Repository navigation
root - chore: defense - add Socket Firewall to every job - #167
Conversation
Every job installs Socket Firewall after checkout. Install steps run sfw pnpm install --frozen-lockfile. The action pin is v1.3.2. The firewall version is 1.15.4. Co-authored-by: Jared Wray <me@jaredwray.com>
The checklist names the open pull request. Co-authored-by: Jared Wray <me@jaredwray.com>
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request updates the DEFENSE_IN_DEPTH.md file to mark the lockfile commitment check as completed and indicates that the Socket Firewall installation is pending. However, the reviewer noted that while the PR description may suggest the installation of Socket Firewall, the actual workflow files implementing this change are missing from the pull request.
| - [x] No `contents: write` except jobs whose purpose is mutating the repo (GitHub Release, Changesets version PR); generated output is a workflow artifact, never committed back from CI — verified 2026-10-08 | ||
| - [x] Every action pinned to a full commit SHA (`npx actions-up`) — verified 2026-10-08 | ||
| - [ ] Every job installs Socket Firewall (`SocketDev/action` SHA-pinned, `firewall-version` pinned); `pnpm install` / `npm install` run as `sfw pnpm install` / `sfw npm install` | ||
| - [ ] Every job installs Socket Firewall (`SocketDev/action` SHA-pinned, `firewall-version` pinned); `pnpm install` / `npm install` run as `sfw pnpm install` / `sfw npm install` (PR #167 pending) |
There was a problem hiding this comment.
The pull request title and description state that this PR installs Socket Firewall on every GitHub Actions job. However, the only file modified in this PR is DEFENSE_IN_DEPTH.md, and no workflow files (e.g., in .github/workflows/) are included in the changes. The actual workflow modifications implementing the Socket Firewall installation are missing from this pull request.
There was a problem hiding this comment.
The workflow changes are in commit 5408827. tests.yaml, code-coverage.yaml, release.yaml, and codeql.yaml install Socket Firewall after checkout. Install steps run sfw pnpm install --frozen-lockfile. DEFENSE_IN_DEPTH.md line 31 stays open until this pull request merges.
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #167 +/- ##
=========================================
Coverage 100.00% 100.00%
=========================================
Files 9 9
Lines 639 639
Branches 151 146 -5
=========================================
Hits 639 639 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
Summary
This pull request installs Socket Firewall on every GitHub Actions job in section 4.
Status
DEFENSE_IN_DEPTH.md: Socket Firewall → (PR #167 pending). Frozen lockfile → PR #166.Verification
SocketDev/actionafter checkout.ba6de6cc0565af1f42295590380973573297e31f(v1.3.2).firewall-versionis1.15.4.sfw pnpm install --frozen-lockfile.npx actions-up --dry-runreports the pins are current.6d9e87a.Reference
defense-in-depth-nodejs § 4