Socket: repository configuration

[mrrobertkent]

Adds socket.yml (schema version 2, https://docs.socket.dev/docs/socket-yml, retrieved 2026-10-08) so Socket's behaviour on this repo is explicit and survives organisation-level changes:

• Pull request alerts, dependency overview comments, project reports and check runs stay on. They run on every pull request, Dependabot's included (no triggerPaths or ignoreUsers), so a new dependency is reviewed whichever PR adds it.
• dist (local build output) is never ingested.
• No alert rules are disabled. issueRules is deprecated in favour of repository labels and is left to the dashboard policy.

Socket ingests manifests only: go.mod/go.sum (GA) and .github/workflows (experimental). It does not read the Dockerfile or the example compose files (https://docs.socket.dev/docs/manifest-file-detection-in-socket); Dependabot covers those digest pins.

Validated with Socket's parser, @socketsecurity/config parseSocketConfig.

Summary by CodeRabbit

• New Features
  • Enabled pull request alerts, dependency overviews, and project reports for supported repositories.
  • Added GitHub App support to provide these repository insights.
• Configuration
  • Excluded generated distribution files from analysis.

[coderabbitai]

Important

Review skipped

Review was skipped as selected files did not have any reviewable changes.

⚙️ Run configuration

• Configuration used: Repository: mrrobertkent/hookgate/.coderabbit.yaml
• Review profile: CHILL
• Plan: Advanced
• Run ID: 07ca6f68-fa67-4c77-9a76-eadc053774ce

📥 Commits

Reviewing files that changed from the base of the PR and between 2f1921c and 4601155.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: a9b116c1-a0b3-45f1-83a7-cd4d36f798ae

📥 Commits

Reviewing files that changed from the base of the PR and between b1d2c35 and 2f1921c.

📒 Files selected for processing (1)

• socket.yml

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 2 remain after this review.

---

📝 Walkthrough

Walkthrough

The pull request adds Socket configuration version 2, ignores dist, and enables GitHub App alerts, dependency overview, and project reports. Comments describe which manifests, workflows, and image files are included or excluded.

Changes

Socket configuration

Layer / File(s)	Summary
Socket settings socket.yml	The configuration sets version 2, ignores dist, and enables GitHub App alerts, dependency overview, and project reports. Comments describe ingested manifests and workflows and excluded Dockerfile and example compose-file images.

Priority: ⬇️ Low

Estimated code review effort: 1 (Trivial) | ~4 minutes

Change: Other

Merge Risk: ⚪ Minimal · up to 2f192

The configured Go manifests and workflow files are the supported Socket inputs; Dockerfile and Compose images are not ingested. No input-scope issue remains that should block merging.

Security Architecture Review

Security architecture risk: 🔵 Low · up to 2f192

This is a small configuration change that enables security reporting and excludes build output. It contains no credentials or explicit permission grants. The installed app’s permissions, effective dashboard policy, and behavior after reverting the configuration were not available for verification.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Blast Radius

• inferred — The directly configured surface is this repository’s Socket analysis and reporting. The file does not establish the external app’s maximum repository access, report audience, or organization-wide authority.

Trust Boundaries and Controls

• inferred — Repository configuration selects reporting capabilities consumed by an external GitHub App; those selections are distinct from granting installation permissions. The source does not demonstrate a new privilege grant, but effective authority and policy precedence remain unverified.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly identifies the main change: adding repository-level Socket configuration. It is concise and specific.
Description check	✅ Passed	The description explains the configuration changes, user-facing behavior, manifest coverage, exclusions, and validation. It does not use the template headings or include the checklist, but it provides…
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

_{Comment @coderabbitai help to get the list of available commands.}

[gitar-bot]

Code Review ✅ Approved

🟡 Medium risk · Enabling Socket alerts, dependency comments, reports, and check runs for every pull request could add unexpected automated feedback and checks.

Adds a socket.yml (schema version 2) that keeps Socket pull request alerts, dependency overview comments, project reports and check runs enabled on every pull request, including Dependabot's, and excludes dist from ingestion. No alert rules are disabled. No issues found.

Review coverage

📋 Rules No rules evaluated

🧪 Functional validation Not enabled · Set up

Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Counting what did not apply, without listing it.

Comment with these commands to change the behavior for this request:

Auto-apply	Compact
gitar auto-apply:on	gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Gitar}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud