Skip to content

Commit 64a4d96

Browse files
lelialelia
committed
Use environment-scoped SFW token
1 parent 41be66a commit 64a4d96

1 file changed

Lines changed: 126 additions & 24 deletions

File tree

‎.github/workflows/dependency-review.yml‎

Lines changed: 126 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -7,16 +7,15 @@ name: dependency-review
77
# install smoke jobs for the affected manifests, picking the firewall edition
88
# per PR:
99
#
10-
# - SocketDev org members on an in-repo (non-fork) PR, when
11-
# SOCKET_SFW_API_TOKEN is present -> Socket Firewall ENTERPRISE
12-
# (authenticated, full org-policy enforcement).
13-
# - Everything else -- Dependabot, forks, outside collaborators, external
14-
# contributors, or a missing token -> Socket Firewall FREE (anonymous, no
15-
# API token), which is safe in the unprivileged `pull_request` context.
10+
# - SocketDev org members on an in-repo (non-fork) PR -> Socket Firewall
11+
# ENTERPRISE through the socket-firewall environment and its
12+
# SOCKET_SFW_API_TOKEN secret (authenticated, full org-policy enforcement).
13+
# - Everything else -- Dependabot, forks, outside collaborators, or external
14+
# contributors -> Socket Firewall FREE (anonymous, no API token), which is
15+
# safe in the unprivileged `pull_request` context.
1616
#
17-
# The mode degrades to free whenever the token is absent, so this workflow is
18-
# safe to ship before the secret exists and starts using enterprise
19-
# automatically once a Socket API token secret is configured.
17+
# Only Enterprise jobs declare the socket-firewall environment. Free jobs do
18+
# not touch that environment or its token.
2019
#
2120
# Pattern adapted from SocketDev/socket-basics.
2221

@@ -86,17 +85,13 @@ jobs:
8685
IS_DEPENDABOT: ${{ github.event.pull_request.user.login == 'dependabot[bot]' }}
8786
IS_FORK: ${{ github.event.pull_request.head.repo.full_name != github.repository }}
8887
AUTHOR_ASSOC: ${{ github.event.pull_request.author_association }}
89-
# Empty for fork PRs (secrets withheld) and until a token secret is added.
90-
SOCKET_SFW_API_TOKEN: ${{ secrets.SOCKET_SFW_API_TOKEN }}
9188
run: |
9289
mode=firewall-free
9390
# Enterprise only for a SocketDev org member (OWNER/MEMBER) on an
94-
# in-repo PR, and only when the token is actually present. Everything
95-
# else -- Dependabot, forks, outside collaborators, external
96-
# contributors, or a missing token -- uses the free edition.
91+
# in-repo PR. Everything else -- Dependabot, forks, outside
92+
# collaborators, and external contributors -- uses the free edition.
9793
if [ "$IS_DEPENDABOT" != "true" ] \
9894
&& [ "$IS_FORK" != "true" ] \
99-
&& [ -n "$SOCKET_SFW_API_TOKEN" ] \
10095
&& printf '%s' "$AUTHOR_ASSOC" | grep -qE '^(OWNER|MEMBER)$'; then
10196
mode=firewall-enterprise
10297
fi
@@ -120,9 +115,11 @@ jobs:
120115
echo "- This workflow runs in pull_request context only; no publish secrets are exposed"
121116
} >> "$GITHUB_STEP_SUMMARY"
122117
123-
python-sfw-smoke:
118+
python-sfw-smoke-free:
124119
needs: inspect
125-
if: needs.inspect.outputs.python_deps_changed == 'true'
120+
if: |
121+
needs.inspect.outputs.python_deps_changed == 'true' &&
122+
needs.inspect.outputs.sfw_mode == 'firewall-free'
126123
runs-on: ubuntu-latest
127124
timeout-minutes: 15
128125
steps:
@@ -134,7 +131,58 @@ jobs:
134131
- uses: ./.github/actions/setup-sfw
135132
with:
136133
uv: "true"
137-
mode: ${{ needs.inspect.outputs.sfw_mode }}
134+
mode: firewall-free
135+
136+
- name: Sync project through Socket Firewall
137+
# `sfw uv sync` is the intended way to route uv through Socket Firewall
138+
# (per Socket's own uv wrapper guidance). --locked verifies the exact
139+
# uv.lock set and fails on lockfile drift rather than silently
140+
# re-resolving, so the firewall inspects precisely what would install.
141+
# Note: uv's sfw integration is quieter than npm/pip -- it does not
142+
# print the "N packages fetched" footer, but interception is active.
143+
#
144+
# Use the runner's setup-python interpreter and forbid managed-Python
145+
# downloads. The firewall is here to vet PyPI installs, not the
146+
# interpreter/toolchain download path.
147+
env:
148+
UV_PYTHON: "3.12"
149+
UV_PYTHON_DOWNLOADS: never
150+
run: sfw uv sync --locked --extra test --extra dev
151+
152+
- name: Import smoke test
153+
env:
154+
UV_PYTHON: "3.12"
155+
UV_PYTHON_DOWNLOADS: never
156+
run: |
157+
uv run python -c "
158+
from socketsecurity.socketcli import cli, build_socket_sdk
159+
from socketsecurity.core import Core
160+
from socketsecurity.core.exceptions import (
161+
APIFailure, RequestTimeoutExceeded, APIResourceNotFound,
162+
)
163+
from socketsecurity.core.git_interface import Git
164+
from socketsecurity.config import CliConfig
165+
print('import smoke OK')
166+
"
167+
168+
python-sfw-smoke-enterprise:
169+
needs: inspect
170+
if: |
171+
needs.inspect.outputs.python_deps_changed == 'true' &&
172+
needs.inspect.outputs.sfw_mode == 'firewall-enterprise'
173+
runs-on: ubuntu-latest
174+
timeout-minutes: 15
175+
environment: socket-firewall
176+
steps:
177+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
178+
with:
179+
fetch-depth: 1
180+
persist-credentials: false
181+
182+
- uses: ./.github/actions/setup-sfw
183+
with:
184+
uv: "true"
185+
mode: firewall-enterprise
138186
socket-token: ${{ secrets.SOCKET_SFW_API_TOKEN }}
139187

140188
- name: Sync project through Socket Firewall
@@ -169,9 +217,11 @@ jobs:
169217
print('import smoke OK')
170218
"
171219
172-
fixture-npm-sfw-smoke:
220+
fixture-npm-sfw-smoke-free:
173221
needs: inspect
174-
if: needs.inspect.outputs.fixture_npm_changed == 'true'
222+
if: |
223+
needs.inspect.outputs.fixture_npm_changed == 'true' &&
224+
needs.inspect.outputs.sfw_mode == 'firewall-free'
175225
runs-on: ubuntu-latest
176226
timeout-minutes: 15
177227
steps:
@@ -183,18 +233,70 @@ jobs:
183233
- uses: ./.github/actions/setup-sfw
184234
with:
185235
node: "true"
186-
mode: ${{ needs.inspect.outputs.sfw_mode }}
236+
mode: firewall-free
237+
238+
- name: Install fixture through Socket Firewall
239+
working-directory: tests/e2e/fixtures/simple-npm
240+
run: sfw npm install --no-audit --no-fund --ignore-scripts
241+
242+
fixture-npm-sfw-smoke-enterprise:
243+
needs: inspect
244+
if: |
245+
needs.inspect.outputs.fixture_npm_changed == 'true' &&
246+
needs.inspect.outputs.sfw_mode == 'firewall-enterprise'
247+
runs-on: ubuntu-latest
248+
timeout-minutes: 15
249+
environment: socket-firewall
250+
steps:
251+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
252+
with:
253+
fetch-depth: 1
254+
persist-credentials: false
255+
256+
- uses: ./.github/actions/setup-sfw
257+
with:
258+
node: "true"
259+
mode: firewall-enterprise
187260
socket-token: ${{ secrets.SOCKET_SFW_API_TOKEN }}
188261

189262
- name: Install fixture through Socket Firewall
190263
working-directory: tests/e2e/fixtures/simple-npm
191264
run: sfw npm install --no-audit --no-fund --ignore-scripts
192265

193-
fixture-pypi-sfw-smoke:
266+
fixture-pypi-sfw-smoke-free:
267+
needs: inspect
268+
if: |
269+
needs.inspect.outputs.fixture_pypi_changed == 'true' &&
270+
needs.inspect.outputs.sfw_mode == 'firewall-free'
271+
runs-on: ubuntu-latest
272+
timeout-minutes: 15
273+
steps:
274+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
275+
with:
276+
fetch-depth: 1
277+
persist-credentials: false
278+
279+
- uses: ./.github/actions/setup-sfw
280+
with:
281+
python: "true"
282+
mode: firewall-free
283+
284+
- name: Install fixture through Socket Firewall
285+
working-directory: tests/e2e/fixtures/simple-pypi
286+
run: |
287+
python -m venv .venv
288+
# shellcheck disable=SC1091
289+
source .venv/bin/activate
290+
sfw pip install -r requirements.txt
291+
292+
fixture-pypi-sfw-smoke-enterprise:
194293
needs: inspect
195-
if: needs.inspect.outputs.fixture_pypi_changed == 'true'
294+
if: |
295+
needs.inspect.outputs.fixture_pypi_changed == 'true' &&
296+
needs.inspect.outputs.sfw_mode == 'firewall-enterprise'
196297
runs-on: ubuntu-latest
197298
timeout-minutes: 15
299+
environment: socket-firewall
198300
steps:
199301
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
200302
with:
@@ -204,7 +306,7 @@ jobs:
204306
- uses: ./.github/actions/setup-sfw
205307
with:
206308
python: "true"
207-
mode: ${{ needs.inspect.outputs.sfw_mode }}
309+
mode: firewall-enterprise
208310
socket-token: ${{ secrets.SOCKET_SFW_API_TOKEN }}
209311

210312
- name: Install fixture through Socket Firewall

0 commit comments

Comments
 (0)