From 1b15215a0aaa19f7e4fd384d05572c1f0109171f Mon Sep 17 00:00:00 2001 From: RelunSec Date: Mon, 6 Jul 2026 06:35:21 +0000 Subject: [PATCH 1/4] Add SocketDev workflow for firewall-free mode Hi, i did that because i see mainteners merge dependabot prs just in hours, if there was a supply chain incident then will progogate by using https://socket.dev, because mainteners a lot frustrated by pinning actions and merge a renovabot pr after days, instead that is the solution a maintener can merge an update safely using that, very easy it outputs the supply chain score in curcilar graph, to see is the update safe or no, before merging, i finally retrieved a solution for that repo, since mainteners frustrated by classical supply chain defenses like pinning deps and github actions and do'nt merge a renovabot pr before 1 day, that was actually frustrating that will be optimal for mainteners while maintening supply chain security --- .github/workflows/SocketDev.yml | 14 ++++++++++++++ 1 file changed, 14 insertions(+) create mode 100644 .github/workflows/SocketDev.yml diff --git a/.github/workflows/SocketDev.yml b/.github/workflows/SocketDev.yml new file mode 100644 index 00000000000..fa0c08b9723 --- /dev/null +++ b/.github/workflows/SocketDev.yml @@ -0,0 +1,14 @@ +on: push + +jobs: + safe-install: + runs-on: ubuntu-latest + + steps: + - uses: actions/checkout@v7.0.0 + + - uses: SocketDev/action@v1.3.1 + with: + mode: firewall-free + # rust + - run: sfw cargo fetch From 9b9cd9ff3b5cc86941ae317432af824e6f3ac83e Mon Sep 17 00:00:00 2001 From: RelunSec Date: Mon, 21 Sep 2026 08:37:44 -0400 Subject: [PATCH 2/4] fix: Use persist creds and latest version --- .github/workflows/SocketDev.yml | 25 +++++++++++++------------ 1 file changed, 13 insertions(+), 12 deletions(-) diff --git a/.github/workflows/SocketDev.yml b/.github/workflows/SocketDev.yml index fa0c08b9723..6b505251994 100644 --- a/.github/workflows/SocketDev.yml +++ b/.github/workflows/SocketDev.yml @@ -1,14 +1,15 @@ on: push - jobs: - safe-install: - runs-on: ubuntu-latest - - steps: - - uses: actions/checkout@v7.0.0 - - - uses: SocketDev/action@v1.3.1 - with: - mode: firewall-free - # rust - - run: sfw cargo fetch + safe-install: + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v7.0.1 + with: + persist-credentials: false + + - uses: SocketDev/action@v1.3.1 + with: + mode: firewall-free + + # rust + - run: sfw cargo fetch From 6d849618fdb0886b19fce09fdf628bf1c0603a86 Mon Sep 17 00:00:00 2001 From: RelunSec Date: Mon, 21 Sep 2026 08:38:21 -0400 Subject: [PATCH 3/4] fix: use on pull_request, not push --- .github/workflows/SocketDev.yml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/.github/workflows/SocketDev.yml b/.github/workflows/SocketDev.yml index 6b505251994..ff99f8498f3 100644 --- a/.github/workflows/SocketDev.yml +++ b/.github/workflows/SocketDev.yml @@ -1,4 +1,5 @@ -on: push +on: pull_request + jobs: safe-install: runs-on: ubuntu-latest From a8b587fbf991ec973f489f4905b1f733c3c4facb Mon Sep 17 00:00:00 2001 From: RelunSec Date: Mon, 21 Sep 2026 08:41:24 -0400 Subject: [PATCH 4/4] fix: add permissions content read --- .github/workflows/SocketDev.yml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/.github/workflows/SocketDev.yml b/.github/workflows/SocketDev.yml index ff99f8498f3..0d032106160 100644 --- a/.github/workflows/SocketDev.yml +++ b/.github/workflows/SocketDev.yml @@ -1,5 +1,8 @@ on: pull_request +permissions: + contents: read + jobs: safe-install: runs-on: ubuntu-latest