From 173753afca7b32e338286655081652183e29d490 Mon Sep 17 00:00:00 2001 From: Marguerite Martinez Date: Tue, 13 Oct 2026 13:52:58 -0400 Subject: [PATCH 1/3] Add Socket full application reachability scan Co-Authored-By: Claude Opus 5.5 --- .github/workflows/socket-reachability.yml | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+) create mode 100644 .github/workflows/socket-reachability.yml diff --git a/.github/workflows/socket-reachability.yml b/.github/workflows/socket-reachability.yml new file mode 100644 index 0000000..42d8e1b --- /dev/null +++ b/.github/workflows/socket-reachability.yml @@ -0,0 +1,21 @@ +name: Socket Full Application Reachability + +on: + push: + # TODO before merge: remove add-socket-reachability, which is only here to test the workflow pre-merge. + branches: [main, add-socket-reachability] + # Socket replaces a full application result older than 7 days with the next GitHub App scan, + # so re-run weekly even when nothing has merged. + schedule: + - cron: "17 9 * * 1" + workflow_dispatch: + +jobs: + socket-reachability: + # Run from @main for the same reasons as socket-basics.yml: we control ynab-sast-scanner, and it pins its own dependencies. + # TODO before merge: point this back at @main once ynab-sast-scanner's add-socket-reachability-workflow branch is merged. + uses: ynab/ynab-sast-scanner/.github/workflows/socket-reachability.yml@add-socket-reachability-workflow + with: + python-version: "3.12" + secrets: + SOCKET_SECURITY_API_KEY: ${{ secrets.SOCKET_SECURITY_API_KEY }} From 79a5c723154a3d386d70d48778f1686f63a3963b Mon Sep 17 00:00:00 2001 From: Marguerite Martinez Date: Tue, 13 Oct 2026 14:29:44 -0400 Subject: [PATCH 2/3] Point Socket reachability at ynab-sast-scanner main Co-Authored-By: Claude Opus 5.5 --- .github/workflows/socket-reachability.yml | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/.github/workflows/socket-reachability.yml b/.github/workflows/socket-reachability.yml index 42d8e1b..a0416cb 100644 --- a/.github/workflows/socket-reachability.yml +++ b/.github/workflows/socket-reachability.yml @@ -2,8 +2,7 @@ name: Socket Full Application Reachability on: push: - # TODO before merge: remove add-socket-reachability, which is only here to test the workflow pre-merge. - branches: [main, add-socket-reachability] + branches: [main] # Socket replaces a full application result older than 7 days with the next GitHub App scan, # so re-run weekly even when nothing has merged. schedule: @@ -13,8 +12,7 @@ on: jobs: socket-reachability: # Run from @main for the same reasons as socket-basics.yml: we control ynab-sast-scanner, and it pins its own dependencies. - # TODO before merge: point this back at @main once ynab-sast-scanner's add-socket-reachability-workflow branch is merged. - uses: ynab/ynab-sast-scanner/.github/workflows/socket-reachability.yml@add-socket-reachability-workflow + uses: ynab/ynab-sast-scanner/.github/workflows/socket-reachability.yml@main with: python-version: "3.12" secrets: From 0a5ac9b706209573c111e2f80e4ce9e1e1c89948 Mon Sep 17 00:00:00 2001 From: Marguerite Martinez Date: Thu, 29 Oct 2026 11:15:45 -0400 Subject: [PATCH 3/3] Run Socket reachability twice a week A weekly run sits right at Socket's 7-day cutoff, so the GitHub App scan could replace the full application result first. Co-Authored-By: Claude Opus 5.5 --- .github/workflows/socket-reachability.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/socket-reachability.yml b/.github/workflows/socket-reachability.yml index a0416cb..24639bb 100644 --- a/.github/workflows/socket-reachability.yml +++ b/.github/workflows/socket-reachability.yml @@ -4,9 +4,9 @@ on: push: branches: [main] # Socket replaces a full application result older than 7 days with the next GitHub App scan, - # so re-run weekly even when nothing has merged. + # so re-run twice a week (Monday and Thursday) even when nothing has merged. schedule: - - cron: "17 9 * * 1" + - cron: "17 9 * * 1,4" workflow_dispatch: jobs: