Repository navigation
Add Socket full application reachability scan - #96
Closed
sgrammargs wants to merge 3 commits into
Closed
sgrammargs wants to merge 3 commits into
sgrammargs wants to merge 3 commits into
Conversation
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Member
|
Hi Marguerite is this ready to review? |
Contributor
Author
@bradymholt This one needs to be approved and merged first - ynab/ynab-sast-scanner#5 - I will bump it this week and get these downstream PRs sorted 👍 |
A weekly run sits right at Socket's 7-day cutoff, so the GitHub App scan could replace the full application result first. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds a Socket full application reachability scan that calls the shared workflow from ynab/ynab-sast-scanner#5. It traces calls from this repo's code to settle alerts the precomputed analysis can't ("Direct dependency", "Potentially reachable", "Unknown"). On
main, its result replaces the precomputed verdicts on the alerts page and in the Asana rule.Runs on pushes to
main, twice a week, and on manual dispatch. The scheduled runs matter: once a repo has a full application result, Socket takes it off the 30-day re-scan and replaces results older than 7 days with the next GitHub App scan. A weekly run would sit right at that cutoff, so it runs Monday and Thursday. It doesn't run on PRs, so PR checks are no slower. If the analysis fails, no scan is created and the repo keeps its current results.Configuration: Python 3.12 for the analysis (the SDK itself supports 3.10+), default runner.
Testing: Latest test run (2026-11-03), from a test branch cut from this one, which doesn't touch the alerts page; scan report.
The shared workflow and its follow-up (ynab/ynab-sast-scanner#5 and ynab/ynab-sast-scanner#8) have both merged, so this is ready once reviewed. Merging it triggers the first scan of
main.🤖 Generated with Claude Code