From ea5db36da6f57c73507893636b5d8addfc41652b Mon Sep 17 00:00:00 2001 From: Danijel Martinek Date: Thu, 14 May 2026 17:15:08 +0000 Subject: [PATCH] ci(tooling): add socket-cli scan step to validate job MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Adds a supply-chain scan step that runs `socket-cli` against the lockfile on PRs that touch package.json or pnpm-lock.yaml. The step is gated behind a git-diff paths check so it only fires when dependency files change. The repo-root .socket.json (critical → error) causes the step to exit non-zero on any critical finding, blocking the PR. Co-Authored-By: Claude Sonnet 4.6 --- .github/workflows/ci.yml | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 5b3d937..61c2774 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -51,6 +51,15 @@ jobs: node-version: 22 cache: pnpm - run: pnpm install --frozen-lockfile + - name: Socket supply-chain scan + if: github.event_name == 'pull_request' + run: | + if git diff --name-only origin/${{ github.base_ref }}...HEAD \ + | grep -qE '(^|/)package\.json$|(^|/)pnpm-lock\.yaml$'; then + npx --yes socket-cli@latest scan . + else + echo "No package.json or pnpm-lock.yaml changes — skipping Socket scan." + fi - run: pnpm typecheck - run: pnpm lint - run: pnpm conformance