Skip to content

Commit 560bd1f

Browse files
dacoburndacoburn
authored
Updated examples with PR check and pinning to commit hashes (#9)
1 parent 1e9af0f commit 560bd1f

File tree

6 files changed

+86
-77
lines changed

6 files changed

+86
-77
lines changed

‎README.md‎

Lines changed: 16 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -18,12 +18,18 @@ on:
1818

1919
jobs:
2020
security-scan:
21+
permissions:
22+
issues: write
23+
contents: read
24+
pull-requests: write
2125
runs-on: ubuntu-latest
2226
steps:
23-
- uses: actions/checkout@v4
27+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
2428

2529
- name: Run Socket Basics
26-
uses: SocketDev/socket-basics@1.0.9
30+
uses: SocketDev/socket-basics@1.0.10
31+
env:
32+
GITHUB_PR_NUMBER: ${{ github.event.pull_request.number || github.event.issue.number }}
2733
with:
2834
github_token: ${{ secrets.GITHUB_TOKEN }}
2935
socket_security_api_key: ${{ secrets.SOCKET_SECURITY_API_KEY }}
@@ -106,7 +112,9 @@ Configure scanning policies, notification channels, and rule sets for your entir
106112

107113
**Dashboard-Configured (Enterprise):**
108114
```yaml
109-
- uses: SocketDev/socket-basics@1.0.9
115+
- uses: SocketDev/socket-basics@1.0.10
116+
env:
117+
GITHUB_PR_NUMBER: ${{ github.event.pull_request.number || github.event.issue.number }}
110118
with:
111119
github_token: ${{ secrets.GITHUB_TOKEN }}
112120
socket_security_api_key: ${{ secrets.SOCKET_SECURITY_API_KEY }}
@@ -115,7 +123,9 @@ Configure scanning policies, notification channels, and rule sets for your entir
115123

116124
**CLI-Configured:**
117125
```yaml
118-
- uses: SocketDev/socket-basics@1.0.9
126+
- uses: SocketDev/socket-basics@1.0.10
127+
env:
128+
GITHUB_PR_NUMBER: ${{ github.event.pull_request.number || github.event.issue.number }}
119129
with:
120130
github_token: ${{ secrets.GITHUB_TOKEN }}
121131
python_sast_enabled: 'true'
@@ -129,10 +139,10 @@ Configure scanning policies, notification channels, and rule sets for your entir
129139

130140
```bash
131141
# Build with version tag
132-
docker build -t socketdev/socket-basics:1.0.9 .
142+
docker build -t socketdev/socket-basics:1.0.10 .
133143
134144
# Run scan
135-
docker run --rm -v "$PWD:/workspace" socketdev/socket-basics:1.0.9 \
145+
docker run --rm -v "$PWD:/workspace" socketdev/socket-basics:1.0.10 \
136146
--workspace /workspace \
137147
--python-sast-enabled \
138148
--secret-scanning-enabled \

‎docs/github-action.md‎

Lines changed: 32 additions & 33 deletions
Original file line numberDiff line numberDiff line change
@@ -35,12 +35,11 @@ jobs:
3535
pull-requests: write
3636
runs-on: ubuntu-latest
3737
steps:
38-
- uses: actions/checkout@v4
38+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
3939

4040
- name: Run Socket Basics
41-
uses: SocketDev/socket-basics@1.0.9
41+
uses: SocketDev/socket-basics@1.0.10
4242
env:
43-
# Optional: Explicitly set PR number for guaranteed PR comments
4443
GITHUB_PR_NUMBER: ${{ github.event.pull_request.number || github.event.issue.number }}
4544
with:
4645
github_token: ${{ secrets.GITHUB_TOKEN }}
@@ -79,7 +78,7 @@ Include these in your workflow's `jobs.<job_id>.permissions` section.
7978

8079
**SAST (Static Analysis):**
8180
```yaml
82-
- uses: SocketDev/socket-basics@1.0.9
81+
- uses: SocketDev/socket-basics@1.0.10
8382
with:
8483
github_token: ${{ secrets.GITHUB_TOKEN }}
8584
# Enable SAST for specific languages
@@ -93,7 +92,7 @@ Include these in your workflow's `jobs.<job_id>.permissions` section.
9392

9493
**Secret Scanning:**
9594
```yaml
96-
- uses: SocketDev/socket-basics@1.0.9
95+
- uses: SocketDev/socket-basics@1.0.10
9796
with:
9897
github_token: ${{ secrets.GITHUB_TOKEN }}
9998
secret_scanning_enabled: 'true'
@@ -105,7 +104,7 @@ Include these in your workflow's `jobs.<job_id>.permissions` section.
105104

106105
**Container Scanning:**
107106
```yaml
108-
- uses: SocketDev/socket-basics@1.0.9
107+
- uses: SocketDev/socket-basics@1.0.10
109108
with:
110109
github_token: ${{ secrets.GITHUB_TOKEN }}
111110
# Scan Docker images (auto-enables container scanning)
@@ -116,7 +115,7 @@ Include these in your workflow's `jobs.<job_id>.permissions` section.
116115

117116
**Socket Tier 1 Reachability:**
118117
```yaml
119-
- uses: SocketDev/socket-basics@1.0.9
118+
- uses: SocketDev/socket-basics@1.0.10
120119
with:
121120
github_token: ${{ secrets.GITHUB_TOKEN }}
122121
socket_tier_1_enabled: 'true'
@@ -125,7 +124,7 @@ Include these in your workflow's `jobs.<job_id>.permissions` section.
125124
### Output Configuration
126125

127126
```yaml
128-
- uses: SocketDev/socket-basics@1.0.9
127+
- uses: SocketDev/socket-basics@1.0.10
129128
with:
130129
github_token: ${{ secrets.GITHUB_TOKEN }}
131130
python_sast_enabled: 'true'
@@ -155,9 +154,8 @@ Configure Socket Basics centrally from the [Socket Dashboard](https://socket.dev
155154

156155
**Enable in workflow:**
157156
```yaml
158-
- uses: SocketDev/socket-basics@1.0.9
157+
- uses: SocketDev/socket-basics@1.0.10
159158
env:
160-
# Optional: Explicitly set PR number for guaranteed PR comments
161159
GITHUB_PR_NUMBER: ${{ github.event.pull_request.number || github.event.issue.number }}
162160
with:
163161
github_token: ${{ secrets.GITHUB_TOKEN }}
@@ -168,7 +166,7 @@ Configure Socket Basics centrally from the [Socket Dashboard](https://socket.dev
168166

169167
> **Note:** You can also pass credentials using environment variables instead of the `with:` section:
170168
> ```yaml
171-
> - uses: SocketDev/socket-basics@1.0.9
169+
> - uses: SocketDev/socket-basics@1.0.10
172170
> env:
173171
> SOCKET_SECURITY_API_KEY: ${{ secrets.SOCKET_SECURITY_API_KEY }}
174172
> with:
@@ -186,7 +184,7 @@ All notification integrations require Socket Enterprise.
186184

187185
**Slack Notifications:**
188186
```yaml
189-
- uses: SocketDev/socket-basics@1.0.9
187+
- uses: SocketDev/socket-basics@1.0.10
190188
with:
191189
github_token: ${{ secrets.GITHUB_TOKEN }}
192190
socket_org: ${{ secrets.SOCKET_ORG }}
@@ -198,7 +196,7 @@ All notification integrations require Socket Enterprise.
198196

199197
**Jira Issue Creation:**
200198
```yaml
201-
- uses: SocketDev/socket-basics@1.0.9
199+
- uses: SocketDev/socket-basics@1.0.10
202200
with:
203201
github_token: ${{ secrets.GITHUB_TOKEN }}
204202
socket_org: ${{ secrets.SOCKET_ORG }}
@@ -213,7 +211,7 @@ All notification integrations require Socket Enterprise.
213211

214212
**Microsoft Teams:**
215213
```yaml
216-
- uses: SocketDev/socket-basics@1.0.9
214+
- uses: SocketDev/socket-basics@1.0.10
217215
with:
218216
github_token: ${{ secrets.GITHUB_TOKEN }}
219217
socket_org: ${{ secrets.SOCKET_ORG }}
@@ -225,7 +223,7 @@ All notification integrations require Socket Enterprise.
225223

226224
**Generic Webhook:**
227225
```yaml
228-
- uses: SocketDev/socket-basics@1.0.9
226+
- uses: SocketDev/socket-basics@1.0.10
229227
with:
230228
github_token: ${{ secrets.GITHUB_TOKEN }}
231229
socket_org: ${{ secrets.SOCKET_ORG }}
@@ -237,7 +235,7 @@ All notification integrations require Socket Enterprise.
237235

238236
**SIEM Integration:**
239237
```yaml
240-
- uses: SocketDev/socket-basics@1.0.9
238+
- uses: SocketDev/socket-basics@1.0.10
241239
with:
242240
github_token: ${{ secrets.GITHUB_TOKEN }}
243241
socket_org: ${{ secrets.SOCKET_ORG }}
@@ -258,6 +256,7 @@ All notification integrations require Socket Enterprise.
258256
name: Comprehensive Security Scan
259257
on:
260258
pull_request:
259+
types: [opened, synchronize, reopened]
261260
push:
262261
branches: [main, develop]
263262
@@ -269,12 +268,11 @@ jobs:
269268
pull-requests: write
270269
runs-on: ubuntu-latest
271270
steps:
272-
- uses: actions/checkout@v4
271+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
273272
274273
- name: Run Socket Basics
275-
uses: SocketDev/socket-basics@1.0.9
274+
uses: SocketDev/socket-basics@1.0.10
276275
env:
277-
# Optional: Explicitly set PR number for guaranteed PR comments
278276
GITHUB_PR_NUMBER: ${{ github.event.pull_request.number || github.event.issue.number }}
279277
with:
280278
github_token: ${{ secrets.GITHUB_TOKEN }}
@@ -316,12 +314,11 @@ jobs:
316314
pull-requests: write
317315
runs-on: ubuntu-latest
318316
steps:
319-
- uses: actions/checkout@v4
317+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
320318
321319
- name: Run Full Security Scan
322-
uses: SocketDev/socket-basics@1.0.9
320+
uses: SocketDev/socket-basics@1.0.10
323321
env:
324-
# Optional: Explicitly set PR number for guaranteed PR comments
325322
GITHUB_PR_NUMBER: ${{ github.event.pull_request.number || github.event.issue.number }}
326323
with:
327324
github_token: ${{ secrets.GITHUB_TOKEN }}
@@ -352,6 +349,8 @@ jobs:
352349
```yaml
353350
name: Container Security
354351
on:
352+
pull_request:
353+
types: [opened, synchronize, reopened]
355354
push:
356355
branches: [main]
357356
paths:
@@ -366,15 +365,14 @@ jobs:
366365
pull-requests: write
367366
runs-on: ubuntu-latest
368367
steps:
369-
- uses: actions/checkout@v4
368+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
370369
371370
- name: Build Docker Image
372-
run: docker build -t myapp:1.0.9:${{ github.sha }} .
371+
run: docker build -t myapp:1.0.10:${{ github.sha }} .
373372
374373
- name: Scan Container
375-
uses: SocketDev/socket-basics@1.0.9
374+
uses: SocketDev/socket-basics@1.0.10
376375
env:
377-
# Optional: Explicitly set PR number for guaranteed PR comments
378376
GITHUB_PR_NUMBER: ${{ github.event.pull_request.number || github.event.issue.number }}
379377
with:
380378
github_token: ${{ secrets.GITHUB_TOKEN }}
@@ -391,7 +389,9 @@ jobs:
391389

392390
```yaml
393391
name: Security Scan with Custom Rules
394-
on: [pull_request]
392+
on:
393+
pull_request:
394+
types: [opened, synchronize, reopened]
395395
396396
jobs:
397397
security-scan:
@@ -401,12 +401,11 @@ jobs:
401401
pull-requests: write
402402
runs-on: ubuntu-latest
403403
steps:
404-
- uses: actions/checkout@v4
404+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
405405
406406
- name: Run Socket Basics
407-
uses: SocketDev/socket-basics@1.0.9
407+
uses: SocketDev/socket-basics@1.0.10
408408
env:
409-
# Optional: Explicitly set PR number for guaranteed PR comments
410409
GITHUB_PR_NUMBER: ${{ github.event.pull_request.number || github.event.issue.number }}
411410
with:
412411
github_token: ${{ secrets.GITHUB_TOKEN }}
@@ -494,11 +493,11 @@ env:
494493

495494
**Problem:** Scanner reports no files found.
496495

497-
**Solution:** Ensure `actions/checkout@v4` runs before Socket Basics:
496+
**Solution:** Ensure `actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683` runs before Socket Basics:
498497
```yaml
499498
steps:
500-
- uses: actions/checkout@v4 # Must be first
501-
- uses: SocketDev/socket-basics@1.0.9
499+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 - Must be first
500+
- uses: SocketDev/socket-basics@1.0.10
502501
```
503502

504503
### PR Comments Not Appearing

0 commit comments

Comments
 (0)