chore(deps): bundle Dependabot updates + harden dependency review workflows#78
Open
lelia wants to merge 3 commits into
Open
chore(deps): bundle Dependabot updates + harden dependency review workflows#78lelia wants to merge 3 commits into
lelia wants to merge 3 commits into
Conversation
Bundles 8 open Dependabot PRs into one verified change and hardens the Dependabot config + dependency-review workflows, mirroring the work in socket-sdk-python#84 and socket-python-cli#207/#217. Adds a supply-chain watch for the four core OSS tools Dependabot cannot cleanly track. - uv.lock: idna 3.10->3.18 (CVE-2026-45409), pygments 2.19.2->2.20.0, pytest 8.4.2->9.0.3, urllib3 2.6.3->2.7.0 - _docker-pipeline.yml: bump 4 docker/* actions (setup-buildx, login, metadata, build-push) - dependabot.yml: add uv ecosystem, group every ecosystem into minor/patch + major bundles, scan composite actions - dependency-review.yml (was dependabot-review.yml): runs on every PR; free/enterprise sfw split; report artifacts; app_tests docker smoke - core-tool-watch.yml + scripts/check_core_tools.py: discover latest versions of opengrep/trufflehog/trivy/socketdev and score them through the Socket API (socketdev SDK purl.post); drift issue + report artifact - python-tests.yml: uv.lock drift guard Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
… gate Mirroring the Python CLI/SDK used `environment: socket-firewall` to scope the SFW token, but that environment can carry a required-reviewers approval gate. Because the enterprise SFW check can't be a required status check (it would block Dependabot/fork PRs that only run the free edition), maintainers could merge without approving the deployment -- the meaningful check silently never ran, and approvers could rubber-stamp their own PRs. On the scheduled core-tool-watch job an approval gate would hang the cron run outright. - Remove `environment:` from python-sfw-smoke-enterprise and core-tool-watch; use a plain repo/org SOCKET_SFW_API_TOKEN (zizmor secrets-outside-env is already disabled here, so no lint cost). Job split still isolates the token to the enterprise job only. - Add always-on `dependency-review-gate` job: pass when no python deps changed, else require the free (Dependabot/fork) or enterprise (maintainer) smoke job to have succeeded. Mark THIS as the single required status check -- safe on every PR, no manual gate, no bypass. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Adopt the socket-python-cli#224 pattern uniformly. The environment was never the problem -- the required-reviewers approval RULE on it was. Keep the environment for secret scoping; forbid the rule. - Restore `environment: socket-firewall` on python-sfw-smoke-enterprise and the core-tool-watch analyze job so SOCKET_SFW_API_TOKEN is scoped to those jobs. Header documents that the environment must have NO reviewers rule, with the gh api command to enforce it (reviewers: null). - dependency-review-gate (Pattern 2 aggregator): now also needs docker-smoke-app-tests; fails on any failure/cancelled result (success and skipped pass) AND requires the trust-appropriate SFW edition to have succeeded when Python deps changed. Runs if: always() so the required context is always created -- no Pattern 1 bypass twin needed. Must land on main before being added to branch protection. Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>
This was referenced Jun 3, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Mirrors the Dependabot hardening done in
socket-sdk-python(#84) andsocket-python-cli(#207 / #217), adapted to socket-basics — the most complex of the three repos, since it ships both auv.lock(Python deps) and two Dockerfiles. Then it goes further with a supply-chain watch for the four core OSS tools Dependabot can't cleanly track, and fixes the SFW-bypass blindspot the CLI/SDK pattern introduced. Four threads:uvecosystem and groups every ecosystem into one minor/patch bundle + a separate major PR.1. Dependencies (supersedes 8 Dependabot PRs)
The four Python bumps are transitive/dev deps — runtime constraints in
pyproject.tomlare unchanged; targeteduv lock --upgrade-packageonly. The fourdocker/*action SHAs all live in_docker-pipeline.yml(majors pinned by SHA, validated by the smoke/publish builds). GitHub closing keywords don't close PRs, so the 8 Dependabot PRs must be closed manually after merge.2. Dependabot config (
.github/dependabot.yml)uvecosystem — the gap that let the Python PRs pile up ungrouped./.github/actions/*(the new composite action). 7-day cooldown retained.3. Dependency review (
.github/workflows/dependency-review.yml)Renamed from
dependabot-review.yml, now runs on every PR.inspectclassifies the PR; exactly one Socket Firewall job runs when Python deps change:firewall-enterprise+ token) — trusted in-repo (non-fork) non-Dependabot PRs (i.e. write-access holders). Only this job references the secret.firewall-free, anonymous) — Dependabot, forks, external contributors, or whenever the token is absent.Degrades to free whenever the token is missing, so it's safe to ship today and auto-upgrades to enterprise once the secret exists. Both jobs upload their
sfwoutput as an artifact (sfw-report-free/sfw-report-enterprise).Environment kept for secret scoping; approval rule forbidden (uniform with socket-python-cli#224).
environment: socket-firewallscopes the token so only the enterprise job can read it — good hygiene, kept. The trap is a required-reviewers rule on that environment: the enterprise check can't itself be a required status check (it's skipped on Dependabot/fork PRs, and a never-created required check blocks merge forever), and a manual deployment gate is self-approvable (prevent_self_reviewdefaults off; admins bypass) yet skippable — so the meaningful check silently never ran. Configure the environment with no reviewers:Coverage is enforced instead by the always-on
dependency-review-gateaggregator (Pattern 2): itneedsevery conditional job, fails on any failure/cancelled, and additionally requires the trust-appropriate SFW edition (free for Dependabot/forks, enterprise for maintainers) to have succeeded when Python deps changed; it's a no-op when no deps changed. It runsif: always()so the required context is always created (no Pattern-1 bypass twin needed). Mark onlydependency-review-gateas the required status check — and merge it to main first, then add it to branch protection (requiring it before it exists strands every open PR).Docker dep changes: the main image is already build-smoke-tested by
smoke-test.yml, so only the app_tests image (uncovered elsewhere) is built here.4. Core-tool supply-chain watch (
core-tool-watch.yml+scripts/check_core_tools.py)Three of socket-basics' four core tools — OpenGrep, TruffleHog, Trivy — ship as binaries / container images / GitHub releases Dependabot can't track; the fourth, Socket SCA (
socketdev), is a PyPI package. The watcher:ARGs +uv.lock).socketdevSDK'spurl.post()that socket-basics already depends on (pkg:pypi/...,pkg:golang/...,pkg:github/...; a missing result is reported, not failed).watch: analyze pinned + latest, report drift, upsert acore-tool-driftissue. PR / push touching pins →build: analyze the versions a build would bake in and fail on a malware/critical alert.core-tools-reportartifact (markdown + JSON); degrades to discovery-only without a token. No environment gate (an approval gate would hang the cron run).Live run today flagged drift on all four: OpenGrep
v1.16.5→v1.22.0, TruffleHog3.93.8→v3.95.5, Trivy0.69.3→v0.71.0, socketdev3.0.29→3.1.1(adopting those is intentionally not in this PR).5. Workflow plumbing
.github/actions/setup-sfwcomposite action (Python 3.12 + uv + Socket Firewall, free/enterprise).python-tests.ymlgains auv lock --lockeddrift guard.actions/permissions → {"enabled":false}) — none of these workflows run in CI until Actions is enabled (Settings → Actions → General). Validated locally instead.socket-firewallenvironment with no reviewers rule (command above) and add theSOCKET_SFW_API_TOKENsecret to it — lights up the enterprise path + core-tool Socket scoring.dependency-review-gateas the single required status check onmain— but only after this PR merges (so the check exists on main). Do not add a required-reviewers rule to thesocket-firewallenvironment — that's the bypass blindspot this PR avoids.Test plan
Local (all green):
uv lock --locked·uv sync --locked --extra dev· import smokepytest tests/— 139 passedactionlint— clean ·zizmor --offline— no findings · YAML parse on all.githubfilesscripts/check_core_tools.pyinwatchandbuildmode (token-absent degradation)Pending (needs Actions enabled + the secret):
python-sfw-smoke-enterpriseruns automatically (no approval), gate requires itpython-sfw-smoke-freeruns, gate requires itcore-tool-watchscheduled run scores all four PURLs through the Socket API🤖 Generated with Claude Code