feat: add Socket Basics security workflow for public repos

[william-u10d]

What

Adds .github/workflows/security.yaml — a Socket Basics SAST / secret-scanning workflow for public repositories, hosted here so public repos can consume it (public repos cannot reference reusable/required workflows that live in a private or internal repo).

Why

Part of operationalizing Socket as the SAST + secret-scanning control replacing GHAS. Public repos (unstructured, unstructured-api, etc.) currently have zero SAST coverage; this closes that gap. Intended to be enforced org-wide on public repos via a repository ruleset scoped to visibility: public.

Details

• Trigger: on: pull_request (not pull_request_target — no "pwn request" surface).
• Posture: informational (continue-on-error: true) — never blocks a PR. Real-finding gating is governed by the Socket dashboard policy + the native Socket GitHub App, not this workflow.
• Secret: consumes the org secret PUBLIC_SOCKET_SECURITY_API_KEY (must be created + scoped to the public repos separately).
• Fork-PR safety: the scan step is gated by if: github.event.pull_request.head.repo.full_name == github.repository, so it runs only on trusted same-repo PRs. Fork PRs don't receive secrets by design and are covered by the native Socket App instead.
• Pinning: SocketDev/socket-basics@6b71cdf3f792e1ba15b0c42133d8a6f29fb1fc4f (v3.0.0), actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd (v6).
• Permissions: top-level permissions: {} default-deny; scan job grants itself only contents: read.

Security review

security-audit pass: no Critical/High/Medium findings — injection-safe (untrusted github.event.* fields bound via env: + printf %s), secrets withheld from forks, SHA-pinned, least-privilege.

Follow-ups (not in this PR)

• Create org secret PUBLIC_SOCKET_SECURITY_API_KEY scoped to the public repos.
• Add visibility: public org ruleset to enforce this as a required workflow.

---

Summary by cubic

Adds .github/workflows/security.yaml to run Socket Basics SAST and secret scanning on PRs in public repos, closing the current gap where public repos had no SAST coverage. Previously: no scans. Now: informational scans on same-repo PRs; fork PRs are covered by the Socket GitHub App. Never blocks merges.

• Trigger: pull_request (not pull_request_target).
• Posture: informational (continue-on-error: true); enforcement remains in the Socket dashboard and GitHub App.
• Secrets and safety: uses PUBLIC_SOCKET_SECURITY_API_KEY; step runs only when github.event.pull_request.head.repo.full_name == github.repository so secrets never reach forks.
• Permissions: top-level {}; job grants only contents: read.
• Pinning: SocketDev/socket-basics@6b71cdf3f792e1ba15b0c42133d8a6f29fb1fc4f (v3.0.0), actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd (v6).
• Failure handling: logs a warning annotation and structured audit line.

Rollout

• Create org secret PUBLIC_SOCKET_SECURITY_API_KEY scoped to public repos.
• Add an org repository ruleset for visibility: public to require this workflow.

^{Written for commit cba4c7e. Summary will update on new commits.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	socketdev/​socket-basics@​6b71cdf3f792e1ba15b0c42133d8a6f29fb1fc4f
	actions/​checkout@​de0fac2e4500dabe0009e67214ff5f5447ce83dd

View full report