Package risk scan (Socket) and pin GitHub Actions to commit SHAs (#922)

.github/workflows/auto-review.yml

@@ -20,7 +20,7 @@ jobs:
     if: github.event.pull_request.state == 'open' && github.event.pull_request.draft == false
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
           # pull_request_target runs on base; checkout base securely, not fork code.
           # We fetch diff via gh API, never execute fork files.

.github/workflows/ci.yml

@@ -26,18 +26,18 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version: ${{ env.NODE_VERSION }}
 
-      - uses: oven-sh/setup-bun@v2
+      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
         with:
           bun-version-file: package.json
 
       - name: Cache downloaded packages
-        uses: actions/cache@v4
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
         with:
           path: ~/.bun/install/cache
           key: bun-${{ runner.os }}-${{ hashFiles('bun.lock') }}-${{ hashFiles('package.json') }}
@@ -63,11 +63,11 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 5
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
           persist-credentials: false
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version: ${{ env.NODE_VERSION }}
 
@@ -79,13 +79,13 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
-      - uses: oven-sh/setup-bun@v2
+      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
         with:
           bun-version-file: package.json
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version: ${{ env.NODE_VERSION }}
 
@@ -108,18 +108,18 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 15
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version: ${{ env.NODE_VERSION }}
 
-      - uses: oven-sh/setup-bun@v2
+      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
         with:
           bun-version-file: package.json
 
       - name: Cache downloaded packages
-        uses: actions/cache@v4
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
         with:
           path: ~/.bun/install/cache
           key: bun-${{ runner.os }}-${{ hashFiles('bun.lock') }}-${{ hashFiles('package.json') }}
@@ -135,7 +135,7 @@ jobs:
 
       - name: Upload coverage report
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: coverage
           path: coverage
@@ -146,25 +146,25 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 15
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version: ${{ env.NODE_VERSION }}
 
-      - uses: oven-sh/setup-bun@v2
+      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
         with:
           bun-version-file: package.json
 
       - name: Cache downloaded packages
-        uses: actions/cache@v4
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
         with:
           path: ~/.bun/install/cache
           key: bun-${{ runner.os }}-${{ hashFiles('bun.lock') }}-${{ hashFiles('package.json') }}
           restore-keys: bun-${{ runner.os }}-
 
       - name: Cache Next.js build
-        uses: actions/cache@v4
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
         with:
           path: .next/cache
           key: next-build-${{ runner.os }}-${{ hashFiles('bun.lock') }}-${{ hashFiles('package.json') }}
@@ -186,18 +186,18 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 20
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version: ${{ env.NODE_VERSION }}
 
-      - uses: oven-sh/setup-bun@v2
+      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
         with:
           bun-version-file: package.json
 
       - name: Cache downloaded packages
-        uses: actions/cache@v4
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
         with:
           path: ~/.bun/install/cache
           key: bun-${{ runner.os }}-${{ hashFiles('bun.lock') }}-${{ hashFiles('package.json') }}
@@ -225,7 +225,7 @@ jobs:
 
       - name: Upload Playwright report
         if: failure()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: playwright-report
           path: playwright-report

.github/workflows/dependency-review.yml

@@ -16,7 +16,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
       - uses: actions/dependency-review-action@2031cfc080254a8a887f58cffee85186f0e49e48 # v4.9.0
         with:

.github/workflows/e2e-chain.yml

@@ -29,18 +29,18 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 45
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
       - name: Start stellar/quickstart (local network, Soroban RPC + Horizon)
         run: |
           docker run -d --rm -p 8000:8000 --name stellar stellar/quickstart:latest \
             --local --enable core,rpc,horizon --limits unlimited
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version: 22
 
-      - uses: oven-sh/setup-bun@v2
+      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
         with:
           bun-version-file: package.json
 
@@ -51,18 +51,18 @@ jobs:
         run: bunx playwright install --with-deps chromium
 
       - name: Install Rust (wasm32v1-none)
-        uses: dtolnay/rust-toolchain@stable
+        uses: dtolnay/rust-toolchain@b725eda525362e7cf34af9a7243cac1e3f01a7ec # stable
         with:
           targets: wasm32v1-none
 
       - name: Check out Heliobond/contracts
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
           repository: Heliobond/contracts
           ref: ${{ env.CONTRACTS_REF }}
           path: ${{ env.CONTRACTS_DIR }}
 
-      - uses: Swatinem/rust-cache@v2
+      - uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2
         with:
           workspaces: ${{ env.CONTRACTS_DIR }}
 
@@ -83,7 +83,7 @@ jobs:
 
       - name: Upload Playwright traces and report
         if: failure()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: e2e-chain-playwright
           path: |

.github/workflows/scorecard.yml

@@ -25,7 +25,7 @@ jobs:
       contents: read
       actions: read
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
           persist-credentials: false
 

.github/workflows/socket.yml

@@ -0,0 +1,42 @@
+name: Package risk scan
+
+# Socket scores the packages a PR adds or changes for install scripts,
+# obfuscated code, network access and new maintainers (#922). The scan needs the
+# SOCKET_CLI_API_TOKEN repository secret. GitHub does not pass secrets to pull
+# requests from forks, so the scan is skipped there. The skip is reported as a
+# notice, not a pass. The scan's pass/fail thresholds are set in the Socket
+# dashboard security policy, not in this file.
+#
+# This runs the `pull_request` event, not `pull_request_target`, so PR code
+# never sees the secret.
+
+on:
+  pull_request:
+
+permissions:
+  contents: read
+
+jobs:
+  socket:
+    name: socket package risk
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+        with:
+          persist-credentials: false
+
+      - name: Scan dependencies with Socket
+        env:
+          SOCKET_CLI_API_TOKEN: ${{ secrets.SOCKET_CLI_API_TOKEN }}
+          SOCKET_ORG: ${{ vars.SOCKET_ORG }}
+        run: |
+          if [ -z "$SOCKET_CLI_API_TOKEN" ]; then
+            echo "::notice title=Socket scan skipped::SOCKET_CLI_API_TOKEN is not available to this run (fork PR or secret not set), so no package-risk scan ran."
+            exit 0
+          fi
+          ORG_ARGS=()
+          if [ -n "$SOCKET_ORG" ]; then
+            ORG_ARGS=(--org "$SOCKET_ORG")
+          fi
+          npx --yes @socketsecurity/cli@1.10.0 ci "${ORG_ARGS[@]}"

.github/workflows/supply-chain.yml

@@ -32,7 +32,7 @@ jobs:
       PR_LABELS: ${{ toJSON(github.event.pull_request.labels.*.name) }}
       PR_ACTION: ${{ github.event.action }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
           ref: ${{ env.HEAD_SHA }}
           fetch-depth: 0
@@ -41,7 +41,7 @@ jobs:
       - name: Load the checker from the base branch
         run: git show "$BASE_SHA:scripts/check-supply-chain-changes.mjs" > "$RUNNER_TEMP/check-supply-chain-changes.mjs"
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version: 22
 

src/__tests__/repoHygiene.test.ts

@@ -191,13 +191,14 @@ describe('bun version parity (#790)', () => {
     expect(e2eChain).not.toMatch(/bun-version:\s*['"]?\d+\.\d+/i)
 
     // Every oven-sh/setup-bun step must specify bun-version-file: package.json
-    const ciSetupBunCount = (ci.match(/uses:\s*oven-sh\/setup-bun@v2/g) || []).length
+    const ciSetupBunCount = (ci.match(/uses:\s*oven-sh\/setup-bun@[0-9a-f]{40}/g) || []).length
     const ciVersionFileCount = (ci.match(/bun-version-file:\s*package\.json/g) || []).length
     // quality, supply-chain, test, build and e2e
     expect(ciSetupBunCount).toBe(5)
     expect(ciVersionFileCount).toBe(ciSetupBunCount)
 
-    const e2eSetupBunCount = (e2eChain.match(/uses:\s*oven-sh\/setup-bun@v2/g) || []).length
+    const e2eSetupBunCount = (e2eChain.match(/uses:\s*oven-sh\/setup-bun@[0-9a-f]{40}/g) || [])
+      .length
     const e2eVersionFileCount = (e2eChain.match(/bun-version-file:\s*package\.json/g) || []).length
     expect(e2eSetupBunCount).toBe(1)
     expect(e2eVersionFileCount).toBe(e2eSetupBunCount)