add socket tier 1 reachability analysis - #433
Conversation
There was a problem hiding this comment.
Pull request overview
Adds a scheduled GitHub Actions workflow to run Socket’s “full application reachability” analysis for stellar-etl, with job semantics that distinguish Tier 1 reachability success from Tier 2 fallback (non-failing warning).
Changes:
- Introduces a weekly + on-demand “Socket reachability scan” workflow.
- Installs required toolchains (Go/Node) and the Socket CLI, then runs
socket scan create --reach. - Parses scan output to emit a
::warning::when Tier 1 reachability falls back to Tier 2, without failing the job.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0 | ||
| with: | ||
| go-version: "1.26.4" |
| - name: Run Socket reachability scan | ||
| env: | ||
| SOCKET_SECURITY_API_TOKEN: ${{ secrets.SOCKET_SECURITY_API_TOKEN }} | ||
| run: | |
| - name: Install Socket CLI | ||
| run: npm install -g socket |
| # Force JS-based GitHub actions (actions/checkout, actions/setup-*, etc.) to | ||
| # use Node 24 instead of the soon-to-be-deprecated Node 20. Safe to remove | ||
| # after 2026-06-16 (when Node 24 becomes the default and this becomes a no-op). | ||
| FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 59d1043931
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
| socket scan create --reach \ | ||
| --org=stellar \ | ||
| --no-interactive \ |
There was a problem hiding this comment.
In this scheduled runner there is no checked-in Socket config (socket.json/socket.yml) to supply scan defaults, and Socket's scan create docs state that --repo and --branch are what associate a scan with a repository/branch, defaulting to socket-default-repository and socket-default-branch when omitted. As written, the weekly Tier 1 scan can succeed but publish results under Socket's default project/branch instead of stellar-etl/master, so this repository's dashboard/head scan will not be updated; pass explicit repo and branch values (and mark the default branch once) in this command.
Useful? React with 👍 / 👎.
More info: https://stellarorg.atlassian.net/wiki/spaces/SCRT/pages/5689311233/Socket+Tier+1+Reachability+Analysis