ci: add CI workflow for PR checks (#1122)

* ci: add CI workflow for lint, typecheck, and unit tests on PRs

Add a GitHub Actions workflow that runs lint, type checking, and unit
tests on every push to a PR targeting main or v1.x. Includes test
fixture updates.

* fix: use test-ci in CI workflow for correct build environment

The separate build + test:unit steps caused snapshot mismatches because
pnpm build does not set VITEST=1, which gets inlined at build time.
Using test-ci runs test:prepare (which builds with .env.test setting
VITEST=1) followed by test:unit, matching local test behavior.

* fix: set initial branch to main in branch-cleanup tests

The test was failing on CI because git's default branch name may not
be 'main'. Using --initial-branch main ensures consistent behavior.

Author: mtorp

.github/workflows/ci.yml

@@ -0,0 +1,49 @@
+name: CI
+
+on:
+  push:
+    branches: [main, v1.x]
+  pull_request:
+    branches: [main, v1.x]
+
+permissions:
+  contents: read
+
+jobs:
+  lint:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: SocketDev/socket-registry/.github/actions/setup-and-install@51be85d39d3b4a42dd9d4712948b9d30a2e04794
+        with:
+          node-version: 22
+
+      - name: Lint
+        run: pnpm check:lint
+
+  typecheck:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: SocketDev/socket-registry/.github/actions/setup-and-install@51be85d39d3b4a42dd9d4712948b9d30a2e04794
+        with:
+          node-version: 22
+
+      - name: Type check
+        run: pnpm check:tsc
+
+  test:
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 15
+    strategy:
+      fail-fast: true
+      matrix:
+        node-version: [20, 22, 24]
+        os: [ubuntu-latest]
+    steps:
+      - uses: SocketDev/socket-registry/.github/actions/setup-and-install@51be85d39d3b4a42dd9d4712948b9d30a2e04794
+        with:
+          node-version: ${{ matrix.node-version }}
+
+      - name: Build and run unit tests
+        run: pnpm test-ci

src/commands/fix/branch-cleanup.integration.test.mts

@@ -37,9 +37,12 @@ describe('branch-cleanup integration tests', () => {
     remoteDir = path.join(tempDir, 'remote.git')
     repoDir = path.join(tempDir, 'repo')
 
-    // Initialize bare remote repository.
+    // Initialize bare remote repository with main as default branch.
     await fs.mkdir(remoteDir, { recursive: true })
-    await spawn('git', ['init', '--bare'], { cwd: remoteDir, stdio: 'ignore' })
+    await spawn('git', ['init', '--bare', '--initial-branch', 'main'], {
+      cwd: remoteDir,
+      stdio: 'ignore',
+    })
 
     // Clone the remote to create local repository.
     await spawn('git', ['clone', remoteDir, repoDir], {

src/commands/fix/cmd-fix.integration.test.mts

@@ -167,6 +167,7 @@ describe('socket fix', async () => {
             --autopilot         Enable auto-merge for pull requests that Socket opens.
                                 See GitHub documentation (https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/configuring-pull-request-merges/managing-auto-merge-for-pull-requests-in-your-repository) for managing auto-merge for pull requests in your repository.
             --debug             Enable debug logging in the Coana-based Socket Fix CLI invocation.
+            --disable-external-tool-checks  Disable external tool checks during fix analysis.
             --ecosystems        Limit fix analysis to specific ecosystems. Can be provided as comma separated values or as multiple flags. Defaults to all ecosystems.
             --exclude           Exclude workspaces matching these glob patterns. Can be provided as comma separated values or as multiple flags
             --fix-version       Override the version of @coana-tech/cli used for fix analysis. Default: <coana-version>.

src/commands/fix/handle-fix-limit.test.mts

@@ -217,7 +217,7 @@ describe('socket fix --pr-limit behavior verification', () => {
       })
 
       expect(result.ok).toBe(true)
-      expect(result.data?.fixed).toBe(false)
+      expect(result.data?.fixedAll).toBe(false)
 
       // Only discovery call, no fix call since no GHSAs found.
       expect(mockSpawnCoanaDlx).toHaveBeenCalledTimes(1)
@@ -374,7 +374,7 @@ describe('socket fix --pr-limit behavior verification', () => {
       })
 
       expect(result.ok).toBe(true)
-      expect(result.data?.fixed).toBe(false)
+      expect(result.data?.fixedAll).toBe(false)
 
       // With 5 open PRs and prLimit 3, adjusted limit is 0, so no processing.
       expect(mockSpawnCoanaDlx).not.toHaveBeenCalled()

src/commands/scan/cmd-scan-create.test.mts

@@ -61,6 +61,7 @@ describe('socket scan create', async () => {
             --reach-debug       Enable debug mode for reachability analysis. Provides verbose logging from the reachability CLI.
             --reach-detailed-analysis-log-file  A log file with detailed analysis logs is written to root of each analyzed workspace.
             --reach-disable-analytics  Disable reachability analytics sharing with Socket. Also disables caching-based optimizations.
+            --reach-disable-external-tool-checks  Disable external tool checks during reachability analysis.
             --reach-ecosystems  List of ecosystems to conduct reachability analysis on, as either a comma separated value or as multiple flags. Defaults to all ecosystems.
             --reach-enable-analysis-splitting  Allow the reachability analysis to partition CVEs into buckets that are processed in separate analysis runs. May improve accuracy, but not recommended by default.
             --reach-exclude-paths  List of paths to exclude from reachability analysis, as either a comma separated value or as multiple flags.

src/commands/scan/cmd-scan-reach.test.mts

@@ -43,6 +43,7 @@ describe('socket scan reach', async () => {
             --reach-debug       Enable debug mode for reachability analysis. Provides verbose logging from the reachability CLI.
             --reach-detailed-analysis-log-file  A log file with detailed analysis logs is written to root of each analyzed workspace.
             --reach-disable-analytics  Disable reachability analytics sharing with Socket. Also disables caching-based optimizations.
+            --reach-disable-external-tool-checks  Disable external tool checks during reachability analysis.
             --reach-ecosystems  List of ecosystems to conduct reachability analysis on, as either a comma separated value or as multiple flags. Defaults to all ecosystems.
             --reach-enable-analysis-splitting  Allow the reachability analysis to partition CVEs into buckets that are processed in separate analysis runs. May improve accuracy, but not recommended by default.
             --reach-exclude-paths  List of paths to exclude from reachability analysis, as either a comma separated value or as multiple flags.