test: enable Socket Security Github Action

eggjs/egg#5430

Author: fengmk2

.github/workflows/ci.yml

@@ -2,9 +2,11 @@ name: CI
 
 on:
   push:
-    branches: [master]
+    branches:
+      - master
   pull_request:
-    branches: [master]
+    branches:
+      - master
   merge_group:
 
 jobs:

.github/workflows/socket-security-workflow.yml

@@ -0,0 +1,31 @@
+name: socket-security-workflow
+run-name: Socket Security Github Action
+on:
+  push:
+    branches:
+      - master
+  pull_request:
+    branches:
+      - master
+jobs:
+  socket-security:
+    permissions:
+      contents: read # This is enough to clone the repo and read files
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - uses: actions/setup-python@v5
+        with:
+          python-version: '3.12'
+      - name: Install Socket CLI
+        run: pip install socketsecurity --upgrade
+      - name: Run scan
+        env:
+          SOCKET_SECURITY_API_KEY: ${{ secrets.SOCKET_SECURITY_API_KEY }}
+          GH_API_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          COMMIT_MESSAGE: ${{ github.event.head_commit.message }}
+          COMMIT_SHA: ${{ github.sha }} # Getting the commit SHA
+        run: |
+          socketcli --scm github --repo ${{ github.event.repository.name }} --branch "${{ github.ref_name }}" --default-branch --pr_number 0 --commit-sha "$COMMIT_SHA" --committer "$GITHUB_ACTOR" --commit_message "$COMMIT_MESSAGE" --target_path $GITHUB_WORKSPACE --disable-blocking

package.json

@@ -17,7 +17,7 @@
   },
   "homepage": "https://github.com/node-modules/read-env-value#readme",
   "engines": {
-    "node": ">= 22.17.0"
+    "node": ">= 22.18.0"
   },
   "devDependencies": {
     "@eggjs/tsconfig": "3",
@@ -32,7 +32,7 @@
   "scripts": {
     "lint": "oxlint",
     "pretest": "npm run lint -- --fix",
-    "test": "node --test --experimental-strip-types",
+    "test": "node --test",
     "preci": "npm run lint",
     "ci": "c8 -r html -r lcov -r text npm test",
     "postci": "npm run prepublishOnly",