[sgrammargs]

Adds a Socket full application reachability scan that calls the shared workflow from ynab/ynab-sast-scanner#5. It traces calls from this repo's code to settle alerts the precomputed analysis can't ("Direct dependency", "Potentially reachable", "Unknown"). On main, its result replaces the precomputed verdicts on the alerts page and in the Asana rule.

Runs on pushes to main, twice a week, and on manual dispatch. The scheduled runs matter: once a repo has a full application result, Socket takes it off the 30-day re-scan and replaces results older than 7 days with the next GitHub App scan. A weekly run would sit right at that cutoff, so it runs Monday and Thursday. It doesn't run on PRs, so PR checks are no slower. If the analysis fails, no scan is created and the repo keeps its current results.

Configuration: Python 3.12 for the analysis (the SDK itself supports 3.10+), default runner.

Testing: Test run from this branch, which doesn't touch the alerts page; scan report.

Merge ynab/ynab-sast-scanner#8 first. The shared workflow is on @main now (#5 merged), but until #8 lands, its fallback check fails the job on any run where nothing falls back, even though the scan still uploads. #8 also moves to Socket CLI 1.8.2. Merging this triggers the first scan of main.

🤖 Generated with Claude Code

[bradymholt]

Hi Marguerite is this ready to review?

[sgrammargs]

Hi Marguerite is this ready to review?

@bradymholt This one needs to be approved and merged first - ynab/ynab-sast-scanner#5 - I will bump it this week and get these downstream PRs sorted 👍