Dependabot hardening and workflow pipeline cleanup by lelia · Pull Request #217 · SocketDev/socket-python-cli

lelia · 2026-05-29T22:51:08Z

Summary

Follow-up to #207 and aligned with the newer socket-sdk-python dependency-review work in SocketDev/socket-sdk-python#84. Once the original Dependabot hardening ran on real PRs, it exposed a bigger gap: Socket Firewall checks only covered Dependabot-style dependency bumps, not dependency changes proposed by Socket maintainers. This PR now fixes that by running dependency review on every PR and upgrading trusted in-repo PRs to Socket Firewall Enterprise through the socket-firewall GitHub Environment.

This PR also folds in the workflow pipeline cleanup from #218 so there is one PR to review and merge.

Dependency Review / Socket Firewall

Renames dependabot-review.yml to dependency-review.yml and runs inspect on every PR, not just Dependabot PRs.
Detects changed dependency surfaces and conditionally runs SFW smoke jobs for:
- root Python deps: pyproject.toml / uv.lock
- npm fixture deps: tests/e2e/fixtures/simple-npm/**
- PyPI fixture deps: tests/e2e/fixtures/simple-pypi/**
- Dockerfile changes: build-only smoke, no push
Chooses SFW mode per PR:
- firewall-enterprise for any in-repo, non-fork PR that is not Dependabot's. This is the write-access boundary GitHub already uses for secret exposure and avoids misclassifying private org members whose author_association appears as CONTRIBUTOR.
- firewall-free for Dependabot and all fork PRs.
Splits Free and Enterprise SFW jobs so only Enterprise jobs declare environment: socket-firewall.
Uses the environment-scoped SOCKET_SFW_API_TOKEN secret only from Enterprise jobs. Free jobs do not touch that environment or token.
Keeps the workflow in normal pull_request context; no pull_request_target secret exposure.
Sets UV_PYTHON=3.12 and UV_PYTHON_DOWNLOADS=never for the sfw uv sync path so SFW scans PyPI package installs rather than uv-managed interpreter downloads.

Dependabot PR Behavior

Skip PR Preview on Dependabot PRs because dependency bumps do not carry a package version bump and should not need publish secrets.
Skip Version Check on Dependabot PRs because uv.lock / pyproject.toml bumps do not require an app-version increment.
Keep those jobs fully active for maintainer-authored PRs.
Treat .github/actions/** changes as workflow-sensitive in the dependency-review notice, alongside .github/workflows/** and .github/dependabot.yml.

Workflow Pipeline Cleanup

Add local composite actions for repeated setup:
- .github/actions/setup-sfw
- .github/actions/setup-docker
- .github/actions/setup-hatch
Add PR Preview concurrency so superseded preview runs are cancelled when a PR is pushed again.
Keep Docker build-push layer caching on preview, release, and stable image builds.
Make PR Preview publish/build only linux/amd64; release and stable Docker publishing still build linux/amd64,linux/arm64.

Dependabot Composite-Action Coverage

The github-actions Dependabot entry uses directories so Dependabot scans workflow files and local composite actions:

directories:
  - "/"
  - "/.github/actions/*"

Per GitHub's Dependabot options reference, / scans /.github/workflows plus root action metadata, and directories can list additional locations with wildcard support.

Test Plan

actionlint -shellcheck= .github/workflows/*.yml
actionlint .github/workflows/dependency-review.yml
zizmor .github --gh-token "$GITHUB_TOKEN" --min-severity medium
YAML parse for .github/dependabot.yml, local composite action.yml files, and dependency-review.yml
git diff --check
Trusted in-repo dependency PR: Enterprise SFW job uses the socket-firewall environment and SOCKET_SFW_API_TOKEN
Dependabot or fork dependency PR: Free SFW job runs without the environment/token
Human PR: preview + check_version still run as before

Both workflows failed on every Dependabot PR for reasons that don't apply to dependency bumps: - PR Preview publishes a dev build to Test PyPI + Docker Hub. On a dependency bump there's no version change, so the publish 400s ("File already exists") -- and it needs publish secrets a Dependabot PR shouldn't carry anyway. - Version Check requires an incremented app version, but Dependabot PRs touch uv.lock / pyproject.toml without bumping socketsecurity's version, so the check always fails. Add a job-level `if` to skip each on `dependabot[bot]`-authored PRs (same pattern already used for e2e-test.yml). Job-level skips report as "skipped" rather than blocking, and these stay required for human-authored PRs. Follow-up to #207 (the Dependabot review hardening), addressing fallout observed once that config went live on real Dependabot PRs. Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>

github-actions · 2026-05-29T22:51:50Z

🚀 Preview package published!

Install with:

pip install --index-url https://test.pypi.org/simple/ --extra-index-url https://pypi.org/simple socketsecurity==2.3.0.dev22

Docker image: socketdev/cli:pr-217

`sfw uv sync` is the intended way to route uv through Socket Firewall (per Socket's own uv-wrapper guidance), so the python-sfw-smoke job was already exercising the firewall -- uv's integration is just quieter than npm/pip (no "N packages fetched" footer), which made it look like a no-op. Add `--locked` so the check verifies the exact uv.lock set and fails on lockfile drift instead of silently re-resolving to newer versions than the PR locked. This makes the firewall inspect precisely what would be installed and aligns with the deterministic-verification guidance for uv-based repos. Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>

Replace the hand-rolled `npm install -g sfw` in all three sfw smoke jobs with the official setup action (socketdev/action@v1.3.2, mode: firewall-free). Why: - It's the documented GitHub Actions integration for Socket Firewall Free and wires up sfw routing correctly, rather than relying on an ad-hoc global npm install. This is the right mitigation for the class of Wrapper-Mode routing gaps where sfw can fail to proxy fetches from files.pythonhosted.org (tracked upstream as ENG-4871) -- exactly the "no interception" symptom that made the python job look like a no-op. - The Python jobs no longer need actions/setup-node at all (the action provides sfw directly), so those steps are dropped; the npm fixture job keeps setup-node since `npm install` needs it. Setup mode is firewall-free (anonymous, no API token) -- unchanged, and the reason this is safe to run on Dependabot/untrusted PRs. Our setup is Wrapper Mode + free edition + no CodeArtifact, so the Registry Mode + CodeArtifact `uv sync`/`uv lock` issue (CE-171) does not apply. Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>

The three sfw smoke jobs (python / npm-fixture / pypi-fixture) repeated the same setup: toolchain bootstrap + socketdev/action install. GitHub Actions doesn't support YAML anchors, so extract the shared setup into a local composite action instead. - New .github/actions/setup-sfw: optional Python/Node/uv toolchain inputs + the socketdev/action (firewall-free) install. - Each job now just declares the toolchain it needs (`uv`, `node`, or `python`) and runs its own distinct sfw command. Net effect: the pinned socketdev/action SHA now lives in ONE place (future bumps touch a single line), the per-job setup-python/setup-node duplication is gone, and each job body is reduced to its actual firewall check. No behavior change. Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>

Performance (PR preview, the iterative-feedback path): - Add a concurrency group with cancel-in-progress so pushing a PR again cancels the superseded (slow) preview run instead of letting it churn. - Build preview images amd64-only. arm64 under QEMU emulation was the slowest part of the job, and preview images are for quick testing; release/stable keep multi-arch. - Enable GitHub Actions Docker layer cache (type=gha) on all image builds so unchanged layers are reused across runs. De-duplication (GitHub Actions has no YAML anchors, so use composite actions): - New .github/actions/setup-docker-publish: the QEMU + Buildx + Docker Hub login trio, shared by release.yml, pr-preview.yml, and docker-stable.yml. These had drifted to three different pinned SHA sets; now there is one. (Docker Hub creds are passed as inputs since composite actions can't read secrets directly.) - New .github/actions/setup-hatch: the pinned virtualenv/hatchling/hatch install shared by release.yml and pr-preview.yml. No behavior change to what gets published; only how the pipelines are assembled and how fast/parallel they run. Stacked on #217 (lelia/fix-dependabot-checks) to avoid a pr-preview.yml conflict with that PR's Dependabot skip; rebase onto main once #217 lands. Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>

Bump every third-party action to its latest git-tagged release, pinned to the resolved commit SHA with a trailing '# vX.Y.Z' comment for readability: actions/checkout -> v6.0.2 actions/setup-python -> v6.2.0 actions/setup-node -> v6.4.0 actions/github-script -> v9.0.0 pypa/gh-action-pypi-publish -> v1.14.0 docker/setup-qemu-action -> v4.1.0 docker/setup-buildx-action -> v4.1.0 docker/login-action -> v4.2.0 docker/build-push-action -> v7.2.0 socketdev/action -> v1.3.2 (comment only) Applied across the setup-sfw composite action and all workflows, including docker-stable.yml which previously used floating major-version comments. Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>

socket-security · 2026-05-31T04:27:55Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Package	Supply Chain Security	License
github/actions/setup-python@f677139bbe7f9c59b41e40162b753c062f5d49a3 ⏵ a309ff8b426b58ec0e2a45f0f869d46889d02405	⁺⁸	⁺²⁰
github/docker/build-push-action@4f58ea79222b3b9dc2c8bbdd6debcef730109a75 ⏵ f9f3042f7e2789586610d6e8b85c8f03e5195baf	⁺¹
github/actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 ⏵ de0fac2e4500dabe0009e67214ff5f5447ce83dd	⁺¹
github/pypa/gh-action-pypi-publish@ab69e431e9c9f48a3310be0a56527c679f56e04d ⏵ cef221092ed1bacb1cc03d23a2d87d1d172e277b
github/actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea ⏵ 3a2844b7e9c422d3c10d287c895573f7108da1b3	⁺¹

View full report

socket-security-staging · 2026-05-31T04:28:00Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	github/actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 ⏵ de0fac2e4500dabe0009e67214ff5f5447ce83dd
	github/docker/build-push-action@ca052bb54ab0790a636c9b5f226502c73d547a25 ⏵ f9f3042f7e2789586610d6e8b85c8f03e5195baf	⁺¹

View full report

socket-security-staging · 2026-05-31T04:28:01Z

All alerts resolved. Learn more about Socket for GitHub.

This PR previously contained dependency changes with security issues that have been resolved, removed, or ignored.

Ignoring alerts on:

github/actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd

View full report

…' into lelia/fix-dependabot-checks # Conflicts: # .github/workflows/docker-stable.yml # .github/workflows/pr-preview.yml # .github/workflows/release.yml

lelia · 2026-05-31T04:56:52Z

@SocketSecurity-Staging ignore github/actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd

lelia requested a review from a team as a code owner May 29, 2026 22:51

lelia changed the title ~~Skip PR Preview and Version Check on Dependabot PRs~~ Dependabot review workflow fixes May 29, 2026

lelia added 2 commits May 29, 2026 19:06

lelia changed the title ~~Dependabot review workflow fixes~~ Harden Dependabot CI: skip Preview/Version Check, adopt official Socket Firewall action May 29, 2026

lelia changed the title ~~Harden Dependabot CI: skip Preview/Version Check, adopt official Socket Firewall action~~ Dependabot hardening: Fix CI checks, adopt sfw-action May 29, 2026

lelia added enhancement New feature or request dependencies Pull requests that update a dependency file labels May 31, 2026

lelia mentioned this pull request May 31, 2026

De-duplicate docker workflow pipelines #218

Merged

5 tasks

lelia added 2 commits May 31, 2026 00:36

Keep dependabot action pins visible

cb7bc9f

Merge remote-tracking branch 'origin/lelia/improve-workflow-pipelines…

88b510e

…' into lelia/fix-dependabot-checks # Conflicts: # .github/workflows/docker-stable.yml # .github/workflows/pr-preview.yml # .github/workflows/release.yml

lelia changed the title ~~Dependabot hardening: Fix CI checks, adopt sfw-action~~ Dependabot hardening and workflow pipeline cleanup May 31, 2026

Configure Dependabot for composite actions

ba9b946

lelia added 8 commits May 31, 2026 00:59

Include composite actions in Dependabot review notice

d9cb95c

Rename Docker setup composite action

e3bef31

Extend dependency review to maintainer PRs

e653f3f

Use CLI Socket token for enterprise dependency review

1ca3aa7

Restrict enterprise SFW to org members

cf2f02f

Use dedicated SFW token secret

41be66a

Use environment-scoped SFW token

64a4d96

Gate enterprise SFW on non-fork PRs

4f68ba1

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Dependabot hardening and workflow pipeline cleanup#217

Dependabot hardening and workflow pipeline cleanup#217
lelia wants to merge 17 commits into
mainfrom
lelia/fix-dependabot-checks

lelia commented May 29, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented May 29, 2026 •

edited

Loading

Uh oh!

socket-security Bot commented May 31, 2026 •

edited

Loading

Uh oh!

socket-security-staging Bot commented May 31, 2026 •

edited

Loading

Uh oh!

socket-security-staging Bot commented May 31, 2026 •

edited

Loading

Uh oh!

lelia commented May 31, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

lelia commented May 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Dependency Review / Socket Firewall

Dependabot PR Behavior

Workflow Pipeline Cleanup

Dependabot Composite-Action Coverage

Test Plan

Uh oh!

github-actions Bot commented May 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

socket-security Bot commented May 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

socket-security-staging Bot commented May 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

socket-security-staging Bot commented May 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

lelia commented May 31, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

lelia commented May 29, 2026 •

edited

Loading

github-actions Bot commented May 29, 2026 •

edited

Loading

socket-security Bot commented May 31, 2026 •

edited

Loading

socket-security-staging Bot commented May 31, 2026 •

edited

Loading

socket-security-staging Bot commented May 31, 2026 •

edited

Loading