Repository navigation
Add Socket full application reachability scan - #114
Draft
sgrammargs wants to merge 3 commits into
Draft
sgrammargs wants to merge 3 commits into
sgrammargs wants to merge 3 commits into
Conversation
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
4 tasks done
A weekly run sits right at Socket's 7-day cutoff, so the GitHub App scan could replace the full application result first. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds a Socket full application reachability scan that calls the shared workflow from ynab/ynab-sast-scanner#5. It traces calls from this repo's code to settle alerts the precomputed analysis can't ("Direct dependency", "Potentially reachable", "Unknown"). On
main, its result replaces the precomputed verdicts on the alerts page and in the Asana rule.Runs on pushes to
main, twice a week, and on manual dispatch. The scheduled runs matter: once a repo has a full application result, Socket takes it off the 30-day re-scan and replaces results older than 7 days with the next GitHub App scan. A weekly run would sit right at that cutoff, so it runs Monday and Thursday. It doesn't run on PRs, so PR checks are no slower. If the analysis fails, no scan is created and the repo keeps its current results.Configuration: Ruby 3.4.8, default runner.
Testing: Test run from this branch, which doesn't touch the alerts page; scan report. The run's log reports no known vulnerabilities in the current dependencies, so this mainly covers future advisories.
Merge ynab/ynab-sast-scanner#8 first. The shared workflow is on
@mainnow (#5 merged), but until #8 lands, its fallback check fails the job on any run where nothing falls back, even though the scan still uploads. #8 also moves to Socket CLI 1.8.2. Merging this triggers the first scan ofmain.🤖 Generated with Claude Code