merge: sync stable npm release with main

Author: mldangelo-oai

.dockerignore

@@ -0,0 +1,15 @@
+.git
+.github
+**/.DS_Store
+**/.env
+**/.env.*
+**/.npmrc
+**/coverage
+**/dist
+**/node_modules
+**/*.csv
+**/repositories.csv
+**/results
+**/security-scans
+**/state
+**/*.log

.github/workflows/node-release.yml

@@ -16,6 +16,13 @@ jobs:
     runs-on: ubuntu-latest
     permissions:
       contents: read
+    env:
+      NPM_CONFIG_REGISTRY: https://openai.firewall.socket.dev/npm/
+      npm_config_registry: https://openai.firewall.socket.dev/npm/
+      PNPM_CONFIG_REGISTRY: https://openai.firewall.socket.dev/npm/
+      pnpm_config_registry: https://openai.firewall.socket.dev/npm/
+      COREPACK_NPM_REGISTRY: https://openai.firewall.socket.dev/npm/
+      BUN_CONFIG_REGISTRY: https://openai.firewall.socket.dev/npm/
     outputs:
       artifact-id: ${{ steps.upload.outputs.artifact-id }}
 
@@ -26,6 +33,12 @@ jobs:
           fetch-depth: 0
           persist-credentials: false
 
+      - name: Set up Socket Firewall
+        uses: SocketDev/action@937f824ec476dfd164d4a4d9995751427b0be143 # v1
+        with:
+          mode: firewall-free
+          firewall-version: v1.15.0
+
       - name: Set up Node.js
         uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6
         with:
@@ -64,7 +77,7 @@ jobs:
           echo "version=$version" >> "$GITHUB_OUTPUT"
 
       - name: Install dependencies
-        run: pnpm --dir sdk/typescript install --frozen-lockfile
+        run: sfw pnpm --dir sdk/typescript install --frozen-lockfile
 
       - name: Verify
         run: |
@@ -89,7 +102,7 @@ jobs:
           consumer="$(mktemp -d)"
           trap 'rm -rf "$consumer"' EXIT
           printf '%s\n' '{"name":"codex-security-smoke","private":true,"type":"module"}' > "$consumer/package.json"
-          npm install --ignore-scripts --prefix "$consumer" --include=optional --no-audit --no-fund ./dist/*.tgz
+          sfw npm install --ignore-scripts --prefix "$consumer" --include=optional --no-audit --no-fund ./dist/*.tgz
           (cd "$consumer" && node --input-type=module --eval 'const sdk = await import("@openai/codex-security"); if (typeof sdk.CodexSecurity !== "function") process.exit(1);')
           "$consumer/node_modules/.bin/codex-security" --version
           "$consumer/node_modules/.bin/codex-security" --help
@@ -101,7 +114,7 @@ jobs:
           name: npm-release-tarball
           path: dist/*.tgz
           if-no-files-found: error
-          retention-days: 1
+          retention-days: 30
           compression-level: 0
 
   publish:

Dockerfile

@@ -0,0 +1,61 @@
+# syntax=docker/dockerfile:1
+
+FROM node:22-bookworm-slim AS package
+
+WORKDIR /build/sdk/typescript
+
+COPY sdk/typescript/package.json sdk/typescript/pnpm-lock.yaml ./
+
+RUN corepack enable \
+    && corepack prepare "$(node --print 'require("./package.json").packageManager')" --activate \
+    && pnpm install --frozen-lockfile
+
+COPY sdk/typescript/ ./
+
+RUN pnpm run types \
+    && pnpm run build \
+    && pnpm pack --pack-destination /build/package \
+    && node scripts/check-package.mjs /build/package/*.tgz
+
+FROM node:22-bookworm-slim
+
+LABEL org.opencontainers.image.title="Codex Security" \
+      org.opencontainers.image.description="Noninteractive, resumable Codex Security CSV repository scans" \
+      org.opencontainers.image.source="https://github.com/openai/codex-security"
+
+RUN apt-get update \
+    && apt-get install --no-install-recommends --yes \
+        ca-certificates \
+        git \
+        openssh-client \
+        python3 \
+    && rm -rf /var/lib/apt/lists/*
+
+COPY --from=package /build/package/ /tmp/codex-security-package/
+
+RUN npm install --global --include=optional --no-audit --no-fund \
+        /tmp/codex-security-package/*.tgz \
+    && codex-security --version \
+    && codex-security bulk-scan --help \
+    && rm -rf /tmp/codex-security-package \
+    && npm cache clean --force
+
+COPY --chmod=0555 docker/entrypoint.sh /usr/local/bin/codex-security-entrypoint
+COPY --chmod=0555 docker/git-credential.sh /usr/local/bin/codex-security-git-credential
+
+RUN groupadd --gid 10001 codex-security \
+    && useradd --uid 10001 --gid 10001 --no-create-home codex-security \
+    && mkdir -p /input /output /state \
+    && chown 10001:10001 /output /state
+
+ENV CODEX_HOME=/state \
+    CODEX_SECURITY_STATE_DIR=/output/.codex-security-state \
+    GIT_TERMINAL_PROMPT=0 \
+    HOME=/state \
+    PYTHON=/usr/bin/python3
+
+USER 10001:10001
+WORKDIR /state
+
+ENTRYPOINT ["/usr/local/bin/codex-security-entrypoint"]
+CMD ["--help"]

README.md

@@ -66,6 +66,7 @@ npx codex-security scan /path/to/repo --output-dir /path/outside/repo/results
 npx codex-security scan /path/to/repo --output-dir /path/outside/repo/results --archive-existing
 npx codex-security scan /path/to/repo --dry-run
 npx codex-security scan /path/to/repo --fail-on-severity high
+npx codex-security install-hook
 npx codex-security bulk-scan
 npx codex-security bulk-scan repositories.csv --output-dir /path/outside/repositories/security-scans
 npx codex-security scans list /path/to/repo
@@ -82,6 +83,10 @@ npx codex-security validate /path/outside/repo/findings.json "Possible SQL injec
 npx codex-security patch /path/outside/repo/findings.json "Missing authorization check in src/routes.ts:18"
 ```
 
+`install-hook` scans staged and unstaged changes before each commit. It respects
+`core.hooksPath`, does not replace an existing hook, and blocks high-severity
+findings or failed scans. Set `--fail-on-severity` to change the threshold.
+
 Use `npx codex-security --version` for the CLI version and
 `npx codex-security info --json` for package, plugin, and runtime versions,
 the default model and reasoning effort, and the next scan command. Add

compose.yaml

@@ -0,0 +1,40 @@
+services:
+  codex-security:
+    image: ${CODEX_SECURITY_IMAGE:-codex-security:local}
+    build:
+      context: .
+    init: true
+    user: ${CODEX_SECURITY_USER:-10001:10001}
+    cap_drop:
+      - ALL
+    security_opt:
+      - no-new-privileges:true
+      - seccomp=${CODEX_SECURITY_SECCOMP:-./docker/codex-security-seccomp.json}
+    environment:
+      CODEX_API_KEY:
+      CODEX_SECURITY_GIT_HOST:
+      GH_TOKEN:
+      GITHUB_TOKEN:
+      OPENAI_API_KEY:
+    volumes:
+      - type: bind
+        source: ${CODEX_SECURITY_CSV:-./repositories.csv}
+        target: /input/repositories.csv
+        read_only: true
+        bind:
+          create_host_path: false
+      - type: bind
+        source: ${CODEX_SECURITY_RESULTS:-./results}
+        target: /output
+        bind:
+          create_host_path: false
+      - type: bind
+        source: ${CODEX_SECURITY_STATE:-./state}
+        target: /state
+        bind:
+          create_host_path: false
+    command:
+      - bulk-scan
+      - /input/repositories.csv
+      - --output-dir
+      - /output