From 5867bae87b4f5549cbff79e6524cb2ba29dc6ae3 Mon Sep 17 00:00:00 2001 From: jdalton Date: Fri, 24 Apr 2026 16:06:17 -0400 Subject: [PATCH 1/2] chore(ci): bump socket-registry refs to 0371e83f MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Picks up the @socketsecurity/lib floor enforcement that landed in socket-registry 24ad6b61 — the install action now fails fast with an actionable message when the consumer's @socketsecurity/lib is below the latest version published to npm. socket-packageurl-js already pins @socketsecurity/lib at 5.24.0 (the floor), so this bump is mechanical — no consumer code changes. --- .github/workflows/ci.yml | 2 +- .github/workflows/pages.yml | 2 +- .github/workflows/provenance.yml | 2 +- .github/workflows/valtown.yml | 2 +- .github/workflows/weekly-update.yml | 8 ++++---- 5 files changed, 8 insertions(+), 8 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index cc12b44..a897613 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -21,4 +21,4 @@ concurrency: jobs: ci: name: Run CI Pipeline - uses: SocketDev/socket-registry/.github/workflows/ci.yml@13684cd82b9fdf2c389e2e808504014362f39655 # main + uses: SocketDev/socket-registry/.github/workflows/ci.yml@0371e83fccd7e2e5370b9ee7d0ddc882c9790210 # main diff --git a/.github/workflows/pages.yml b/.github/workflows/pages.yml index c80a5d1..dd68080 100644 --- a/.github/workflows/pages.yml +++ b/.github/workflows/pages.yml @@ -60,7 +60,7 @@ jobs: contents: read steps: - name: Setup and install (checkout + Node + pnpm + install) - uses: SocketDev/socket-registry/.github/actions/setup-and-install@13684cd82b9fdf2c389e2e808504014362f39655 # main + uses: SocketDev/socket-registry/.github/actions/setup-and-install@0371e83fccd7e2e5370b9ee7d0ddc882c9790210 # main with: checkout-fetch-depth: '1' diff --git a/.github/workflows/provenance.yml b/.github/workflows/provenance.yml index 6bcb311..1b4c628 100644 --- a/.github/workflows/provenance.yml +++ b/.github/workflows/provenance.yml @@ -27,7 +27,7 @@ permissions: jobs: publish: - uses: SocketDev/socket-registry/.github/workflows/provenance.yml@13684cd82b9fdf2c389e2e808504014362f39655 # main + uses: SocketDev/socket-registry/.github/workflows/provenance.yml@0371e83fccd7e2e5370b9ee7d0ddc882c9790210 # main with: debug: ${{ inputs.debug }} dist-tag: ${{ inputs.dist-tag }} diff --git a/.github/workflows/valtown.yml b/.github/workflows/valtown.yml index 9185e71..da45159 100644 --- a/.github/workflows/valtown.yml +++ b/.github/workflows/valtown.yml @@ -74,7 +74,7 @@ jobs: echo "VALTOWN_TOKEN present (length: ${#VALTOWN_TOKEN})" - name: Setup and install (checkout + Node + pnpm + install) - uses: SocketDev/socket-registry/.github/actions/setup-and-install@13684cd82b9fdf2c389e2e808504014362f39655 # main + uses: SocketDev/socket-registry/.github/actions/setup-and-install@0371e83fccd7e2e5370b9ee7d0ddc882c9790210 # main with: checkout-fetch-depth: '1' diff --git a/.github/workflows/weekly-update.yml b/.github/workflows/weekly-update.yml index 24afc92..566ca5c 100644 --- a/.github/workflows/weekly-update.yml +++ b/.github/workflows/weekly-update.yml @@ -24,7 +24,7 @@ jobs: outputs: has-updates: ${{ steps.check.outputs.has-updates }} steps: - - uses: SocketDev/socket-registry/.github/actions/setup-and-install@13684cd82b9fdf2c389e2e808504014362f39655 # main + - uses: SocketDev/socket-registry/.github/actions/setup-and-install@0371e83fccd7e2e5370b9ee7d0ddc882c9790210 # main - name: Check for npm updates id: check @@ -49,7 +49,7 @@ jobs: contents: write pull-requests: write steps: - - uses: SocketDev/socket-registry/.github/actions/setup-and-install@13684cd82b9fdf2c389e2e808504014362f39655 # main + - uses: SocketDev/socket-registry/.github/actions/setup-and-install@0371e83fccd7e2e5370b9ee7d0ddc882c9790210 # main - name: Create update branch id: branch @@ -62,7 +62,7 @@ jobs: git checkout -b "$BRANCH_NAME" echo "branch=$BRANCH_NAME" >> "$GITHUB_OUTPUT" - - uses: SocketDev/socket-registry/.github/actions/setup-git-signing@13684cd82b9fdf2c389e2e808504014362f39655 # main + - uses: SocketDev/socket-registry/.github/actions/setup-git-signing@0371e83fccd7e2e5370b9ee7d0ddc882c9790210 # main with: gpg-private-key: ${{ secrets.BOT_GPG_PRIVATE_KEY }} @@ -303,7 +303,7 @@ jobs: test-output.log retention-days: 7 - - uses: SocketDev/socket-registry/.github/actions/cleanup-git-signing@13684cd82b9fdf2c389e2e808504014362f39655 # main + - uses: SocketDev/socket-registry/.github/actions/cleanup-git-signing@0371e83fccd7e2e5370b9ee7d0ddc882c9790210 # main if: always() notify: From 091cff9313f37de38aacb0fc96534e6eeb72b4c8 Mon Sep 17 00:00:00 2001 From: jdalton Date: Fri, 24 Apr 2026 16:15:36 -0400 Subject: [PATCH 2/2] fixup: repin socket-registry to f1b40c99 (npm-banner-validation fix) The previous propagation SHA (0371e83f) shipped a guard step whose version_lt function exploded when npm view returned a Socket Firewall banner string instead of a version. f1b40c99 validates npm view output as semver before using it. --- .github/workflows/ci.yml | 2 +- .github/workflows/pages.yml | 2 +- .github/workflows/provenance.yml | 2 +- .github/workflows/valtown.yml | 2 +- .github/workflows/weekly-update.yml | 8 ++++---- 5 files changed, 8 insertions(+), 8 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index a897613..56d3442 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -21,4 +21,4 @@ concurrency: jobs: ci: name: Run CI Pipeline - uses: SocketDev/socket-registry/.github/workflows/ci.yml@0371e83fccd7e2e5370b9ee7d0ddc882c9790210 # main + uses: SocketDev/socket-registry/.github/workflows/ci.yml@f1b40c99a11f8f2f65a44c9e6c66e53470bd0b90 # main diff --git a/.github/workflows/pages.yml b/.github/workflows/pages.yml index dd68080..df2cbeb 100644 --- a/.github/workflows/pages.yml +++ b/.github/workflows/pages.yml @@ -60,7 +60,7 @@ jobs: contents: read steps: - name: Setup and install (checkout + Node + pnpm + install) - uses: SocketDev/socket-registry/.github/actions/setup-and-install@0371e83fccd7e2e5370b9ee7d0ddc882c9790210 # main + uses: SocketDev/socket-registry/.github/actions/setup-and-install@f1b40c99a11f8f2f65a44c9e6c66e53470bd0b90 # main with: checkout-fetch-depth: '1' diff --git a/.github/workflows/provenance.yml b/.github/workflows/provenance.yml index 1b4c628..2051e0e 100644 --- a/.github/workflows/provenance.yml +++ b/.github/workflows/provenance.yml @@ -27,7 +27,7 @@ permissions: jobs: publish: - uses: SocketDev/socket-registry/.github/workflows/provenance.yml@0371e83fccd7e2e5370b9ee7d0ddc882c9790210 # main + uses: SocketDev/socket-registry/.github/workflows/provenance.yml@f1b40c99a11f8f2f65a44c9e6c66e53470bd0b90 # main with: debug: ${{ inputs.debug }} dist-tag: ${{ inputs.dist-tag }} diff --git a/.github/workflows/valtown.yml b/.github/workflows/valtown.yml index da45159..5ac2b1c 100644 --- a/.github/workflows/valtown.yml +++ b/.github/workflows/valtown.yml @@ -74,7 +74,7 @@ jobs: echo "VALTOWN_TOKEN present (length: ${#VALTOWN_TOKEN})" - name: Setup and install (checkout + Node + pnpm + install) - uses: SocketDev/socket-registry/.github/actions/setup-and-install@0371e83fccd7e2e5370b9ee7d0ddc882c9790210 # main + uses: SocketDev/socket-registry/.github/actions/setup-and-install@f1b40c99a11f8f2f65a44c9e6c66e53470bd0b90 # main with: checkout-fetch-depth: '1' diff --git a/.github/workflows/weekly-update.yml b/.github/workflows/weekly-update.yml index 566ca5c..30c97ff 100644 --- a/.github/workflows/weekly-update.yml +++ b/.github/workflows/weekly-update.yml @@ -24,7 +24,7 @@ jobs: outputs: has-updates: ${{ steps.check.outputs.has-updates }} steps: - - uses: SocketDev/socket-registry/.github/actions/setup-and-install@0371e83fccd7e2e5370b9ee7d0ddc882c9790210 # main + - uses: SocketDev/socket-registry/.github/actions/setup-and-install@f1b40c99a11f8f2f65a44c9e6c66e53470bd0b90 # main - name: Check for npm updates id: check @@ -49,7 +49,7 @@ jobs: contents: write pull-requests: write steps: - - uses: SocketDev/socket-registry/.github/actions/setup-and-install@0371e83fccd7e2e5370b9ee7d0ddc882c9790210 # main + - uses: SocketDev/socket-registry/.github/actions/setup-and-install@f1b40c99a11f8f2f65a44c9e6c66e53470bd0b90 # main - name: Create update branch id: branch @@ -62,7 +62,7 @@ jobs: git checkout -b "$BRANCH_NAME" echo "branch=$BRANCH_NAME" >> "$GITHUB_OUTPUT" - - uses: SocketDev/socket-registry/.github/actions/setup-git-signing@0371e83fccd7e2e5370b9ee7d0ddc882c9790210 # main + - uses: SocketDev/socket-registry/.github/actions/setup-git-signing@f1b40c99a11f8f2f65a44c9e6c66e53470bd0b90 # main with: gpg-private-key: ${{ secrets.BOT_GPG_PRIVATE_KEY }} @@ -303,7 +303,7 @@ jobs: test-output.log retention-days: 7 - - uses: SocketDev/socket-registry/.github/actions/cleanup-git-signing@0371e83fccd7e2e5370b9ee7d0ddc882c9790210 # main + - uses: SocketDev/socket-registry/.github/actions/cleanup-git-signing@f1b40c99a11f8f2f65a44c9e6c66e53470bd0b90 # main if: always() notify: