From 02294fc20055281334717adebfb64cc644cc018a Mon Sep 17 00:00:00 2001 From: Marguerite Martinez Date: Tue, 13 Oct 2026 13:53:00 -0400 Subject: [PATCH 1/3] Add Socket full application reachability scan Co-Authored-By: Claude Opus 5.5 --- .github/workflows/socket-reachability.yml | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+) create mode 100644 .github/workflows/socket-reachability.yml diff --git a/.github/workflows/socket-reachability.yml b/.github/workflows/socket-reachability.yml new file mode 100644 index 0000000..66020d9 --- /dev/null +++ b/.github/workflows/socket-reachability.yml @@ -0,0 +1,21 @@ +name: Socket Full Application Reachability + +on: + push: + # TODO before merge: remove add-socket-reachability, which is only here to test the workflow pre-merge. + branches: [main, add-socket-reachability] + # Socket replaces a full application result older than 7 days with the next GitHub App scan, + # so re-run weekly even when nothing has merged. + schedule: + - cron: "17 9 * * 1" + workflow_dispatch: + +jobs: + socket-reachability: + # Run from @main for the same reasons as socket-basics.yml: we control ynab-sast-scanner, and it pins its own dependencies. + # TODO before merge: point this back at @main once ynab-sast-scanner's add-socket-reachability-workflow branch is merged. + uses: ynab/ynab-sast-scanner/.github/workflows/socket-reachability.yml@add-socket-reachability-workflow + with: + ruby-version: "3.4.8" + secrets: + SOCKET_SECURITY_API_KEY: ${{ secrets.SOCKET_SECURITY_API_KEY }} From 2c1fc3bfb24e81ec0259f6715744e325500dd06e Mon Sep 17 00:00:00 2001 From: Marguerite Martinez Date: Tue, 13 Oct 2026 14:29:46 -0400 Subject: [PATCH 2/3] Point Socket reachability at ynab-sast-scanner main Co-Authored-By: Claude Opus 5.5 --- .github/workflows/socket-reachability.yml | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/.github/workflows/socket-reachability.yml b/.github/workflows/socket-reachability.yml index 66020d9..2c0f21b 100644 --- a/.github/workflows/socket-reachability.yml +++ b/.github/workflows/socket-reachability.yml @@ -2,8 +2,7 @@ name: Socket Full Application Reachability on: push: - # TODO before merge: remove add-socket-reachability, which is only here to test the workflow pre-merge. - branches: [main, add-socket-reachability] + branches: [main] # Socket replaces a full application result older than 7 days with the next GitHub App scan, # so re-run weekly even when nothing has merged. schedule: @@ -13,8 +12,7 @@ on: jobs: socket-reachability: # Run from @main for the same reasons as socket-basics.yml: we control ynab-sast-scanner, and it pins its own dependencies. - # TODO before merge: point this back at @main once ynab-sast-scanner's add-socket-reachability-workflow branch is merged. - uses: ynab/ynab-sast-scanner/.github/workflows/socket-reachability.yml@add-socket-reachability-workflow + uses: ynab/ynab-sast-scanner/.github/workflows/socket-reachability.yml@main with: ruby-version: "3.4.8" secrets: From 6a044c1ee4dc6ed117b8bcea7e9f2e72157b6f26 Mon Sep 17 00:00:00 2001 From: Marguerite Martinez Date: Thu, 29 Oct 2026 11:15:47 -0400 Subject: [PATCH 3/3] Run Socket reachability twice a week A weekly run sits right at Socket's 7-day cutoff, so the GitHub App scan could replace the full application result first. Co-Authored-By: Claude Opus 5.5 --- .github/workflows/socket-reachability.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/socket-reachability.yml b/.github/workflows/socket-reachability.yml index 2c0f21b..5d7eca1 100644 --- a/.github/workflows/socket-reachability.yml +++ b/.github/workflows/socket-reachability.yml @@ -4,9 +4,9 @@ on: push: branches: [main] # Socket replaces a full application result older than 7 days with the next GitHub App scan, - # so re-run weekly even when nothing has merged. + # so re-run twice a week (Monday and Thursday) even when nothing has merged. schedule: - - cron: "17 9 * * 1" + - cron: "17 9 * * 1,4" workflow_dispatch: jobs: