Repository navigation
Add Socket Basics security scanning workflow - #234
Merged
Merged
Conversation
kanwalpreetd
force-pushed
the
master
branch
4 times, most recently
from
September 26, 2026 01:31
3531c59 to
247c52f
Compare
kanwalpreetd
marked this pull request as ready for review
September 28, 2026 12:36
There was a problem hiding this comment.
Copilot review overview
🟡 Changes recommended
Unresolved critical workflow security and scan-result handling issues must be addressed before approval.
Review effort: Lite
Findings: 2
Open (3)
What changed in this PR
Adds scheduled/manual Socket Basics security scanning with SAST, secret detection, exclusions, and a pinned Docker-based workflow.
Changes:
- Configures Socket Basics scanners and exclusions.
- Adds Semgrep exclusion patterns.
- Adds the scheduled/manual security scan workflow.
| File | Summary and review findings |
|---|---|
.socket-basics.json |
Configures scanner settings and exclusions. Moderate (1 vote): Trivy scanning is disabled despite being claimed in the workflow description. |
.semgrepignore |
Defines SAST exclusion paths. |
.github/workflows/socket-basics.yml |
Runs the scheduled/manual scan. Critical (1 vote): Checkout credentials may be exposed to the third-party container. Critical (1 vote): High/critical findings are converted to success and the parser does not match the scanner output. Moderate (2 votes): An incomplete scan can pass when the container exits with status 0. Nit (1 vote): The Dockerfile scanning description does not match the configured coverage. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
kanwalpreetd
force-pushed
the
master
branch
from
September 29, 2026 07:19
247c52f to
6d6d1a1
Compare
kanwalpreetd
force-pushed
the
master
branch
from
September 29, 2026 07:30
6d6d1a1 to
c507ffa
Compare
kanwalpreetd
force-pushed
the
master
branch
from
September 29, 2026 08:54
c507ffa to
09dc481
Compare
kanwalpreetd
force-pushed
the
master
branch
from
September 29, 2026 09:33
09dc481 to
8e3817c
Compare
kanwalpreetd
force-pushed
the
master
branch
from
September 29, 2026 22:07
8e3817c to
fd5d55e
Compare
kanwalpreetd
force-pushed
the
master
branch
from
September 29, 2026 22:45
fd5d55e to
e61e682
Compare
kanwalpreetd
force-pushed
the
master
branch
from
September 29, 2026 23:20
e61e682 to
e4af624
Compare
kanwalpreetd
force-pushed
the
master
branch
from
September 30, 2026 00:20
e4af624 to
af0b202
Compare
Runs SAST through OpenGrep, secret scanning through TruffleHog, and
Dockerfile misconfiguration scanning through Trivy, submitting results
to Socket.dev.
.github/workflows/socket-basics.yml scheduled weekly + manual dispatch
.socket-basics.json scanner configuration
.semgrepignore SAST path exclusions
.trivyignore Dockerfile lint rules with no
security dimension (only present
where the repo has a Dockerfile)
Separate from socket-scan.yml, which covers dependency CVEs and Tier 1
reachability.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
anupsdf
approved these changes
Oct 2, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
More info: https://stellarorg.atlassian.net/wiki/spaces/SCRT/pages/5901680652/Socket+Basics+Integration+Guide