socket_reachability.yml

# Socket Security Scan with Tier 1 Reachability Analysis
#
# This workflow scans dependencies and performs reachability analysis
# to identify which vulnerabilities are actually reachable in the code.
#
# Required: SOCKET_SECURITY_API_KEY secret with enterprise plan
# API token scopes needed: socket-basics, uploaded-artifacts, full-scans, repo

name: Socket Security Scan

on:
  schedule:
    - cron: "0 3 * * *" # Everyday at 3 AM UTC
  workflow_dispatch:
    inputs:
      enable_reachability:
        description: "Enable Tier 1 reachability analysis"
        required: false
        default: "true"
        type: choice
        options:
          - "true"
          - "false"

concurrency:
  group: socket-security-scan
  cancel-in-progress: true

jobs:
  socket-security:
    name: Socket Security Scan
    runs-on: ubuntu-latest
    timeout-minutes: 120
    permissions:
      contents: read

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Setup Python
        uses: actions/setup-python@v5
        with:
          python-version: "3.12"

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: "20"

      - name: Install uv (Python package manager)
        uses: astral-sh/setup-uv@v4

      - name: Install Socket CLI
        run: uv pip install socketsecurity --upgrade --system

      - name: Run Socket Security Scan
        env:
          SOCKET_SECURITY_API_KEY: ${{ secrets.SOCKET_SECURITY_API_KEY }}
          SOCKET_SECURITY_API_TOKEN: ${{ secrets.SOCKET_SECURITY_API_KEY }}
          PYTHONUNBUFFERED: "1"
        run: |
          REPO_NAME="${GITHUB_REPOSITORY#*/}"

          # Build reachability flags if enabled
          REACH_FLAGS=""
          if [[ "${{ github.event.inputs.enable_reachability }}" != "false" ]]; then
            REACH_FLAGS="--reach --reach-memory-limit 16384 --reach-timeout 3600"
            echo "Reachability analysis enabled"
          fi

          echo "Scanning repository: $REPO_NAME"

          socketcli \
            --target-path "$GITHUB_WORKSPACE" \
            --repo "$REPO_NAME" \
            --enable-debug \
            $REACH_FLAGS