add socket tier 1 reachability analysis - #273
Conversation
There was a problem hiding this comment.
Pull request overview
This PR introduces a scheduled GitHub Actions workflow to run Socket’s full-application reachability scan (Tier 1 where possible) against the stellar-dbt-public repository, with a weekly cadence and an on-demand trigger.
Changes:
- Add a new
.github/workflows/socket-scan.ymlworkflow to runsocket scan create --reachon a weekly schedule and viaworkflow_dispatch. - Set up Python and Node toolchains required to run the Socket CLI and reachability analysis.
- Parse scan output to emit a GitHub Actions
::warning::when Tier 1 reachability falls back to Tier 2 (without failing the job).
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| - name: Install Socket CLI | ||
| run: npm install -g socket |
| - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0 | ||
| - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 | ||
| with: | ||
| node-version: "24.18.0" | ||
| - name: Enable Corepack (yarn/pnpm per repo packageManager) | ||
| run: corepack enable |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: b298af8b5a
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
| # annotation that GitHub Actions renders as a yellow run-level | ||
| # warning without failing the job. | ||
| set +e | ||
| socket scan create --reach \ |
There was a problem hiding this comment.
When this scheduled workflow runs, socket scan create is invoked without --repo or --branch; the Socket scan create reference states these default to socket-default-repository and socket-default-branch, so scans from stellar-dbt-public will be filed under the placeholder project/branch instead of this repo's default branch and won't update the intended Socket project/alerts view. Pass the repository and branch explicitly, e.g. from the GitHub context.
Useful? React with 👍 / 👎.
| socket scan create --reach \ | ||
| --org=stellar \ | ||
| --no-interactive \ | ||
| --reach-continue-on-no-source-files \ |
There was a problem hiding this comment.
This repo has no Python source files to analyze, only requirements.txt and dbt SQL, and the Socket reachability docs describe --reach-continue-on-no-source-files as continuing by falling back to precomputed reachability. With this flag, the new Tier 1 workflow can complete without ever producing full application reachability for this repository; letting the no-source case fail would surface that Tier 1 is not actually being computed.
Useful? React with 👍 / 👎.
More info: https://stellarorg.atlassian.net/wiki/spaces/SCRT/pages/5689311233/Socket+Tier+1+Reachability+Analysis