyignore                         Dockerfile lint rules with no
                                       security dimension (only present
                                       where the repo has a Dockerfile)

Separate from socket-scan.yml, which covers dependency CVEs and Tier 1
reachability.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Author: kanwalpreetd

.github/workflows/socket-basics.yml

@@ -0,0 +1,48 @@
+# Socket Basics security scan for stellar-cli.
+# Upstream: https://github.com/SocketDev/socket-basics
+# Scanner settings live in .socket-basics.json; SAST path exclusions live in
+# .semgrepignore.
+#
+# This workflow does SAST through OpenGrep and secret scanning through
+# TruffleHog, and submits results to Socket.dev
+
+name: Socket Basics security scan
+
+on:
+  workflow_dispatch:
+  schedule:
+    - cron: "26 14 * * 6"
+
+permissions:
+  contents: read
+
+jobs:
+  socket-basics:
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        with:
+          # Remove the GitHub token from the workspace after checkout, so it is
+          # not mounted into the Socket Basics container, which doesn't need it.
+          persist-credentials: false
+
+      - name: Run Socket Basics
+        env:
+          SOCKET_SECURITY_API_TOKEN: ${{ secrets.SOCKET_SECURITY_API_TOKEN }}
+          SOCKET_ORG: stellar
+        run: |
+          # Socket Basics is pinned by digest since rule tuning is calibrated
+          # to the exact ruleset contained in this image. Automatic updates
+          # could introduce new rules and a sudden increase in false
+          # positives, as these tools are generally noisy without tuning.
+          docker run --rm \
+            -v "$PWD:/github/workspace" \
+            -w /github/workspace \
+            -e SOCKET_SECURITY_API_TOKEN \
+            -e SOCKET_ORG \
+            -e GITHUB_REPOSITORY \
+            -e GITHUB_REF_NAME \
+            -e GITHUB_SHA \
+            ghcr.io/socketdev/socket-basics@sha256:d463bae84f21d0240d5e197acb81e95144a966a20ab7cd05cca3a70e1796a4bb \
+            --config .socket-basics.json

.semgrepignore

@@ -0,0 +1,112 @@
+# This file excludes scan paths from Socket Basics SAST scanning (through OpenGrep).
+# It replaces the built-in ignore list for scanning with a more thorough list of paths.
+
+# --- third-party / generated ---
+.git/
+node_modules/
+vendor/
+third_party/
+thirdparty/
+.devcontainer/
+dist/
+build/
+target/
+.venv/
+venv/
+__pycache__/
+.yarn/
+generated/
+*.min.js
+
+# --- test / example / mock code ---
+__fixtures__/
+__mocks__/
+__snapshots__/
+__tests__/
+acceptance-test/
+acceptance-tests/
+acceptance_test/
+acceptance_tests/
+benches/
+browser-test/
+browser-tests/
+browser_test/
+browser_tests/
+e2e/
+e2e-test/
+e2e-tests/
+e2e_test/
+e2e_tests/
+example/
+examples/
+fixtures/
+functional-test/
+functional-tests/
+functional_test/
+functional_tests/
+integration-test/
+integration-tests/
+integration_test/
+integration_tests/
+integrationtest/
+integrationtests/
+mock/
+mock-dapp/
+mocks/
+perf-test/
+perf-tests/
+perf_test/
+perf_tests/
+performance-test/
+performance-tests/
+performance_test/
+performance_tests/
+regression-test/
+regression-tests/
+regression_test/
+regression_tests/
+smoke-test/
+smoke-tests/
+smoke_test/
+smoke_tests/
+spec/
+specs/
+test/
+test-data/
+test-fixtures/
+testFixtures/
+testdata/
+testfixtures/
+tests/
+unit-test/
+unit-tests/
+unit_test/
+unit_tests/
+*.test.js
+*.test.jsx
+*.test.ts
+*.test.tsx
+*.test.mjs
+*.spec.js
+*.spec.jsx
+*.spec.ts
+*.spec.tsx
+*_test.go
+*_test.py
+*_test.rb
+*_test.exs
+test_*.py
+*Test.java
+*Tests.java
+*Test.kt
+*Tests.kt
+*Test.scala
+*Test.cs
+*Tests.cs
+tests.rs
+test.rs
+
+# --- repo-specific third-party (PER_REPO_VENDORED +
+# git submodules); the generic patterns above cannot know these ---
+soroban-test/
+ts-tests/

.socket-basics.json

@@ -0,0 +1,13 @@
+{
+  "workspace": ".",
+  "javascript_sast_enabled": true,
+  "ruby_sast_enabled": true,
+  "rust_sast_enabled": true,
+  "rust_disabled_rules": "rust-env-injection,rust-panic-in-production,rust-sql-injection",
+  "sast_ignore_overrides": "rust-hardcoded-secrets:cmd/crates/stellar-ledger/src/lib.rs,rust-hardcoded-secrets:cmd/soroban-cli/src/commands/container/shared.rs,rust-hardcoded-secrets:cmd/soroban-cli/src/commands/contract/upload.rs,rust-hardcoded-secrets:cmd/soroban-cli/src/commands/keys/add.rs,rust-hardcoded-secrets:cmd/soroban-cli/src/commands/keys/fund.rs,rust-hardcoded-secrets:cmd/soroban-cli/src/commands/keys/public_key.rs,rust-hardcoded-secrets:cmd/soroban-cli/src/commands/message/sign.rs,rust-hardcoded-secrets:cmd/soroban-cli/src/commands/message/verify.rs,rust-hardcoded-secrets:cmd/soroban-cli/src/commands/tx/new/clawback_claimable_balance.rs,rust-hardcoded-secrets:cmd/soroban-cli/src/config/address.rs,rust-hardcoded-secrets:cmd/soroban-cli/src/config/key.rs,rust-hardcoded-secrets:cmd/soroban-cli/src/config/locator.rs,rust-hardcoded-secrets:cmd/soroban-cli/src/config/secret.rs,rust-hardcoded-secrets:cmd/soroban-cli/src/signer/mod.rs,rust-command-injection:cmd/soroban-cli/src/commands/doctor.rs,rust-integer-overflow:cmd/soroban-cli/src/commands/tx/fetch/fee.rs,rust-memory-safety:cmd/crates/soroban-spec-tools/src/contract.rs,rust-memory-safety:cmd/soroban-cli/src/assembled.rs,rust-memory-safety:cmd/soroban-cli/src/commands/contract/arg_parsing.rs,rust-memory-safety:cmd/soroban-cli/src/tx.rs,rust-path-traversal:cmd/crates/soroban-spec-typescript/src/boilerplate.rs,rust-path-traversal:cmd/crates/stellar-ledger/src/emulator_test_support/speculos.rs,rust-path-traversal:cmd/soroban-cli/src/cli.rs,rust-path-traversal:cmd/soroban-cli/src/commands/contract/build.rs,rust-path-traversal:cmd/soroban-cli/src/commands/contract/init.rs,rust-serde-security:cmd/soroban-cli/src/commands/contract/arg_parsing.rs,rust-serde-security:cmd/soroban-cli/src/commands/token/decimals.rs,rust-serde-security:cmd/soroban-cli/src/commands/token/name.rs,rust-serde-security:cmd/soroban-cli/src/commands/token/symbol.rs,rust-unsafe-usage:cmd/soroban-cli/src/commands/contract/invoke.rs,rust-hardcoded-secrets:cmd/soroban-cli/src/config/network.rs,rust-hardcoded-secrets:cmd/soroban-cli/src/utils.rs",
+  "secret_scanning_enabled": true,
+  "console_tabular_enabled": true,
+  "socket_tier_1_enabled": false,
+  "trivy_vuln_enabled": false,
+  "trufflehog_exclude_dir": "node_modules,dist,build,vendor,target,.git,yarn.lock,package-lock.json,pnpm-lock.yaml,Cargo.lock,go.sum,poetry.lock,Gemfile.lock,composer.lock,cmd/soroban-cli/src/commands/network/ls.rs,cmd/soroban-cli/src/config/data.rs,cmd/soroban-cli/src/config/network.rs,cmd/soroban-cli/src/utils.rs,soroban-test,ts-tests"
+}