[onyinyechinwokwu-success]

Summary

Follow-up to #917/#918/#919 (merged in #925) for the remaining part of #922. Two changes:

• Pin every GitHub Action to a commit SHA. OpenSSF Scorecard's Pinned-Dependencies check was at 2/10 on main, because most actions used mutable tags. Each uses: line now has the commit SHA of its current release, with the version as a comment.
• Socket package-risk scan on pull requests (.github/workflows/socket.yml). It runs socket ci (CLI 1.10.0, pinned) to score added or changed packages for install scripts, obfuscated code, network access and new maintainers.

Linked issue

Closes #922.

The Socket scan is merged but not yet active: it needs the SOCKET_CLI_API_TOKEN secret, which a maintainer must add. Setup and the untested parts are listed below as follow-up for maintainers.

Socket follow-up (maintainer)

• Add the SOCKET_CLI_API_TOKEN repository secret. The scan is skipped without it.
• Optionally set the SOCKET_ORG repository variable to the Socket org slug. Without it, the CLI uses its own default org.
• Set the thresholds in the Socket dashboard policy: fail on install scripts, obfuscated files, network access and new authors in runtime dependencies. The workflow doesn't carry them.
• Fork PRs don't receive secrets, so the scan is skipped there with a notice (not a pass). Maintainer PRs and pushes to this repo are scanned.

Not verified

• Socket reads bun.lock. The CLI's dry run bails before manifest discovery without a token, so I couldn't confirm locally that it finds bun.lock. The first run with the secret is the test.
• Socket blocks on a bad package. Not tested. That needs a test PR with a real token.

Scorecard: what's still open (for follow-up issues)

Measured locally with Scorecard v5.6.0 against main before this PR: 5.8/10. Scorecard is run against the default branch, so the score after this PR is only known after the next scheduled run.

• Dangerous-Workflow (0): auto-review.yml runs under pull_request_target and checks out base.sha. Scorecard flags any checkout in that event as an untrusted checkout, so the flag may be a false positive. It is upstream's workflow, and changing it is a separate decision.
• SAST (0): Scorecard wants a SAST tool on every commit. CodeQL is set up in default-setup mode, so an advanced workflow would conflict with it. Needs a repo-settings decision.
• Branch-Protection (0), Fuzzing (0), CII-Best-Practices (0): repo settings or external processes, not workflow changes.
• Vulnerabilities (4): transitive braces, uuid, stream-json and elliptic. No fixes available in range (see Supply-chain hardening: patch advisories, install policy, dependency review #925).
• Packaging (-1), Signed-Releases (-1): this repo doesn't publish releases.

Test evidence

Local, bun 1.3.14 and Node 24:

• typecheck, lint, format:check: pass
• test:coverage: 133 files, 1496 tests passed, 3 expected fails
• Socket workflow's skip branch, run with the token unset: prints the notice and exits 0
• All workflow YAML parses; every uses: ref is a 40-character SHA

Checklist

• Tied to the open issue (Refs #922)
• typecheck, lint, format:check, test pass locally
• No UI change
• Docs: the Socket setup is in the workflow header comment (no CONTRIBUTING change)
• No secrets committed

Supply-chain gate: this PR changes workflows, so the upstream supply-chain review gate will block it until a maintainer applies supply-chain-reviewed.

[vercel]

@onyinyechinwokwu-success is attempting to deploy a commit to the David Dada's projects Team on Vercel.

A member of the Team first needs to authorize it.

[github-actions]

Thanks for your contribution! ❤️ It looks like this PR isn't linked to an issue yet. Please add Fixes #123 (or Closes #123) to the PR description, or link it via the Development sidebar on the right. Once linked, a maintainer will review your changes. No stress — we'll help fix things up if needed!