Skip to content

Commit c723343

Browse files
bergenhembergenhem
committed
Merge remote-tracking branch 'origin/main' into carl/update-pr-comments-with-triaged-alerts
2 parents 0ded415 + 9467be6 commit c723343

25 files changed

Lines changed: 935 additions & 111 deletions

‎.github/workflows/python-tests.yml‎

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
name: python-tests
2+
3+
env:
4+
PYTHON_VERSION: "3.12"
5+
6+
on:
7+
push:
8+
branches: [main]
9+
paths:
10+
- "socket_basics/**/*.py"
11+
- "tests/**/*.py"
12+
- "pyproject.toml"
13+
- "uv.lock"
14+
- ".github/workflows/python-tests.yml"
15+
pull_request:
16+
paths:
17+
- "socket_basics/**/*.py"
18+
- "tests/**/*.py"
19+
- "pyproject.toml"
20+
- "uv.lock"
21+
- ".github/workflows/python-tests.yml"
22+
workflow_dispatch:
23+
24+
permissions:
25+
contents: read
26+
27+
concurrency:
28+
group: python-tests-${{ github.ref }}
29+
cancel-in-progress: true
30+
31+
jobs:
32+
python-tests:
33+
runs-on: ubuntu-latest
34+
timeout-minutes: 20
35+
steps:
36+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
37+
with:
38+
fetch-depth: 1
39+
persist-credentials: false
40+
- name: 🐍 setup python
41+
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
42+
with:
43+
python-version: ${{ env.PYTHON_VERSION }}
44+
cache: "pip"
45+
- name: 🛠️ install deps
46+
run: |
47+
python -m pip install --upgrade pip
48+
pip install -e ".[dev]"
49+
- name: 🧪 run tests
50+
run: pytest -q tests/

‎.github/workflows/smoke-test.yml‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
name: smoke-test
2+
3+
on:
4+
push:
5+
branches: [main]
6+
paths:
7+
- 'Dockerfile'
8+
- 'scripts/smoke-test-docker.sh'
9+
- '.github/workflows/smoke-test.yml'
10+
pull_request:
11+
paths:
12+
- 'Dockerfile'
13+
- 'scripts/smoke-test-docker.sh'
14+
- '.github/workflows/smoke-test.yml'
15+
schedule:
16+
- cron: '0 */12 * * *' # every 12 hours
17+
workflow_dispatch:
18+
19+
permissions:
20+
contents: read
21+
22+
concurrency:
23+
group: smoke-test-${{ github.ref }}
24+
cancel-in-progress: true
25+
26+
jobs:
27+
smoke-test:
28+
runs-on: ubuntu-latest
29+
timeout-minutes: 30
30+
env:
31+
DOCKER_BUILDKIT: "1"
32+
SMOKE_TEST_BUILD_PROGRESS: plain
33+
steps:
34+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
35+
- name: 🐳 smoke test
36+
run: bash ./scripts/smoke-test-docker.sh --image-tag socket-basics:smoke-test

‎Dockerfile‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -23,11 +23,12 @@ ARG TRIVY_VERSION=v0.69.2
2323
RUN curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin "${TRIVY_VERSION}"
2424

2525
# Install Trufflehog
26-
ARG TRUFFLEHOG_VERSION=v3.93.3
26+
ARG TRUFFLEHOG_VERSION=v3.93.6
2727
RUN curl -sSfL https://raw.githubusercontent.com/trufflesecurity/trufflehog/main/scripts/install.sh | sh -s -- -b /usr/local/bin "${TRUFFLEHOG_VERSION}"
2828

2929
# Install OpenGrep (connector/runtime dependency)
30-
RUN curl -fsSL https://raw.githubusercontent.com/opengrep/opengrep/main/install.sh | bash
30+
ARG OPENGREP_VERSION=v1.16.2
31+
RUN curl -fsSL https://raw.githubusercontent.com/opengrep/opengrep/main/install.sh | bash -s -- -v "${OPENGREP_VERSION}"
3132

3233
# Copy the specific files needed for the project
3334
COPY socket_basics /socket-basics/socket_basics

‎README.md‎

Lines changed: 8 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -33,7 +33,7 @@ jobs:
3333
steps:
3434
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
3535
- name: Run Socket Basics
36-
uses: SocketDev/socket-basics@1.1.1
36+
uses: SocketDev/socket-basics@1.1.3
3737
env:
3838
GITHUB_PR_NUMBER: ${{ github.event.pull_request.number || github.event.issue.number }}
3939
with:
@@ -144,23 +144,24 @@ For GitHub Actions, see the [Quick Start](#-quick-start---github-actions) above
144144

145145
```bash
146146
# Build with version tag
147-
docker build -t socketdev/socket-basics:1.1.1 .
147+
docker build -t socketdev/socket-basics:1.1.3 .
148148
149149
# Run scan
150-
docker run --rm -v "$PWD:/workspace" socketdev/socket-basics:1.1.1 \
150+
docker run --rm -v "$PWD:/workspace" socketdev/socket-basics:1.1.3 \
151151
--workspace /workspace \
152152
--python-sast-enabled \
153153
--secret-scanning-enabled \
154154
--console-tabular-enabled
155155
```
156156

157-
Tip: If you need specific Trivy or TruffleHog versions, you can override them at build time:
157+
Tip: If you need specific Trivy, TruffleHog, or OpenGrep versions, you can override them at build time:
158158

159159
```bash
160160
docker build \
161-
--build-arg TRIVY_VERSION=v0.67.2 \
162-
--build-arg TRUFFLEHOG_VERSION=v3.93.3 \
163-
-t socketdev/socket-basics:1.1.1 .
161+
--build-arg TRIVY_VERSION=v0.69.2 \
162+
--build-arg TRUFFLEHOG_VERSION=v3.93.6 \
163+
--build-arg OPENGREP_VERSION=v1.16.2 \
164+
-t socketdev/socket-basics:1.1.3 .
164165
```
165166

166167
📖 **[View Docker Installation Guide](docs/local-install-docker.md)**

‎app_tests/Dockerfile‎

Lines changed: 9 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -23,10 +23,16 @@ RUN apt-get update && \
2323
RUN curl -sfL https://raw.githubusercontent.com/securego/gosec/master/install.sh | sh -s -- -b /usr/local/bin v2.21.4
2424

2525
# Install Trivy
26-
RUN curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin v0.18.3
26+
ARG TRIVY_VERSION=v0.69.2
27+
RUN curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin "${TRIVY_VERSION}"
2728

2829
# Install Trufflehog
29-
RUN curl -sSfL https://raw.githubusercontent.com/trufflesecurity/trufflehog/main/scripts/install.sh | sh -s -- -b /usr/local/bin
30+
ARG TRUFFLEHOG_VERSION=v3.93.6
31+
RUN curl -sSfL https://raw.githubusercontent.com/trufflesecurity/trufflehog/main/scripts/install.sh | sh -s -- -b /usr/local/bin "${TRUFFLEHOG_VERSION}"
32+
33+
# Install OpenGrep (connector/runtime dependency)
34+
ARG OPENGREP_VERSION=v1.16.2
35+
RUN curl -fsSL https://raw.githubusercontent.com/opengrep/opengrep/main/install.sh | bash -s -- -v "${OPENGREP_VERSION}"
3036

3137
# Install Bandit using uv as a tool
3238
RUN uv tool install bandit
@@ -50,7 +56,7 @@ COPY pyproject.toml uv.lock /scripts/
5056
# Install Python dependencies using uv
5157
WORKDIR /scripts
5258
RUN uv sync --frozen && uv pip install light-s3-client
53-
ENV PATH="/scripts/.venv/bin:$PATH"
59+
ENV PATH="/scripts/.venv/bin:/root/.opengrep/cli/latest:$PATH"
5460

5561
# Define entrypoint
5662
ENTRYPOINT ["/socket-security-tools/entrypoint.sh"]

‎docs/github-action.md‎

Lines changed: 20 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -42,7 +42,7 @@ jobs:
4242
steps:
4343
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
4444
- name: Run Socket Basics
45-
uses: SocketDev/socket-basics@1.1.1
45+
uses: SocketDev/socket-basics@1.1.3
4646
env:
4747
GITHUB_PR_NUMBER: ${{ github.event.pull_request.number || github.event.issue.number }}
4848
with:
@@ -77,7 +77,7 @@ Include these in your workflow's `jobs.<job_id>.permissions` section.
7777

7878
**SAST (Static Analysis):**
7979
```yaml
80-
- uses: SocketDev/socket-basics@1.1.1
80+
- uses: SocketDev/socket-basics@1.1.3
8181
with:
8282
github_token: ${{ secrets.GITHUB_TOKEN }}
8383
# Enable SAST for specific languages
@@ -91,7 +91,7 @@ Include these in your workflow's `jobs.<job_id>.permissions` section.
9191

9292
**Secret Scanning:**
9393
```yaml
94-
- uses: SocketDev/socket-basics@1.1.1
94+
- uses: SocketDev/socket-basics@1.1.3
9595
with:
9696
github_token: ${{ secrets.GITHUB_TOKEN }}
9797
secret_scanning_enabled: 'true'
@@ -103,7 +103,7 @@ Include these in your workflow's `jobs.<job_id>.permissions` section.
103103

104104
**Container Scanning:**
105105
```yaml
106-
- uses: SocketDev/socket-basics@1.1.1
106+
- uses: SocketDev/socket-basics@1.1.3
107107
with:
108108
github_token: ${{ secrets.GITHUB_TOKEN }}
109109
# Scan Docker images (auto-enables container scanning)
@@ -114,7 +114,7 @@ Include these in your workflow's `jobs.<job_id>.permissions` section.
114114

115115
**Socket Tier 1 Reachability:**
116116
```yaml
117-
- uses: SocketDev/socket-basics@1.1.1
117+
- uses: SocketDev/socket-basics@1.1.3
118118
with:
119119
github_token: ${{ secrets.GITHUB_TOKEN }}
120120
socket_tier_1_enabled: 'true'
@@ -123,7 +123,7 @@ Include these in your workflow's `jobs.<job_id>.permissions` section.
123123
### Output Configuration
124124

125125
```yaml
126-
- uses: SocketDev/socket-basics@1.1.1
126+
- uses: SocketDev/socket-basics@1.1.3
127127
with:
128128
github_token: ${{ secrets.GITHUB_TOKEN }}
129129
python_sast_enabled: 'true'
@@ -159,7 +159,7 @@ Configure Socket Basics centrally from the [Socket Dashboard](https://socket.dev
159159

160160
**Enable in workflow:**
161161
```yaml
162-
- uses: SocketDev/socket-basics@1.1.1
162+
- uses: SocketDev/socket-basics@1.1.3
163163
env:
164164
GITHUB_PR_NUMBER: ${{ github.event.pull_request.number || github.event.issue.number }}
165165
with:
@@ -171,7 +171,7 @@ Configure Socket Basics centrally from the [Socket Dashboard](https://socket.dev
171171

172172
> **Note:** You can also pass credentials using environment variables instead of the `with:` section:
173173
> ```yaml
174-
> - uses: SocketDev/socket-basics@1.1.1
174+
> - uses: SocketDev/socket-basics@1.1.3
175175
> env:
176176
> SOCKET_SECURITY_API_KEY: ${{ secrets.SOCKET_SECURITY_API_KEY }}
177177
> with:
@@ -189,7 +189,7 @@ All notification integrations require Socket Enterprise.
189189

190190
**Slack Notifications:**
191191
```yaml
192-
- uses: SocketDev/socket-basics@1.1.1
192+
- uses: SocketDev/socket-basics@1.1.3
193193
with:
194194
github_token: ${{ secrets.GITHUB_TOKEN }}
195195
socket_org: ${{ secrets.SOCKET_ORG }}
@@ -201,7 +201,7 @@ All notification integrations require Socket Enterprise.
201201

202202
**Jira Issue Creation:**
203203
```yaml
204-
- uses: SocketDev/socket-basics@1.1.1
204+
- uses: SocketDev/socket-basics@1.1.3
205205
with:
206206
github_token: ${{ secrets.GITHUB_TOKEN }}
207207
socket_org: ${{ secrets.SOCKET_ORG }}
@@ -216,7 +216,7 @@ All notification integrations require Socket Enterprise.
216216

217217
**Microsoft Teams:**
218218
```yaml
219-
- uses: SocketDev/socket-basics@1.1.1
219+
- uses: SocketDev/socket-basics@1.1.3
220220
with:
221221
github_token: ${{ secrets.GITHUB_TOKEN }}
222222
socket_org: ${{ secrets.SOCKET_ORG }}
@@ -228,7 +228,7 @@ All notification integrations require Socket Enterprise.
228228

229229
**Generic Webhook:**
230230
```yaml
231-
- uses: SocketDev/socket-basics@1.1.1
231+
- uses: SocketDev/socket-basics@1.1.3
232232
with:
233233
github_token: ${{ secrets.GITHUB_TOKEN }}
234234
socket_org: ${{ secrets.SOCKET_ORG }}
@@ -240,7 +240,7 @@ All notification integrations require Socket Enterprise.
240240

241241
**SIEM Integration:**
242242
```yaml
243-
- uses: SocketDev/socket-basics@1.1.1
243+
- uses: SocketDev/socket-basics@1.1.3
244244
with:
245245
github_token: ${{ secrets.GITHUB_TOKEN }}
246246
socket_org: ${{ secrets.SOCKET_ORG }}
@@ -276,7 +276,7 @@ jobs:
276276
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
277277
278278
- name: Run Socket Basics
279-
uses: SocketDev/socket-basics@1.1.1
279+
uses: SocketDev/socket-basics@1.1.3
280280
env:
281281
GITHUB_PR_NUMBER: ${{ github.event.pull_request.number || github.event.issue.number }}
282282
with:
@@ -322,7 +322,7 @@ jobs:
322322
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
323323
324324
- name: Run Full Security Scan
325-
uses: SocketDev/socket-basics@1.1.1
325+
uses: SocketDev/socket-basics@1.1.3
326326
env:
327327
GITHUB_PR_NUMBER: ${{ github.event.pull_request.number || github.event.issue.number }}
328328
with:
@@ -373,10 +373,10 @@ jobs:
373373
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
374374
375375
- name: Build Docker Image
376-
run: docker build -t myapp:1.1.1:${{ github.sha }} .
376+
run: docker build -t myapp:1.1.3:${{ github.sha }} .
377377
378378
- name: Scan Container
379-
uses: SocketDev/socket-basics@1.1.1
379+
uses: SocketDev/socket-basics@1.1.3
380380
env:
381381
GITHUB_PR_NUMBER: ${{ github.event.pull_request.number || github.event.issue.number }}
382382
with:
@@ -439,7 +439,7 @@ jobs:
439439
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
440440
441441
- name: Run Socket Basics
442-
uses: SocketDev/socket-basics@1.1.1
442+
uses: SocketDev/socket-basics@1.1.3
443443
env:
444444
GITHUB_PR_NUMBER: ${{ github.event.pull_request.number || github.event.issue.number }}
445445
with:
@@ -491,7 +491,7 @@ jobs:
491491
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
492492
493493
- name: Run Socket Basics
494-
uses: SocketDev/socket-basics@1.1.1
494+
uses: SocketDev/socket-basics@1.1.3
495495
env:
496496
GITHUB_PR_NUMBER: ${{ github.event.pull_request.number || github.event.issue.number }}
497497
with:
@@ -584,7 +584,7 @@ env:
584584
```yaml
585585
steps:
586586
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - Must be first
587-
- uses: SocketDev/socket-basics@1.1.1
587+
- uses: SocketDev/socket-basics@1.1.3
588588
```
589589

590590
### PR Comments Not Appearing

0 commit comments

Comments
 (0)