From 507504679045c8a4b214609450fa08bcba90e33c Mon Sep 17 00:00:00 2001 From: RelunSec Date: Mon, 6 Jul 2026 06:35:21 +0000 Subject: [PATCH] Add SocketDev workflow for firewall-free mode Hi, i did that because i see mainteners merge dependabot prs just in hours, if there was a supply chain incident then will progogate by using https://socket.dev, because mainteners a lot frustrated by pinning actions and merge a renovabot pr after days, instead that is the solution a maintener can merge an update safely using that, very easy it outputs the supply chain score in curcilar graph, to see is the update safe or no, before merging, i finally retrieved a solution for that repo, since mainteners frustrated by classical supply chain defenses like pinning deps and github actions and do'nt merge a renovabot pr before 1 day, that was actually frustrating that will be optimal for mainteners while maintening supply chain security --- .github/workflows/SocketDev.yml | 14 ++++++++++++++ 1 file changed, 14 insertions(+) create mode 100644 .github/workflows/SocketDev.yml diff --git a/.github/workflows/SocketDev.yml b/.github/workflows/SocketDev.yml new file mode 100644 index 00000000000..fa0c08b9723 --- /dev/null +++ b/.github/workflows/SocketDev.yml @@ -0,0 +1,14 @@ +on: push + +jobs: + safe-install: + runs-on: ubuntu-latest + + steps: + - uses: actions/checkout@v7.0.0 + + - uses: SocketDev/action@v1.3.1 + with: + mode: firewall-free + # rust + - run: sfw cargo fetch