Add Socket Basics security scanning workflow by kanwalpreetd · Pull Request #254 · stellar/typescript-wallet-sdk

kanwalpreetd · 2026-09-17T17:46:36Z

More info: https://stellarorg.atlassian.net/wiki/spaces/SCRT/pages/5901680652/Socket+Basics+Integration+Guide

Copilot

Copilot review overview

🟡 Changes recommended

Critical authentication and scan-result handling issues remain unresolved.

Review effort: Lite
Findings: 2 · 1

Open (3)

Use expected Socket Security API key environment variable · New
Successful Docker exit masks incomplete scan · New
Trivy Dockerfile scan is disabled despite workflow comment · New

What changed in this PR

Adds scheduled and manually triggered Socket Basics security scanning with scanner configuration, Semgrep exclusions, and a pinned Docker workflow.

Changes:

Adds Socket Basics scanner configuration.
Adds Semgrep ignore paths.
Adds scheduled/manual GitHub Actions scanning.

File	Summary
`.socket-basics.json`	Configures scanners and exclusions; Trivy vulnerability scanning is disabled.
`.semgrepignore`	Defines SAST exclusion paths.
`.github/workflows/socket-basics.yml`	Runs the scan; critical issues affect authentication and incomplete-scan failure handling, plus a nit regarding the Trivy comment.

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

Copilot

Copilot review overview

🔵 Needs a closer look

Broad TruffleHog exclusions prevent scanning tests, fixtures, and examples for committed secrets.

Review effort: Lite
Findings: 1 · 1

Open (2)

Use expected Socket Security API key environment variable
Trivy Dockerfile scan is disabled despite workflow comment

Resolved since last review (1)

Successful Docker exit masks incomplete scan

Copilot

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

Copilot

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

Copilot

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

Copilot

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

Copilot

Copilot review overview

🔵 Needs a closer look

The workflow can report success after facts are written despite later operational failures.

Review effort: Lite
Findings: 1

Open (1)

Use expected Socket Security API key environment variable

Resolved since last review (1)

Trivy Dockerfile scan is disabled despite workflow comment

Copilot

Copilot review overview

🟡 Changes recommended

The workflow incorrectly fails clean scans when the valid components array is empty.

Review effort: Lite
Findings: 2

Open (2)

Rejects valid empty components array as incomplete scan · New
Use expected Socket Security API key environment variable

Copilot

Copilot review overview

🟡 Changes recommended

Narrow the TruffleHog exclusions so credentials in test and fixture paths remain detectable.

Review effort: Lite
Findings: 2

Open (2)

Avoid excluding test and fixture paths from secret scanning · New
Use expected Socket Security API key environment variable

Resolved since last review (1)

Rejects valid empty components array as incomplete scan

Copilot

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

Copilot

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

Runs SAST through OpenGrep, secret scanning through TruffleHog, and Dockerfile misconfiguration scanning through Trivy, submitting results to Socket.dev. .github/workflows/socket-basics.yml scheduled weekly + manual dispatch .socket-basics.json scanner configuration .semgrepignore SAST path exclusions .trivyignore Dockerfile lint rules with no security dimension (only present where the repo has a Dockerfile) Separate from socket-scan.yml, which covers dependency CVEs and Tier 1 reachability. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Copilot

Copilot review overview

🔵 Needs a closer look

Address the frozen scanner image update path and avoid file-wide secret-scanning exclusions.

Review effort: Lite
Findings: 1

Open (1)

Use expected Socket Security API key environment variable

Resolved since last review (1)

Avoid excluding test and fixture paths from secret scanning

kanwalpreetd · 2026-10-02T18:52:41Z

Copilot review overview

🔵 Needs a closer look

Address the frozen scanner image update path and avoid file-wide secret-scanning exclusions.

Review effort: Lite Findings: 1

Open (1)

Use expected Socket Security API key environment variable

Resolved since last review (1)

Regarding frozen scanner image update path: that is stale suggestion on outdated code.
Regarding avoid file-wide secret-scanning exclusions: There is no way to switch off a detector or suppress a single finding inside a file for secret scanning through socket basics wrapper, this is required to control false positives. More info: https://stellarorg.atlassian.net/wiki/spaces/SCRT/pages/5901680652/Socket+Basics+Integration+Guide#Tuning-false-positives
Regarding Use expected Socket Security API key environment variable: this is a false suggestion.

kanwalpreetd force-pushed the main branch 4 times, most recently from 36fdec1 to 450510f Compare September 26, 2026 01:31

kanwalpreetd marked this pull request as ready for review September 28, 2026 12:42

Copilot AI lite review requested due to automatic review settings September 28, 2026 12:42

Copilot started reviewing on behalf of kanwalpreetd September 28, 2026 12:42

View session

Copilot AI reviewed Sep 28, 2026

View reviewed changes

Comment thread .github/workflows/socket-basics.yml Resolved

Comment thread .github/workflows/socket-basics.yml Resolved

Comment thread .github/workflows/socket-basics.yml Resolved

Copilot AI review requested due to automatic review settings September 29, 2026 07:19

kanwalpreetd force-pushed the main branch from 450510f to 9ca19ca Compare September 29, 2026 07:19

Copilot started reviewing on behalf of kanwalpreetd September 29, 2026 07:19

View session

Copilot AI reviewed Sep 29, 2026

View reviewed changes

Copilot AI review requested due to automatic review settings September 29, 2026 07:30

kanwalpreetd force-pushed the main branch from 9ca19ca to 54df2f8 Compare September 29, 2026 07:30

Copilot AI reviewed Sep 29, 2026

Copilot AI review requested due to automatic review settings September 29, 2026 08:54

kanwalpreetd force-pushed the main branch from 54df2f8 to 7317efe Compare September 29, 2026 08:54

Copilot AI reviewed Sep 29, 2026

Copilot AI review requested due to automatic review settings September 29, 2026 09:33

kanwalpreetd force-pushed the main branch from 7317efe to 03473ea Compare September 29, 2026 09:33

Copilot AI reviewed Sep 29, 2026

Copilot AI lite review requested due to automatic review settings September 29, 2026 22:07

kanwalpreetd force-pushed the main branch from 03473ea to a30adaa Compare September 29, 2026 22:07

Copilot AI reviewed Sep 29, 2026

kanwalpreetd force-pushed the main branch from a30adaa to c93fece Compare September 29, 2026 22:44

Copilot AI lite review requested due to automatic review settings September 29, 2026 22:44

Copilot started reviewing on behalf of kanwalpreetd September 29, 2026 22:45

View session

Copilot AI reviewed Sep 29, 2026

View reviewed changes

Copilot AI lite review requested due to automatic review settings September 29, 2026 23:20

kanwalpreetd force-pushed the main branch from c93fece to d772ce5 Compare September 29, 2026 23:20

Copilot started reviewing on behalf of kanwalpreetd September 29, 2026 23:21

View session

Copilot AI reviewed Sep 29, 2026

View reviewed changes

Comment thread .github/workflows/socket-basics.yml Resolved

Copilot AI lite review requested due to automatic review settings September 30, 2026 00:19

kanwalpreetd force-pushed the main branch from d772ce5 to 077324a Compare September 30, 2026 00:19

Copilot started reviewing on behalf of kanwalpreetd September 30, 2026 00:20

View session

Copilot AI reviewed Sep 30, 2026

View reviewed changes

Comment thread .socket-basics.json Resolved

kanwalpreetd force-pushed the main branch from 077324a to 36c5304 Compare October 2, 2026 01:52

Copilot AI lite review requested due to automatic review settings October 2, 2026 01:52

Copilot AI reviewed Oct 2, 2026

kanwalpreetd force-pushed the main branch from 36c5304 to 0044f3a Compare October 2, 2026 02:27

Copilot AI lite review requested due to automatic review settings October 2, 2026 02:27

Copilot AI reviewed Oct 2, 2026

Copilot AI lite review requested due to automatic review settings October 2, 2026 06:05

kanwalpreetd force-pushed the main branch from 0044f3a to e7f64e8 Compare October 2, 2026 06:05

Copilot started reviewing on behalf of kanwalpreetd October 2, 2026 06:06

View session

Copilot AI reviewed Oct 2, 2026

View reviewed changes

kanwalpreetd requested a review from aristidesstaffieri October 2, 2026 20:30

JakeUrban approved these changes Oct 7, 2026

View reviewed changes

JakeUrban merged commit 5800630 into stellar:main Oct 7, 2026
8 checks passed

CassioMG mentioned this pull request Oct 15, 2026

Release/5.1.0 #260

Merged

Conversation

kanwalpreetd commented Sep 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Copilot review overview

🟡 Changes recommended

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Copilot review overview

🔵 Needs a closer look

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Copilot review overview

🔵 Needs a closer look

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Copilot review overview

🟡 Changes recommended

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Copilot review overview

🟡 Changes recommended

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Copilot review overview

🔵 Needs a closer look

Uh oh!

kanwalpreetd commented Oct 2, 2026

Copilot review overview

🔵 Needs a closer look

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

kanwalpreetd commented Sep 17, 2026 •

edited

Loading