Add SocketDev workflow for firewall-free mode

[HackingRepo]

Hi, i did that because i see mainteners merge renovabot prs just in hours, if there was a supply chain incident then will progogate, because mainteners a lot frustrated by pinning actions and merge a renovabot pr after days, instead that is the solution a maintener can merge an update safely using that, very easy it outputs the supply chain score in curcilar graph, to see is the update safe or no, before merging, i finally retrieved a solution for that repo, since mainteners frustrated by classical supply chain defenses like pinning deps and github actions and do'nt merge a renovabot pr before 1 day, that was actually frustrating that will be optimal for mainteners while balancing and maintening supply chain security for free no cost and usability too

[HackingRepo]

@cakebaker can you take a look in that? i appreciate it

[github-actions]

GNU testsuite comparison:

GNU test failed: tests/df/skip-rootfs. tests/df/skip-rootfs is passing on 'main'. Maybe you have to rebase?
GNU test failed: tests/id/smack. tests/id/smack is passing on 'main'. Maybe you have to rebase?
GNU test failed: tests/mkdir/smack-root. tests/mkdir/smack-root is passing on 'main'. Maybe you have to rebase?

[HackingRepo]

hi, @cakebaker

can you take a look in that and merge it and review it? i appreciate it

[HackingRepo]

hi, @sylvestre can you review that pr, i appreciate it, and thank's for your effort

[sylvestre]

Sorry but I don't understand this PR. I don't know what is socketdev

[HackingRepo]

read https://github.com/SocketDev/action to see, the meaning, i mean socket firewall, @sylvestre

the explanation i can say, by example someone add a new dep or crate or whatever callled, socket firewall will evaluate the supply chain security score and maintenance score and quality and license and vulnerability and also for renovabot update, if any crate of one used ever compromised and ships malware socket firewall will say supply chain security very low score and then that was a malware incident if the score 75% or heigher then safe to merge

[codspeed]

Merging this PR will not alter performance

✅ 172 untouched benchmarks
⏩ 213 skipped benchmarks¹

---

_{Comparing HackingRepo:patch-11 (496a5c4) with main (ef50d8b)}

Footnotes

1. 213 benchmarks were skipped, so the baseline results were used instead. If they were deleted from the codebase, click here and archive them to remove them from the performance reports. ↩

[sylvestre]

I am still unfortunately not very convinced by this

[HackingRepo]

why it is important for supply chain security since the repo have no pinning, a supply chain attack in these deps since uutils use dozens of deps, if just one compromised, then these utilities will serve malware?

[sylvestre]

why only push and not pull_request? renovate PRs are the stated use case

[sylvestre]

what does firewall-free mean here? please document the why

[HackingRepo]

@sylvestre, The term firewall-free (short for Socket Firewall Free) refers to the Free Edition of Socket's security tool. It means zero-configuration and entirely free security, requiring no API keys, no secrets management, and no account sign-ups to run in this repository.