Skip to content

Add Socket Basics security scanning workflow - #189

Merged
kanwalpreetd merged 1 commit into
stellar:masterfrom
kanwalpreetd:master
Oct 19, 2026
Merged

Add Socket Basics security scanning workflow#189
kanwalpreetd merged 1 commit into
stellar:masterfrom
kanwalpreetd:master

Conversation

@kanwalpreetd

@kanwalpreetd kanwalpreetd commented Sep 17, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

@kanwalpreetd
kanwalpreetd force-pushed the master branch 4 times, most recently from bce9593 to f969f0a Compare September 26, 2026 01:29
@kanwalpreetd
kanwalpreetd marked this pull request as ready for review September 28, 2026 12:40
Copilot AI lite review requested due to automatic review settings September 28, 2026 12:40
Copilot AI reviewed Sep 28, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot review overview

🟡 Changes recommended

The workflow can report success when the scan completion marker is missing.

Review effort: Lite
Findings: 1 Medium severity

Open (1)
What changed in this PR

Adds scheduled and manual Socket Basics security scanning for SAST, secrets, and Dockerfile checks.

Changes:

  • Adds scanner configuration and exclusion files.
  • Adds a pinned GitHub Actions workflow.
  • Configures findings as warnings.
  • Requires a fix for incomplete scans being reported as successful.
File Description
.trivyignore Configures excluded Dockerfile rules
.socket-basics.json Enables and configures Socket scanning
.semgrepignore Defines SAST exclusions
.github/​workflows/​socket-basics.yml Runs the scheduled/manual security scan

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

Comment thread .github/workflows/socket-basics.yml Resolved
Copilot AI review requested due to automatic review settings September 29, 2026 07:16
Copilot AI reviewed Sep 29, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot review overview

🔵 Needs a closer look

The workflow may miss scan failures and severity warnings, while broad exclusions omit runtime code from security scanning.

Review effort: Lite
Findings: None

Resolved since last review (1)

Copilot AI review requested due to automatic review settings September 29, 2026 08:52
Copilot AI reviewed Sep 29, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot review overview

🟡 Changes recommended

The workflow exposes persisted credentials to a third-party container, and broad exclusions omit significant package implementations from security scans.

Review effort: Lite
Findings: 1 High severity

Open (1)

Comment thread .github/workflows/socket-basics.yml Resolved
Copilot AI review requested due to automatic review settings September 29, 2026 09:31
Copilot AI reviewed Sep 29, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot review overview

🟡 Changes recommended

Narrow the tests/ exclusions so published runtime code remains covered by security scans.

Review effort: Lite
Findings: 1 High severity · 2 Medium severity

Open (3)

Comment thread .semgrepignore Resolved
Comment thread .socket-basics.json Resolved
Copilot AI lite review requested due to automatic review settings September 29, 2026 22:05
Copilot AI reviewed Sep 29, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot review overview

🟡 Changes recommended

The workflow has a critical clean-scan failure, and broad tests exclusions create scanning blind spots.

Review effort: Lite
Findings: 1 High severity · 2 Medium severity

Open (3)
Resolved since last review (1)

Comment thread .github/workflows/socket-basics.yml Resolved
Copilot AI lite review requested due to automatic review settings September 29, 2026 22:43
Copilot AI reviewed Sep 29, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot review overview

🔵 Needs a closer look

Two moderate exclusions may silently omit production code from security scanning.

Review effort: Lite
Findings: 1 High severity · 2 Medium severity

Open (3)

Copilot AI lite review requested due to automatic review settings September 29, 2026 23:19
Copilot AI reviewed Sep 29, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot review overview

🟡 Changes recommended

Broad tests exclusions omit published runtime code from SAST and secret scanning.

Review effort: Lite
Findings: 2 High severity · 2 Medium severity

Open (4)

Comment thread .semgrepignore Resolved
Copilot AI lite review requested due to automatic review settings September 30, 2026 00:18
Copilot AI reviewed Sep 30, 2026

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

Copilot AI lite review requested due to automatic review settings October 2, 2026 01:51
Copilot AI reviewed Oct 2, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot review overview

🔵 Needs a closer look

Anchor the .semgrepignore tests/ exclusion to avoid omitting production runtime code.

Review effort: Lite
Findings: 1 High severity · 2 Medium severity

Open (3)
Resolved since last review (1)

Copilot AI lite review requested due to automatic review settings October 2, 2026 02:25
Copilot AI reviewed Oct 2, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot review overview

🔵 Needs a closer look

The broad tests/ Semgrep exclusion skips production code under @stellar/anchor-tests/src/tests.

Review effort: Lite
Findings: 1 High severity · 2 Medium severity

Open (3)

@kanwalpreetd @claude
Add Socket Basics security scanning workflow
a22bccd 
Runs SAST through OpenGrep, secret scanning through TruffleHog, and
Dockerfile misconfiguration scanning through Trivy, submitting results
to Socket.dev.

  .github/workflows/socket-basics.yml  scheduled weekly + manual dispatch
  .socket-basics.json                  scanner configuration
  .semgrepignore                       SAST path exclusions
  .trivyignore                         Dockerfile lint rules with no
                                       security dimension (only present
                                       where the repo has a Dockerfile)

Separate from socket-scan.yml, which covers dependency CVEs and Tier 1
reachability.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Copilot AI lite review requested due to automatic review settings October 2, 2026 05:57
Copilot AI reviewed Oct 2, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot review overview

🟡 Changes recommended

Scope the unhandled promise rejection suppression or fix the underlying issue.

Review effort: Lite
Findings: 1 Medium severity

Open (1)
Resolved since last review (3)

Comment thread .socket-basics.json Resolved
@kanwalpreetd

kanwalpreetd commented Oct 2, 2026

Copy link
Copy Markdown
Contributor Author

Copilot review overview

🟡 Changes recommended

Scope the unhandled promise rejection suppression or fix the underlying issue.

Review effort: Lite Findings: 1 Medium severity

Open (1)

Resolved since last review (3)

This is intentional to control false positives and allow for easier integration across all repos. More info about rule tuning methodology: https://stellarorg.atlassian.net/wiki/spaces/SCRT/pages/5901680652/Socket+Basics+Integration+Guide#Tuning-false-positives.

@kanwalpreetd
kanwalpreetd merged commit 84a8742 into stellar:master Oct 19, 2026
2 of 3 checks passed
@github-actions

github-actions Bot commented Oct 19, 2026

Copy link
Copy Markdown

PR Preview: torn down

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot
Copilot review effort
Applies to this pull request for everyone.Learn more about Copilot code review.
Copilot left review comments
@amandagonsalves amandagonsalves amandagonsalves approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@kanwalpreetd @amandagonsalves