socket.yaml

# Socket Security GitHub Actions Workflow
# This workflow runs Socket Security scans manually
# It is designed to be triggered via workflow_dispatch with an optional PR number

name: socket-security-workflow
run-name: Socket Security Github Action

on:
  workflow_dispatch:
    inputs:
      pr_number:
        description: 'PR number to target'
        required: false
        type: string

# Prevent concurrent runs for the same commit
concurrency:
  group: socket-scan-${{ github.ref }}-${{ github.sha }}
  cancel-in-progress: true

jobs:
  socket-security:
    permissions:
      issues: write
      contents: read
      pull-requests: write
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v4
        with:
          # For PRs, fetch one additional commit for proper diff analysis
          fetch-depth: ${{ github.event_name == 'pull_request' && 2 || 0 }}

      - uses: actions/setup-python@0b93645e9fea7318ecaed2b359559ac225c90a2b # v5.3.0
        with:
          python-version: "3.12"

      - name: Install Socket CLI
        run: pip install socketsecurity --upgrade

      - name: Run Socket Security Scan
        env:
          SOCKET_SECURITY_API_KEY: ${{ secrets.SOCKET_SECURITY_API_KEY }}
          GH_API_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          # Determine PR number based on event type or input
          PR_NUMBER="${{ inputs.pr_number || 0 }}"
          # Fallback logic if needed (though manual run usually implies input or 0)
          if [ "$PR_NUMBER" == "0" ] && [ "${{ github.event_name }}" == "pull_request" ]; then
            PR_NUMBER=${{ github.event.pull_request.number }}
          elif [ "$PR_NUMBER" == "0" ] && [ "${{ github.event_name }}" == "issue_comment" ]; then
            PR_NUMBER=${{ github.event.issue.number }}
          fi

          # Run Socket CLI with minimal required parameters
          # The CLI automatically detects:
          # - Repository name from git
          # - Branch name from git
          # - Commit SHA from git
          # - Commit message from git
          # - Committer information from git
          # - Default branch status from git and GitHub environment
          # - Changed files from git commit
          socketcli \
            --target-path $GITHUB_WORKSPACE \
            --scm github \
            --pr-number $PR_NUMBER