Skip to content

Commit 8dfb7a1

Browse files
leliaclaude
lelia
and
claude
authored
Dependabot hardening + dependency update bundle (#84)
* Harden Dependabot reviews and bundle dependency updates Mirrors the Dependabot hardening done in socket-python-cli (#207/#217/#218), adapted to this SDK (no Dockerfile, no e2e fixtures, hatch/pip build path). Bundle dependency updates (supersedes 4 open Dependabot PRs): - idna 3.11 -> 3.17 (security: CVE-2026-45409 quadratic-time DoS fix) - cryptography 46.0.5 -> 46.0.7 - pygments 2.19.2 -> 2.20.0 - uv 0.9.21 -> 0.11.17 Verified via uv sync --locked, import smoke, and pytest tests/unit (102 passed). Adds grouped/cooldowned dependabot.yml (uv + github-actions), a dependabot-review workflow running anonymous Socket Firewall smoke jobs, Version Check / PR Preview skips for Dependabot PRs, and setup-sfw / setup-hatch composite actions. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * chore(release): bump to 3.1.2 Version Check requires a package-version increment on maintainer PRs, and this PR bundles dependency bumps + Dependabot hardening. Bump version.py, pyproject.toml, and the uv.lock project version in sync. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * Extend dependency review to maintainers (free + enterprise SFW) Broaden dependabot-review into dependency-review so the Socket Firewall guardrail covers maintainer PRs too, not just Dependabot: - inspect now runs on every PR and computes the SFW edition per-PR: enterprise for a trusted SocketDev member (author_association OWNER/ MEMBER/COLLABORATOR) on an in-repo (non-fork) PR when SOCKET_API_TOKEN is present; free (anonymous) for Dependabot, forks, external contributors, or when the token is absent. - The mode degrades to free whenever the token is missing, so this is safe to ship before the secret exists and auto-upgrades to enterprise once SOCKET_API_TOKEN is added (repo or org level). The SDK has no Socket token today (cf. socket-python-cli's SOCKET_CLI_API_TOKEN). - setup-sfw composite action gains `mode` + `socket-token` inputs, forwarded to socketdev/action (same action, firewall-free vs firewall-enterprise). - Rename workflow dependabot-review.yml -> dependency-review.yml to match the broadened scope (not a required status check). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * fix(dependency-review): use runner Python, forbid uv interpreter download .python-version pins 3.12.7; setup-python provides 3.12.13, so `uv sync` tried to download the exact managed CPython from GitHub, which Socket Firewall's TLS interception blocked (UnknownIssuer). Set UV_PYTHON=3.12 + UV_PYTHON_DOWNLOADS=never so uv uses the runner interpreter and only PyPI package fetches route through sfw. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * fix(dependency-review): require strict org membership for enterprise SFW Tighten the enterprise-mode gate to author_association OWNER/MEMBER only. Outside collaborators (COLLABORATOR) now fall through to the free edition, same as Dependabot / forks / external contributors. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * chore(dependency-review): rename enterprise secret to SOCKET_SFW_API_TOKEN Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * fix(dependency-review): scope SFW token to a dedicated environment Resolve zizmor secrets-outside-env (medium) without suppressing it. Split the single mode-switching smoke job into two: - python-sfw-smoke-free: untrusted PRs (Dependabot, forks, outside collaborators, externals). Anonymous free edition, never references the token. - python-sfw-smoke-enterprise: SocketDev org members (OWNER/MEMBER) on an in-repo PR. Authenticated enterprise edition; SOCKET_SFW_API_TOKEN is scoped to the `socket-firewall` GitHub environment, so only this job can read it. inspect now classifies PR trust (author_association OWNER/MEMBER, non-fork, non-Dependabot) and references no secret. No required-reviewer protection on the environment, so trusted dep PRs still run automatically. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * fix(dependency-review): gate enterprise on write-access (non-fork), not author_association author_association only reflects PUBLIC org membership, so private members (the common case here) show as CONTRIBUTOR and were misclassified -> the enterprise job always skipped. Switch the trust gate to "non-fork PR and not Dependabot": only accounts with write access can push an in-repo branch, the same boundary GitHub uses for secret exposure. No read:org token needed. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * ci(dependency-review): upload SFW smoke artifacts * ci(dependency-review): include SFW JSON report artifact * ci(dependency-review): read SFW report path from env var, drop stdout scrape Match socket-python-cli: discover the firewall report via the $SFW_JSON_REPORT_PATH env var that socketdev/action exports, instead of parsing the 'sfw report written to:' line out of stdout. The two sync steps return to plain 'set -o pipefail' + tee. A new 'Collect SFW JSON report' step (if: always(), before each upload) copies $SFW_JSON_REPORT_PATH into sfw-artifacts/sfw-report.json -- copy, not move, since socketdev/action's post step reads that temp path for its job summary -- and drops a sfw-report-missing.txt breadcrumb when absent. More robust than scraping an undocumented log string, and keeps the report-capture pattern uniform across both repos. Signed-off-by: lelia <2418071+lelia@users.noreply.github.com> --------- Signed-off-by: lelia <2418071+lelia@users.noreply.github.com> Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
1 parent be87c34 commit 8dfb7a1

10 files changed

Lines changed: 513 additions & 97 deletions

File tree

‎.github/actions/setup-hatch/action.yml‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
name: "Set up Hatch build tooling"
2+
description: >-
3+
Install the pinned hatch / hatchling / virtualenv toolchain used to build
4+
and publish the package. Assumes Python is already set up by the caller.
5+
6+
runs:
7+
using: "composite"
8+
steps:
9+
- shell: bash
10+
run: |
11+
python -m pip install --upgrade pip
12+
pip install "virtualenv<20.36"
13+
pip install hatchling==1.27.0 hatch==1.14.0

‎.github/actions/setup-sfw/action.yml‎

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
name: "Set up Socket Firewall"
2+
description: >-
3+
Set up the requested Python/uv toolchain and install Socket Firewall so
4+
subsequent steps can run package-manager commands wrapped with `sfw`.
5+
Defaults to free/anonymous mode (no API token -- safe on untrusted /
6+
Dependabot / fork PRs). Pass mode: firewall-enterprise + socket-token for
7+
full org-policy enforcement on trusted maintainer PRs.
8+
9+
inputs:
10+
python:
11+
description: "Set up Python 3.12"
12+
default: "false"
13+
uv:
14+
description: "Install uv (implies Python)"
15+
default: "false"
16+
mode:
17+
description: "socketdev/action mode: firewall-free or firewall-enterprise"
18+
default: "firewall-free"
19+
socket-token:
20+
description: "Socket API token (only used/required for firewall-enterprise)"
21+
default: ""
22+
23+
runs:
24+
using: "composite"
25+
steps:
26+
- if: ${{ inputs.python == 'true' || inputs.uv == 'true' }}
27+
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
28+
with:
29+
python-version: "3.12"
30+
31+
# Official Socket setup action. Wires up sfw routing correctly.
32+
# socket-token is ignored in firewall-free mode and empty when absent.
33+
- uses: socketdev/action@ba6de6cc0565af1f42295590380973573297e31f # v1.3.2
34+
with:
35+
mode: ${{ inputs.mode }}
36+
socket-token: ${{ inputs.socket-token }}
37+
38+
- if: ${{ inputs.uv == 'true' }}
39+
name: Install uv
40+
shell: bash
41+
run: python -m pip install --upgrade pip uv

‎.github/dependabot.yml‎

Lines changed: 63 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,63 @@
1+
# Dependabot configuration for socket-sdk-python.
2+
#
3+
# Design notes:
4+
# - Python deps are grouped into a weekly PR (minor/patch), with a
5+
# separate group for majors so breaking bumps stay reviewable.
6+
# - GitHub Actions are grouped similarly into one weekly PR, and Dependabot
7+
# scans both the workflows and the local composite actions.
8+
# - 7-day cooldown enforced across all ecosystems.
9+
# - This repo ships no Dockerfile, so there is no docker ecosystem entry.
10+
11+
version: 2
12+
updates:
13+
14+
# Python deps (uv-tracked via uv.lock)
15+
- package-ecosystem: "uv"
16+
directory: "/"
17+
schedule:
18+
interval: "weekly"
19+
open-pull-requests-limit: 2
20+
groups:
21+
python-minor-patch:
22+
patterns:
23+
- "*"
24+
update-types:
25+
- "minor"
26+
- "patch"
27+
python-major:
28+
patterns:
29+
- "*"
30+
update-types:
31+
- "major"
32+
labels:
33+
- "dependencies"
34+
- "python:uv"
35+
commit-message:
36+
prefix: "chore"
37+
include: "scope"
38+
cooldown:
39+
default-days: 7
40+
41+
# GitHub Actions used in workflows and local composite actions.
42+
- package-ecosystem: "github-actions"
43+
directories:
44+
- "/"
45+
- "/.github/actions/*"
46+
schedule:
47+
interval: "weekly"
48+
open-pull-requests-limit: 2
49+
groups:
50+
github-actions-minor-patch:
51+
patterns:
52+
- "*"
53+
update-types:
54+
- "minor"
55+
- "patch"
56+
labels:
57+
- "dependencies"
58+
- "github-actions"
59+
commit-message:
60+
prefix: "ci"
61+
include: "scope"
62+
cooldown:
63+
default-days: 7

0 commit comments

Comments
 (0)