Skip to content

Updated examples with PR check and pinning to commit hashes #9

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Oct 22, 2025
Merged

Updated examples with PR check and pinning to commit hashes #9

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
22 changes: 16 additions & 6 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,12 +18,18 @@ on:

jobs:
security-scan:
permissions:
issues: write
contents: read
pull-requests: write
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

- name: Run Socket Basics
uses: SocketDev/socket-basics@1.0.9
uses: SocketDev/socket-basics@1.0.10
env:
GITHUB_PR_NUMBER: ${{ github.event.pull_request.number || github.event.issue.number }}
with:
github_token: ${{ secrets.GITHUB_TOKEN }}
socket_security_api_key: ${{ secrets.SOCKET_SECURITY_API_KEY }}
Expand Down Expand Up @@ -106,7 +112,9 @@ Configure scanning policies, notification channels, and rule sets for your entir

**Dashboard-Configured (Enterprise):**
```yaml
- uses: SocketDev/socket-basics@1.0.9
- uses: SocketDev/socket-basics@1.0.10
env:
GITHUB_PR_NUMBER: ${{ github.event.pull_request.number || github.event.issue.number }}
with:
github_token: ${{ secrets.GITHUB_TOKEN }}
socket_security_api_key: ${{ secrets.SOCKET_SECURITY_API_KEY }}
Expand All @@ -115,7 +123,9 @@ Configure scanning policies, notification channels, and rule sets for your entir

**CLI-Configured:**
```yaml
- uses: SocketDev/socket-basics@1.0.9
- uses: SocketDev/socket-basics@1.0.10
env:
GITHUB_PR_NUMBER: ${{ github.event.pull_request.number || github.event.issue.number }}
with:
github_token: ${{ secrets.GITHUB_TOKEN }}
python_sast_enabled: 'true'
Expand All @@ -129,10 +139,10 @@ Configure scanning policies, notification channels, and rule sets for your entir

```bash
# Build with version tag
docker build -t socketdev/socket-basics:1.0.9 .
docker build -t socketdev/socket-basics:1.0.10 .

# Run scan
docker run --rm -v "$PWD:/workspace" socketdev/socket-basics:1.0.9 \
docker run --rm -v "$PWD:/workspace" socketdev/socket-basics:1.0.10 \
--workspace /workspace \
--python-sast-enabled \
--secret-scanning-enabled \
Expand Down
65 changes: 32 additions & 33 deletions docs/github-action.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,12 +35,11 @@ jobs:
pull-requests: write
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

- name: Run Socket Basics
uses: SocketDev/socket-basics@1.0.9
uses: SocketDev/socket-basics@1.0.10
env:
# Optional: Explicitly set PR number for guaranteed PR comments
GITHUB_PR_NUMBER: ${{ github.event.pull_request.number || github.event.issue.number }}
with:
github_token: ${{ secrets.GITHUB_TOKEN }}
Expand Down Expand Up @@ -79,7 +78,7 @@ Include these in your workflow's `jobs.<job_id>.permissions` section.

**SAST (Static Analysis):**
```yaml
- uses: SocketDev/socket-basics@1.0.9
- uses: SocketDev/socket-basics@1.0.10
with:
github_token: ${{ secrets.GITHUB_TOKEN }}
# Enable SAST for specific languages
Expand All @@ -93,7 +92,7 @@ Include these in your workflow's `jobs.<job_id>.permissions` section.

**Secret Scanning:**
```yaml
- uses: SocketDev/socket-basics@1.0.9
- uses: SocketDev/socket-basics@1.0.10
with:
github_token: ${{ secrets.GITHUB_TOKEN }}
secret_scanning_enabled: 'true'
Expand All @@ -105,7 +104,7 @@ Include these in your workflow's `jobs.<job_id>.permissions` section.

**Container Scanning:**
```yaml
- uses: SocketDev/socket-basics@1.0.9
- uses: SocketDev/socket-basics@1.0.10
with:
github_token: ${{ secrets.GITHUB_TOKEN }}
# Scan Docker images (auto-enables container scanning)
Expand All @@ -116,7 +115,7 @@ Include these in your workflow's `jobs.<job_id>.permissions` section.

**Socket Tier 1 Reachability:**
```yaml
- uses: SocketDev/socket-basics@1.0.9
- uses: SocketDev/socket-basics@1.0.10
with:
github_token: ${{ secrets.GITHUB_TOKEN }}
socket_tier_1_enabled: 'true'
Expand All @@ -125,7 +124,7 @@ Include these in your workflow's `jobs.<job_id>.permissions` section.
### Output Configuration

```yaml
- uses: SocketDev/socket-basics@1.0.9
- uses: SocketDev/socket-basics@1.0.10
with:
github_token: ${{ secrets.GITHUB_TOKEN }}
python_sast_enabled: 'true'
Expand Down Expand Up @@ -155,9 +154,8 @@ Configure Socket Basics centrally from the [Socket Dashboard](https://socket.dev

**Enable in workflow:**
```yaml
- uses: SocketDev/socket-basics@1.0.9
- uses: SocketDev/socket-basics@1.0.10
env:
# Optional: Explicitly set PR number for guaranteed PR comments
GITHUB_PR_NUMBER: ${{ github.event.pull_request.number || github.event.issue.number }}
with:
github_token: ${{ secrets.GITHUB_TOKEN }}
Expand All @@ -168,7 +166,7 @@ Configure Socket Basics centrally from the [Socket Dashboard](https://socket.dev

> **Note:** You can also pass credentials using environment variables instead of the `with:` section:
> ```yaml
> - uses: SocketDev/socket-basics@1.0.9
> - uses: SocketDev/socket-basics@1.0.10
> env:
> SOCKET_SECURITY_API_KEY: ${{ secrets.SOCKET_SECURITY_API_KEY }}
> with:
Expand All @@ -186,7 +184,7 @@ All notification integrations require Socket Enterprise.

**Slack Notifications:**
```yaml
- uses: SocketDev/socket-basics@1.0.9
- uses: SocketDev/socket-basics@1.0.10
with:
github_token: ${{ secrets.GITHUB_TOKEN }}
socket_org: ${{ secrets.SOCKET_ORG }}
Expand All @@ -198,7 +196,7 @@ All notification integrations require Socket Enterprise.

**Jira Issue Creation:**
```yaml
- uses: SocketDev/socket-basics@1.0.9
- uses: SocketDev/socket-basics@1.0.10
with:
github_token: ${{ secrets.GITHUB_TOKEN }}
socket_org: ${{ secrets.SOCKET_ORG }}
Expand All @@ -213,7 +211,7 @@ All notification integrations require Socket Enterprise.

**Microsoft Teams:**
```yaml
- uses: SocketDev/socket-basics@1.0.9
- uses: SocketDev/socket-basics@1.0.10
with:
github_token: ${{ secrets.GITHUB_TOKEN }}
socket_org: ${{ secrets.SOCKET_ORG }}
Expand All @@ -225,7 +223,7 @@ All notification integrations require Socket Enterprise.

**Generic Webhook:**
```yaml
- uses: SocketDev/socket-basics@1.0.9
- uses: SocketDev/socket-basics@1.0.10
with:
github_token: ${{ secrets.GITHUB_TOKEN }}
socket_org: ${{ secrets.SOCKET_ORG }}
Expand All @@ -237,7 +235,7 @@ All notification integrations require Socket Enterprise.

**SIEM Integration:**
```yaml
- uses: SocketDev/socket-basics@1.0.9
- uses: SocketDev/socket-basics@1.0.10
with:
github_token: ${{ secrets.GITHUB_TOKEN }}
socket_org: ${{ secrets.SOCKET_ORG }}
Expand All @@ -258,6 +256,7 @@ All notification integrations require Socket Enterprise.
name: Comprehensive Security Scan
on:
pull_request:
types: [opened, synchronize, reopened]
push:
branches: [main, develop]

Expand All @@ -269,12 +268,11 @@ jobs:
pull-requests: write
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

- name: Run Socket Basics
uses: SocketDev/socket-basics@1.0.9
uses: SocketDev/socket-basics@1.0.10
env:
# Optional: Explicitly set PR number for guaranteed PR comments
GITHUB_PR_NUMBER: ${{ github.event.pull_request.number || github.event.issue.number }}
with:
github_token: ${{ secrets.GITHUB_TOKEN }}
Expand Down Expand Up @@ -316,12 +314,11 @@ jobs:
pull-requests: write
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

- name: Run Full Security Scan
uses: SocketDev/socket-basics@1.0.9
uses: SocketDev/socket-basics@1.0.10
env:
# Optional: Explicitly set PR number for guaranteed PR comments
GITHUB_PR_NUMBER: ${{ github.event.pull_request.number || github.event.issue.number }}
with:
github_token: ${{ secrets.GITHUB_TOKEN }}
Expand Down Expand Up @@ -352,6 +349,8 @@ jobs:
```yaml
name: Container Security
on:
pull_request:
types: [opened, synchronize, reopened]
push:
branches: [main]
paths:
Expand All @@ -366,15 +365,14 @@ jobs:
pull-requests: write
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

- name: Build Docker Image
run: docker build -t myapp:1.0.9:${{ github.sha }} .
run: docker build -t myapp:1.0.10:${{ github.sha }} .

- name: Scan Container
uses: SocketDev/socket-basics@1.0.9
uses: SocketDev/socket-basics@1.0.10
env:
# Optional: Explicitly set PR number for guaranteed PR comments
GITHUB_PR_NUMBER: ${{ github.event.pull_request.number || github.event.issue.number }}
with:
github_token: ${{ secrets.GITHUB_TOKEN }}
Expand All @@ -391,7 +389,9 @@ jobs:

```yaml
name: Security Scan with Custom Rules
on: [pull_request]
on:
pull_request:
types: [opened, synchronize, reopened]

jobs:
security-scan:
Expand All @@ -401,12 +401,11 @@ jobs:
pull-requests: write
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

- name: Run Socket Basics
uses: SocketDev/socket-basics@1.0.9
uses: SocketDev/socket-basics@1.0.10
env:
# Optional: Explicitly set PR number for guaranteed PR comments
GITHUB_PR_NUMBER: ${{ github.event.pull_request.number || github.event.issue.number }}
with:
github_token: ${{ secrets.GITHUB_TOKEN }}
Expand Down Expand Up @@ -494,11 +493,11 @@ env:

**Problem:** Scanner reports no files found.

**Solution:** Ensure `actions/checkout@v4` runs before Socket Basics:
**Solution:** Ensure `actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683` runs before Socket Basics:
```yaml
steps:
- uses: actions/checkout@v4 # Must be first
- uses: SocketDev/socket-basics@1.0.9
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 - Must be first
- uses: SocketDev/socket-basics@1.0.10
```

### PR Comments Not Appearing
Expand Down
Loading