Add Socket Basics security scanning workflow

[kanwalpreetd]

More info: https://stellarorg.atlassian.net/wiki/spaces/SCRT/pages/5901680652/Socket+Basics+Integration+Guide

[Copilot]

Copilot review overview

🟡 Changes recommended

Fix the incomplete-scan exit handling and align the advertised Trivy coverage with the configured scans.

Review effort: Lite
Findings: 1

Open (1)

• Incomplete scan can incorrectly mark the GitHub job successful · New

What changed in this PR

Adds scheduled/manual Socket Basics security scanning for SAST, secrets, and repository analysis.

Changes:

• Adds Socket Basics configuration and exclusions.
• Adds Semgrep exclusion patterns.
• Adds a pinned Docker-based GitHub Actions workflow.

File	Summary
.socket-basics.json	Scanner settings and exclusions
.semgrepignore	SAST path exclusions
.github/​workflows/​socket-basics.yml	Scheduled/manual scan execution

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Copilot review overview

🟡 Changes recommended

Address the workflow command-injection risk and narrow or correct the scanner exclusions and disabled checks.

Review effort: Lite
Findings: 1

Open (1)

• Untrusted scanner output can inject GitHub Actions commands · New

Resolved since last review (1)

• Incomplete scan can incorrectly mark the GitHub job successful

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

[Copilot]

Copilot review overview

🟡 Changes recommended

Unresolved critical and moderate findings affect scan coverage, authentication, failure handling, and timeout behavior.

Review effort: Lite
Findings: 2 · 1

Open (3)

• Avoid globally disabling rust-panic-in-production · New
• Untrusted scanner output can inject GitHub Actions commands
• Handle partial scanner failures and distinguish findings from operational errors · New

[Copilot]

Copilot review overview

🟡 Changes recommended

Critical production-code scan exclusions and workflow failure handling can allow security issues to pass unnoticed.

Review effort: Lite
Findings: 5 · 1

Open (6)

• Broad soroban-test exclusion skips production SAST coverage · New
• File-wide secret suppressions hide real credentials · New
• TruffleHog exclusions hide secrets in production files · New
• Avoid globally disabling rust-panic-in-production
• Untrusted scanner output can inject GitHub Actions commands
• Handle partial scanner failures and distinguish findings from operational errors

[Copilot]

Copilot review overview

🔵 Needs a closer look

Narrow or remove the broad Rust rule disables and production-file TruffleHog exclusions.

Review effort: Lite
Findings: 5 · 1

Open (6)

• TruffleHog exclusions hide secrets in production files
• File-wide secret suppressions hide real credentials
• Broad soroban-test exclusion skips production SAST coverage
• Avoid globally disabling rust-panic-in-production
• Untrusted scanner output can inject GitHub Actions commands
• Handle partial scanner failures and distinguish findings from operational errors

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

[Copilot]

Copilot review overview

🟡 Changes recommended

Blanket secret-scanning exclusions allow credentials accidentally committed in tests, fixtures, or examples to go undetected.

Review effort: Lite
Findings: 5 · 1

Open (6)

• TruffleHog exclusions hide secrets in production files
• File-wide secret suppressions hide real credentials
• Broad soroban-test exclusion skips production SAST coverage
• Avoid globally disabling rust-panic-in-production
• Untrusted scanner output can inject GitHub Actions commands
• Avoid excluding test and fixture paths from secret scanning · New

Resolved since last review (1)

• Handle partial scanner failures and distinguish findings from operational errors

[Copilot]

Copilot review overview

🔵 Needs a closer look

Secret-scanning exclusions are overly broad and may hide credentials in production, test, and example files.

Review effort: Lite
Findings: 5 · 1

Open (6)

• TruffleHog exclusions hide secrets in production files
• File-wide secret suppressions hide real credentials
• Broad soroban-test exclusion skips production SAST coverage
• Avoid globally disabling rust-panic-in-production
• Untrusted scanner output can inject GitHub Actions commands
• Avoid excluding test and fixture paths from secret scanning

[Copilot]

Copilot review overview

🟡 Changes recommended

Critical scanner exclusions can hide secrets and vulnerabilities and must be narrowed.

Review effort: Lite
Findings: 7 · 1

Open (8)

• Keep environment- and SQL-injection rules enabled globally · New
• Avoid globally excluding credential-bearing source files from secret scans · New
• TruffleHog exclusions hide secrets in production files
• File-wide secret suppressions hide real credentials
• Broad soroban-test exclusion skips production SAST coverage
• Avoid globally disabling rust-panic-in-production
• Untrusted scanner output can inject GitHub Actions commands
• Avoid excluding test and fixture paths from secret scanning

[Copilot]

Copilot review overview

🔵 Needs a closer look

Narrow the TruffleHog exclusions in .socket-basics.json to preserve coverage of future credentials.

Review effort: Lite
Findings: 7 · 1

Open (8)

• Avoid globally excluding credential-bearing source files from secret scans
• Keep environment- and SQL-injection rules enabled globally
• TruffleHog exclusions hide secrets in production files
• File-wide secret suppressions hide real credentials
• Broad soroban-test exclusion skips production SAST coverage
• Avoid globally disabling rust-panic-in-production
• Untrusted scanner output can inject GitHub Actions commands
• Avoid excluding test and fixture paths from secret scanning

[Copilot]

Copilot review overview

🟢 Approval recommended

No unresolved blocking issues were identified.

Review effort: Lite
Findings: None

Resolved since last review (8)

• Avoid globally excluding credential-bearing source files from secret scans
• Keep environment- and SQL-injection rules enabled globally
• TruffleHog exclusions hide secrets in production files
• File-wide secret suppressions hide real credentials
• Broad soroban-test exclusion skips production SAST coverage
• Avoid globally disabling rust-panic-in-production
• Untrusted scanner output can inject GitHub Actions commands
• Avoid excluding test and fixture paths from secret scanning

[Copilot]

Copilot review overview

🔵 Needs a closer look

Narrow the TruffleHog exclusions so production source files remain covered.

Review effort: Lite
Findings: None