chore(license): add nonempty license (LICENSE.md)#79
Merged
Merged
Conversation
Applies the PolyForm Shield License 1.0.0
Chris Bailey (ammkrn)
marked this pull request as draft
June 4, 2026 13:30
Contributor
Author
|
To the maintainers: this should probably be merged as part of a version bump. When we're ready I'll remove this from draft status. |
Chris Bailey (ammkrn)
marked this pull request as ready for review
June 4, 2026 18:39
lelia
added
documentation
lelia
approved these changes
Jul 21, 2026
lelia
added a commit
that referenced
this pull request
Jul 22, 2026
Temporary: pull #88's fix into this branch so CI's merge-with-main ref builds. PR #79 renamed the license to LICENSE.md and deleted the empty LICENSE, but pyproject.toml and the Dockerfile still reference LICENSE, so hatchling and the Docker build fail against current main. This restores the PolyForm content into bare LICENSE (rename LICENSE.md -> LICENSE) and drops the now-moot !LICENSE.md .gitignore exception. Revert this commit and pull latest main once #88 lands there (main will then carry the identical fix). Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>
lelia
added a commit
that referenced
this pull request
Jul 22, 2026
The scan env checkout of main fails to build the socket-basics package editable while main carries the LICENSE.md rename breakage (#79, fix pending in #88). The scan only imports the dependencies (socketdev SDK), never socket_basics itself, so skip installing the project entirely -- also insulates this guard from any future main-side packaging breakage. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
lelia
added a commit
that referenced
this pull request
Jul 22, 2026
…79) (#88) PR #79 renamed LICENSE to LICENSE.md, which deviates from standard OSS naming conventions and broke references that point at the extensionless LICENSE file: - Dockerfile:61 COPY ... LICENSE ... (Docker build failed, file missing) - pyproject.toml license = {file = "LICENSE"} (packaging failed) Renames LICENSE.md back to LICENSE and drops the now-unnecessary !LICENSE.md exception from .gitignore. Both references above resolve correctly again with no further changes. Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>
lelia
added a commit
that referenced
this pull request
Jul 22, 2026
…kflows (#78) * chore(deps): bundle dependency updates + harden supply-chain review Bundles 8 open Dependabot PRs into one verified change and hardens the Dependabot config + dependency-review workflows, mirroring the work in socket-sdk-python#84 and socket-python-cli#207/#217. Adds a supply-chain watch for the four core OSS tools Dependabot cannot cleanly track. - uv.lock: idna 3.10->3.18 (CVE-2026-45409), pygments 2.19.2->2.20.0, pytest 8.4.2->9.0.3, urllib3 2.6.3->2.7.0 - _docker-pipeline.yml: bump 4 docker/* actions (setup-buildx, login, metadata, build-push) - dependabot.yml: add uv ecosystem, group every ecosystem into minor/patch + major bundles, scan composite actions - dependency-review.yml (was dependabot-review.yml): runs on every PR; free/enterprise sfw split; report artifacts; app_tests docker smoke - core-tool-watch.yml + scripts/check_core_tools.py: discover latest versions of opengrep/trufflehog/trivy/socketdev and score them through the Socket API (socketdev SDK purl.post); drift issue + report artifact - python-tests.yml: uv.lock drift guard Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * fix(ci): drop socket-firewall environment gate, add required coverage gate Mirroring the Python CLI/SDK used `environment: socket-firewall` to scope the SFW token, but that environment can carry a required-reviewers approval gate. Because the enterprise SFW check can't be a required status check (it would block Dependabot/fork PRs that only run the free edition), maintainers could merge without approving the deployment -- the meaningful check silently never ran, and approvers could rubber-stamp their own PRs. On the scheduled core-tool-watch job an approval gate would hang the cron run outright. - Remove `environment:` from python-sfw-smoke-enterprise and core-tool-watch; use a plain repo/org SOCKET_SFW_API_TOKEN (zizmor secrets-outside-env is already disabled here, so no lint cost). Job split still isolates the token to the enterprise job only. - Add always-on `dependency-review-gate` job: pass when no python deps changed, else require the free (Dependabot/fork) or enterprise (maintainer) smoke job to have succeeded. Mark THIS as the single required status check -- safe on every PR, no manual gate, no bypass. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * fix(ci): scope SFW token via environment (no approval rule), harden gate Adopt the socket-python-cli#224 pattern uniformly. The environment was never the problem -- the required-reviewers approval RULE on it was. Keep the environment for secret scoping; forbid the rule. - Restore `environment: socket-firewall` on python-sfw-smoke-enterprise and the core-tool-watch analyze job so SOCKET_SFW_API_TOKEN is scoped to those jobs. Header documents that the environment must have NO reviewers rule, with the gh api command to enforce it (reviewers: null). - dependency-review-gate (Pattern 2 aggregator): now also needs docker-smoke-app-tests; fails on any failure/cancelled result (success and skipped pass) AND requires the trust-appropriate SFW edition to have succeeded when Python deps changed. Runs if: always() so the required context is always created -- no Pattern 1 bypass twin needed. Must land on main before being added to branch protection. Signed-off-by: lelia <2418071+lelia@users.noreply.github.com> * fix(ci): degrade SFW enterprise to free when token absent; upload JSON report Live CI exposed two things on the now-enabled Actions: - socketdev/action firewall-enterprise HARD-ERRORS on an empty token (no silent fallback), so a trusted dep PR opened before the SOCKET_SFW_API_TOKEN secret exists fails and the required gate blocks merge. setup-sfw now resolves the effective mode and falls back to firewall-free when enterprise is requested without a token -- still a real supply-chain check, ships green today, auto-upgrades to enterprise the moment the secret is added. Token is read via env, never interpolated into the script. - socketdev/action writes a structured report to $SFW_JSON_REPORT_PATH; both smoke jobs now capture it and upload it alongside the tee'd log. Signed-off-by: lelia <2418071+lelia@users.noreply.github.com> * feat(core-tool-watch): add Semgrep upstream proxy for OpenGrep Socket scoring OpenGrep ships as a GitHub-release binary that Socket has no data for under its pkg:github coordinate, so the watcher reported 'no data' for it. OpenGrep is a hard fork of Semgrep, so fall back to scoring the upstream Semgrep lineage (pkg:pypi/semgrep) as a project-health proxy. The proxy is report-only and never build-failing: it does not analyze OpenGrep's own release artifacts, so a Semgrep alert must not block an OpenGrep build. The pinned/latest verdicts show the proxy result labeled '(via semgrep upstream proxy)' when the primary coordinate has no data, and the JSON report records it under a separate 'proxy' key. The npm 'opengrep' package is a single-version squat (not the official distribution) and is deliberately not used as a coordinate. Signed-off-by: lelia <2418071+lelia@users.noreply.github.com> * chore(deps): bundle 3 newly-filed Dependabot PRs (#81, #86, #87) - requests >=2.31.0 -> >=2.33.0 (#87); targeted 'uv lock --upgrade-package requests' resolves 2.34.2 (newer than Dependabot's 2.33.0) and pulls light-s3-client 0.0.40 -- the only two packages Dependabot's own PR touched. - actions/setup-python 6.2.0 -> 6.3.0 in python-tests.yml (#86, SHA verified against the v6.3.0 tag). The group's setup-buildx 4.1.0 bump is already in this branch. - docker/metadata-action 6.1.0 (#81) is already applied here (identical SHA) -- #81 is fully superseded, no code change. All three PRs to be closed manually as superseded by #78. Signed-off-by: lelia <2418071+lelia@users.noreply.github.com> * fix(core-tool-watch): address Cursor Bugbot findings on #78 Five hardening fixes flagged by Bugbot: 1. Critical alerts now fail-on-malware (was malware-only). Track any_critical separately and exit non-zero on malware OR critical, matching the documented intent; add a 'critical' GitHub output. 2. Pins are read from BOTH Dockerfiles. app_tests/Dockerfile pins the same core tools (trufflehog/trivy/opengrep) independently; the reader only saw the root Dockerfile, so a divergent app_tests bump went unscored. Tool.pinned is now a list of every distinct pinned version, all of which are scored. 3. Watch mode no longer fails on latest. Only PINNED (in-use) versions are fail-worthy; the discovered latest is scored for drift reporting only, so a scheduled watch can't go red on an upstream release we haven't adopted. 4. dependency-review-gate fails closed when inspect fails. A failed inspect left DEPS_CHANGED/IS_TRUSTED empty, so the coverage rules silently passed and a PR with dep changes could merge with no Socket Firewall run. Added Rule 0. 5. Socket API errors fail closed in build mode. A swallowed analyze_purls exception let --fail-on-malware exit 0 with pinned versions unverified; now a scoring error (token present) fails the run. Signed-off-by: lelia <2418071+lelia@users.noreply.github.com> * fix(ci): address 2 more Bugbot findings on #78 1. Drift issue never opened (High). gh issue list --jq '.[0].number' prints the literal string 'null' when no open core-tool-drift issue exists; 'null' is non-empty in bash, so the first scheduled drift run would call 'gh issue edit null' instead of creating the issue. Use '// empty' so an absent issue yields an empty string and the create branch runs. 2. Tests ignored the lockfile (Medium). python-tests installed deps via 'pip install -e .[dev]' (a fresh resolution) while only asserting the lock separately, so tests could run against different versions than uv.lock. Switch to 'uv sync --locked --extra dev' + 'uv run --no-sync pytest' so tests run against exactly the locked set. Signed-off-by: lelia <2418071+lelia@users.noreply.github.com> * fix(ci): restore bare LICENSE to unblock CI (mirrors #88) Temporary: pull #88's fix into this branch so CI's merge-with-main ref builds. PR #79 renamed the license to LICENSE.md and deleted the empty LICENSE, but pyproject.toml and the Dockerfile still reference LICENSE, so hatchling and the Docker build fail against current main. This restores the PolyForm content into bare LICENSE (rename LICENSE.md -> LICENSE) and drops the now-moot !LICENSE.md .gitignore exception. Revert this commit and pull latest main once #88 lands there (main will then carry the identical fix). Signed-off-by: lelia <2418071+lelia@users.noreply.github.com> * fix(core-tool-watch): per-event concurrency group + document Dependabot secret gap - Include github.event_name in the concurrency group so a merge to main can't cancel the in-flight weekly watch run (or vice versa). - Document that Dependabot-triggered pull_request runs never receive the environment-scoped SOCKET_SFW_API_TOKEN (only Dependabot secrets), so build-mode scoring silently degrades to drift-only there; note the 'gh secret set --app dependabot' mirror needed for pre-merge coverage. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * feat(deps-review): route Dependabot through sfw-enterprise; isolate core-tool-watch scan env Dependabot-triggered runs can read a *Dependabot-store* secret (set via 'gh secret set SOCKET_SFW_API_TOKEN --app dependabot'), so the free-tier routing for Dependabot -- a workaround for the assumption that its runs could never hold a token -- is gone: - dependency-review.yml: trusted == any in-repo (non-fork) PR, now including Dependabot. Its dep bumps get full org-policy (enterprise) enforcement; forks stay on the anonymous free edition. setup-sfw's existing empty-token fallback covers the window until the Dependabot secret mirror exists. - core-tool-watch.yml: sync the scan's Python env from the DEFAULT BRANCH lockfile (second checkout at .scan-env) so the token-holding step never imports packages bumped by the PR under review -- it only reads the PR's pins. Makes the Dependabot token mirror safe here too. - dependency-review.yml: import smokes use 'uv run --no-sync' so the post-firewall step can't re-sync outside sfw (Bugbot finding). - check_core_tools.py: docstring/help now honestly describe the strict fail thresholds (curated malware-class list + high/critical), which are intentional (Bugbot finding). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(core-tool-watch): sync scan env with --no-install-project The scan env checkout of main fails to build the socket-basics package editable while main carries the LICENSE.md rename breakage (#79, fix pending in #88). The scan only imports the dependencies (socketdev SDK), never socket_basics itself, so skip installing the project entirely -- also insulates this guard from any future main-side packaging breakage. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(core-tool-watch): org-scoped purl endpoint + fail closed on empty API result Two related hardenings from external review of purl.post() usage: - Pass org_slug (resolved via client.org.get) when the installed SDK supports it: socketdev >= 3.1 (socket-sdk-python#76) deprecates the legacy POST /v0/purl in favor of POST /v0/orgs/{slug}/purl, and a future major may drop the legacy route. The pinned 3.0.29 predates the parameter, so it is signature-gated -- activates automatically when the scan env's lockfile bumps the SDK. - Raise on an empty purl.post result: the SDK swallows ANY non-200 (expired token, dropped endpoint, outage) into [], which previously flowed through as 'no data' verdicts and exit 0 -- fail-open. Every run scores coordinates Socket definitely has data for, so empty is an API failure; raising routes it into the existing scoring_error fail-closed path under --fail-on-malware. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(core-tool-watch): resolve org slug only when unambiguous Match socket-python-cli's get_org_id_slug() semantics: pass org_slug to purl.post only when the token maps to exactly one org; multi-org tokens fall back to the legacy endpoint with a notice rather than guessing and scoring under the wrong org's policies. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(core-tool-watch): fail closed on unverified pinned coordinates Bugbot: a non-empty but incomplete Socket batch (or a pinned coordinate that never matches a returned analysis row) previously passed as 'no data' with exit 0 -- the guard could green-light a build without verifying every pin it exists to gate. Tools now declare socket_coverage (default True); with a token and a successful scoring pass, any covered pinned coordinate missing from the results is collected as unverified and fails a --fail-on-malware run, listing the exact coordinates. OpenGrep sets socket_coverage=False: its pkg:github coordinate is the documented no-data case with the report-only semgrep proxy, and must not perma-fail the guard. The unverified list is also surfaced in the JSON report. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Signed-off-by: lelia <2418071+lelia@users.noreply.github.com> Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Applies the PolyForm Shield License 1.0.0 at request of maintainer(s).
Changes
Testing
Release checklist (skip for non-release PRs)
pyproject.tomlversion:field updated to new versionpython3 scripts/sync_release_version.py --writerun after updatingpyproject.tomlsocket_basics/version.pyupdated to new versionsocket_basics/__init__.pyupdated to the same versionaction.ymlimage:ref updated todocker://ghcr.io/socketdev/socket-basics:<new-version>CHANGELOG.mdupdated with human-authored release notes for this version