Skip to content

Dependabot hardening + dependency update bundle#84

Open
lelia wants to merge 8 commits into
mainfrom
lelia/dependabot-hardening
Open

Dependabot hardening + dependency update bundle#84
lelia wants to merge 8 commits into
mainfrom
lelia/dependabot-hardening

Conversation

@lelia
Copy link
Copy Markdown
Contributor

@lelia lelia commented Jun 1, 2026 •
edited
Loading

Summary

Mirrors the Dependabot hardening done in socket-python-cli (#207 / #217 / #218), adapted to this SDK (no Dockerfile, no e2e fixtures, hatch/pip build path), and extended so the Socket Firewall guardrail covers maintainer PRs, not just Dependabot. Three threads:

  1. Bundle dependency updates — supersedes the 4 open Dependabot PRs in one verified change.
  2. Dependency review — anonymous Socket Firewall smoke on every dependency PR, with an authenticated (enterprise) upgrade path for trusted SocketDev members.
  3. Workflow plumbing — composite actions + Dependabot-aware skips on the publish/version workflows.

Dependencies (supersedes 4 Dependabot PRs)

PR Package Bump Notes
#80 idna 3.11 → 3.17 CVE-2026-45409 fix (quadratic-time DoS)
#75 cryptography 46.0.5 → 46.0.7
#74 pygments 2.19.2 → 2.20.0
#83 uv 0.9.21 → 0.11.17 latest (Dependabot targeted 0.11.15)

All four are transitive build/dev deps; runtime deps (requests, typing-extensions) are unchanged. Targeted uv lock upgrades only — no unrelated churn. The 4 Dependabot PRs were closed manually (GitHub closing keywords only close issues, not PRs).

Dependency review (.github/workflows/dependency-review.yml)

On every PR: inspect changed files, then run a Socket Firewall (sfw uv sync --locked) + import-smoke job when Python deps change. The firewall edition is chosen per-PR in inspect:

  • Enterprise (firewall-enterprise + socket-token) — for a trusted SocketDev member (author_association ∈ OWNER/MEMBER/COLLABORATOR) on an in-repo (non-fork) PR, when SOCKET_SFW_API_TOKEN is present. Full org-policy enforcement.
  • Free (firewall-free, anonymous, no token) — Dependabot, forks, external contributors, or whenever the token is absent. Safe in the unprivileged pull_request context (no pull_request_target, no secret-leak surface).

The mode degrades to free whenever the token is missing, so this is safe to ship today and auto-upgrades to enterprise once the secret exists — no follow-up PR needed.

⚠️ Action required to enable enterprise mode: add a SOCKET_SFW_API_TOKEN secret (repo or org level) holding a Socket API token. The SDK has none today; the CLI uses SOCKET_CLI_API_TOKEN as precedent. Until it's added, all PRs use the free edition.

Verified live on this PR: inspect → firewall-free (no token yet) → python-sfw-smoke installs Socket Firewall Free v1.12.0 and runs sfw uv sync + import smoke successfully.

Dependabot config + workflow skips

  • .github/dependabot.yml (new). Grouped (minor/patch + separate major), 7-day cooldown; uv + github-actions (scanning /.github/workflows and /.github/actions/*). No docker ecosystem — no Dockerfile here.
  • version-check.yml skips Dependabot PRs (dep bumps carry no package-version bump).
  • pr-preview.yml skips Dependabot + fork PRs and gains concurrency cancellation.
  • This PR bumps the package version to 3.1.2 (Version Check requires an increment on maintainer PRs).

Workflow cleanup

  • .github/actions/setup-sfw (now parameterized with mode + socket-token) and .github/actions/setup-hatch composite actions. pr-preview.yml and release.yml use setup-hatch to de-duplicate the pinned virtualenv/hatchling/hatch install.

Test plan

Automated (local + CI, all green):

  • uv lock --locked; uv sync --locked --extra test --extra dev
  • Import smoke; pytest tests/unit — 102 passed, 1 skipped
  • actionlint on all workflows; YAML parse on all .github files
  • CI on this PR: inspect, python-sfw-smoke (free mode), workflow-notice, check_version, preview all pass

Pending:

  • Add SOCKET_SFW_API_TOKEN secret, then confirm a maintainer dep PR runs python-sfw-smoke in firewall-enterprise mode
  • Next Dependabot PR: runs in firewall-free; Version Check + PR Preview show skipped

@lelia @claude
Harden Dependabot reviews and bundle dependency updates
b77634d 
Mirrors the Dependabot hardening done in socket-python-cli (#207/#217/#218),
adapted to this SDK (no Dockerfile, no e2e fixtures, hatch/pip build path).

Bundle dependency updates (supersedes 4 open Dependabot PRs):
- idna 3.11 -> 3.17 (security: CVE-2026-45409 quadratic-time DoS fix)
- cryptography 46.0.5 -> 46.0.7
- pygments 2.19.2 -> 2.20.0
- uv 0.9.21 -> 0.11.17

Verified via uv sync --locked, import smoke, and pytest tests/unit (102 passed).

Adds grouped/cooldowned dependabot.yml (uv + github-actions), a
dependabot-review workflow running anonymous Socket Firewall smoke jobs,
Version Check / PR Preview skips for Dependabot PRs, and setup-sfw /
setup-hatch composite actions.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
@lelia lelia requested a review from a team as a code owner June 1, 2026 18:30
This was referenced Jun 1, 2026
Closed
Closed
Closed
Closed
@github-actions
Copy link
Copy Markdown

github-actions Bot commented Jun 1, 2026 •
edited
Loading

🚀 Preview package published!

Install with:

pip install --index-url https://test.pypi.org/simple/ --extra-index-url https://pypi.org/simple socketdev==3.1.2.dev5

@lelia lelia added enhancement New feature or request dependencies Pull requests that update a dependency file labels Jun 1, 2026
lelia and others added 3 commits June 1, 2026 15:15
@lelia @claude
chore(release): bump to 3.1.2
69524b9 
Version Check requires a package-version increment on maintainer PRs, and
this PR bundles dependency bumps + Dependabot hardening. Bump version.py,
pyproject.toml, and the uv.lock project version in sync.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
@lelia @claude
Extend dependency review to maintainers (free + enterprise SFW)
bca454d 
Broaden dependabot-review into dependency-review so the Socket Firewall
guardrail covers maintainer PRs too, not just Dependabot:

- inspect now runs on every PR and computes the SFW edition per-PR:
  enterprise for a trusted SocketDev member (author_association OWNER/
  MEMBER/COLLABORATOR) on an in-repo (non-fork) PR when SOCKET_API_TOKEN
  is present; free (anonymous) for Dependabot, forks, external
  contributors, or when the token is absent.
- The mode degrades to free whenever the token is missing, so this is
  safe to ship before the secret exists and auto-upgrades to enterprise
  once SOCKET_API_TOKEN is added (repo or org level). The SDK has no
  Socket token today (cf. socket-python-cli's SOCKET_CLI_API_TOKEN).
- setup-sfw composite action gains `mode` + `socket-token` inputs,
  forwarded to socketdev/action (same action, firewall-free vs
  firewall-enterprise).
- Rename workflow dependabot-review.yml -> dependency-review.yml to match
  the broadened scope (not a required status check).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
@lelia @claude
fix(dependency-review): use runner Python, forbid uv interpreter down…
37d06ad 
…load

.python-version pins 3.12.7; setup-python provides 3.12.13, so `uv sync`
tried to download the exact managed CPython from GitHub, which Socket
Firewall's TLS interception blocked (UnknownIssuer). Set UV_PYTHON=3.12 +
UV_PYTHON_DOWNLOADS=never so uv uses the runner interpreter and only PyPI
package fetches route through sfw.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
@lelia lelia changed the title Harden Dependabot reviews and bundle dependency updates Harden dependency reviews (free + enterprise SFW) and bundle dependency updates Jun 1, 2026
@lelia lelia changed the title Harden dependency reviews (free + enterprise SFW) and bundle dependency updates Harden dependency reviews + bundle dependency updates Jun 1, 2026
@lelia lelia changed the title Harden dependency reviews + bundle dependency updates Dependabot hardening + dependency update bundle Jun 1, 2026
@lelia @claude
fix(dependency-review): require strict org membership for enterprise SFW
b0e50b0 
Tighten the enterprise-mode gate to author_association OWNER/MEMBER only.
Outside collaborators (COLLABORATOR) now fall through to the free edition,
same as Dependabot / forks / external contributors.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
@lelia lelia mentioned this pull request Jun 1, 2026
Open
8 tasks
lelia and others added 3 commits June 1, 2026 16:15
@lelia @claude
chore(dependency-review): rename enterprise secret to SOCKET_SFW_API_…
9f5b0fb 
…TOKEN

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
@lelia @claude
fix(dependency-review): scope SFW token to a dedicated environment
6d2433c 
Resolve zizmor secrets-outside-env (medium) without suppressing it. Split
the single mode-switching smoke job into two:

- python-sfw-smoke-free: untrusted PRs (Dependabot, forks, outside
  collaborators, externals). Anonymous free edition, never references the
  token.
- python-sfw-smoke-enterprise: SocketDev org members (OWNER/MEMBER) on an
  in-repo PR. Authenticated enterprise edition; SOCKET_SFW_API_TOKEN is
  scoped to the `socket-firewall` GitHub environment, so only this job can
  read it.

inspect now classifies PR trust (author_association OWNER/MEMBER, non-fork,
non-Dependabot) and references no secret. No required-reviewer protection
on the environment, so trusted dep PRs still run automatically.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
@lelia @claude
fix(dependency-review): gate enterprise on write-access (non-fork), n…
8f1318e 
…ot author_association

author_association only reflects PUBLIC org membership, so private members
(the common case here) show as CONTRIBUTOR and were misclassified -> the
enterprise job always skipped. Switch the trust gate to "non-fork PR and not
Dependabot": only accounts with write access can push an in-repo branch, the
same boundary GitHub uses for secret exposure. No read:org token needed.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
@lelia lelia temporarily deployed to socket-firewall June 1, 2026 20:38 — with GitHub Actions Inactive
@lelia lelia deployed to socket-firewall June 1, 2026 20:46 — with GitHub Actions Active
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file enhancement New feature or request

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@lelia