add socket tier 1 reachability analysis - #82
Conversation
There was a problem hiding this comment.
Pull request overview
Adds an automated Socket “Tier 1 reachability” scan workflow to continuously assess dependency vulnerabilities with reachability context, running on a weekly schedule and via manual dispatch.
Changes:
- Introduces a new GitHub Actions workflow to run
socket scan create --reachon a schedule and on-demand. - Sets up Go + Node toolchains, installs Socket CLI, and runs the scan.
- Marks runs “yellow” (warning) when output indicates Tier 2 reachability fallbacks without failing the job.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0 | ||
| with: | ||
| go-version: "1.26.4" |
| - name: Install Socket CLI | ||
| run: npm install -g socket |
| - name: Run Socket reachability scan | ||
| env: | ||
| SOCKET_SECURITY_API_TOKEN: ${{ secrets.SOCKET_SECURITY_API_TOKEN }} | ||
| run: | |
| --reach-continue-on-missing-lock-files \ | ||
| . 2>&1 | tee /tmp/scan.log | ||
| rc=${PIPESTATUS[0]} | ||
| if [ $rc -eq 0 ] && grep -qE "Reachability falls back to Tier 2|fallback to the results from the pre-computed|Reachability falls back to precomputed" /tmp/scan.log; then |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 51f32fcd1f
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
| # annotation that GitHub Actions renders as a yellow run-level | ||
| # warning without failing the job. | ||
| set +e | ||
| socket scan create --reach \ |
There was a problem hiding this comment.
For scheduled/manual runs in this repo there is no socket.json or other Socket config, and the Socket CLI docs for socket scan create say --repo/--branch are what associate a scan with a repository/branch and otherwise default to socket-default-repository/socket-default-branch (https://docs.socket.dev/docs/socket-scan#socket-scan-create). As written, the weekly Galexie scan is uploaded under those generic defaults instead of stellar-galexie on the current/default branch, so the intended repository alerts/head scan will not be updated and scans from other repos using the same defaults can collide.
Useful? React with 👍 / 👎.
More info: https://stellarorg.atlassian.net/wiki/spaces/SCRT/pages/5689311233/Socket+Tier+1+Reachability+Analysis