add socket tier 1 reachability analysis

[kanwalpreetd]

More info: https://stellarorg.atlassian.net/wiki/spaces/SCRT/pages/5689311233/Socket+Tier+1+Reachability+Analysis

[Copilot]

Pull request overview

Adds a new GitHub Actions workflow intended to run Socket reachability scanning on a weekly schedule (and on-demand) for this repository, including setup for Go/Rust/Node and log parsing to surface Tier-2 fallback scenarios as GitHub Actions warnings.

Changes:

• Introduces a scheduled + manual workflow to run socket scan create --reach using a Socket API token.
• Installs required toolchains (Rust, Go, Node) and enables Corepack before running the scan.
• Captures scan output to detect Tier-2 fallbacks and emit a ::warning:: annotation while preserving the scan exit code.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated 1 comment.

Suppressed comments (2)

.github/workflows/socket-scan.yml:94

• A ::warning:: command creates an annotation only; it does not give the job or workflow a yellow conclusion, so this run still appears green/success. If degraded reachability must be visible in status checks, it needs to fail or be reported through a separate mechanism; otherwise update the GREEN/YELLOW documentation to describe the annotation accurately.

            echo "::warning::Socket scan completed with Tier 2 fallbacks - some vulnerabilities used precomputed reachability instead of full Tier 1"

.github/workflows/socket-scan.yml:94

• The known 15.2.7 result (Found 0 projects across 0 ecosystems) is not one of these patterns, so the expected SBOM-only run exits successfully without any degradation warning and is incorrectly presented as full Tier 1 coverage. Detect that signature too and make the annotation describe both fallback and zero-project outcomes.

          if [ $rc -eq 0 ] && grep -qE "Reachability falls back to Tier 2|fallback to the results from the pre-computed|Reachability falls back to precomputed" /tmp/scan.log; then
            echo "::warning::Socket scan completed with Tier 2 fallbacks - some vulnerabilities used precomputed reachability instead of full Tier 1"

[Copilot]

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated 1 comment.

Suppressed comments (1)

Previously missed (1) — in code that hasn't changed since the last review.

.github/workflows/socket-scan.yml:52

• This note contradicts the resolved history above and the command below: the --reach-version flag has already been removed. Keeping this instruction makes maintainers believe the workflow is still pinned.

[Copilot]

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated no new comments.

Suppressed comments (1)

.github/workflows/socket-scan.yml:85

• ::warning:: creates an annotation but does not create a yellow job or workflow conclusion; the run remains successful/green. These branches therefore cannot distinguish full Tier 1 coverage from zero-project or Tier 2 fallback by the job state as documented. If degraded scans must be visible in status, fail the job or publish a separate check/notification; otherwise revise the GREEN/YELLOW guidance to require inspecting annotations.

          if [ $rc -eq 0 ] && grep -qE "Found 0 projects( across 0 ecosystems)?" /tmp/scan.log; then
            echo "::warning::Socket found 0 analyzable projects - no Tier 1 reachability ran. CVE detection from the SBOM still applies."
          fi
          if [ $rc -eq 0 ] && grep -qE "Reachability falls back to Tier 2|fallback to the results from the pre-computed|Reachability falls back to precomputed" /tmp/scan.log; then
            echo "::warning::Socket scan completed with Tier 2 fallbacks - some vulnerabilities used precomputed reachability instead of full Tier 1"

[Copilot]

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated 1 comment.

Suppressed comments (2)

.github/workflows/socket-scan.yml:10

• ::warning:: creates an annotation; it does not become the job's state or change a successful job/workflow conclusion from green. This GREEN/YELLOW/RED runbook therefore misleads operators into expecting a yellow workflow result. Describe the degraded cases as warning annotations, or use a separate failing/check mechanism if a distinct status is required.

# Socket scan — reading the job status. (The scan step below produces this: an
# exit code + an optional ::warning:: annotation, which GitHub Actions renders
# as the job's state.)

.github/workflows/socket-scan.yml:67

• A warning annotation is visible in the run UI, but it does not produce a yellow run-level status; the successful job remains green. Correct this description so maintainers do not rely on a status that GitHub Actions does not provide.

          # succeeded but logged a Tier 2 fallback, emit a ::warning::
          # annotation that GitHub Actions renders as a yellow run-level
          # warning without failing the job.