Add Socket Basics security scanning workflow

[kanwalpreetd]

More info: https://stellarorg.atlassian.net/wiki/spaces/SCRT/pages/5901680652/Socket+Basics+Integration+Guide

[Copilot]

Copilot review overview

🟡 Changes recommended

Moderate findings leave security coverage gaps and may allow an incomplete scan to pass.

Review effort: Lite
Findings: 1

Open (1)

• Broad override hides sensitive logs in walletStore.js · New

What changed in this PR

Adds scheduled and manual Socket Basics security scanning with SAST, secret scanning, exclusions, and Socket result submission.

Changes:

• Adds scanner configuration.
• Adds Semgrep exclusion rules.
• Adds a pinned Docker-based GitHub Actions workflow.

File	Description
.socket-basics.json	Configures scanner features and exclusions.
.semgrepignore	Defines SAST scan exclusions.
.github/​workflows/​socket-basics.yml	Runs scheduled/manual security scans.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Copilot review overview

🟡 Changes recommended

Add a job timeout, verify submission success, and narrow the sensitive-data suppression.

Review effort: Lite
Findings: 2

Open (2)

• Add a bounded timeout to the scan job · New
• Broad override hides sensitive logs in walletStore.js

[Copilot]

Copilot review overview

🟡 Changes recommended

Address the workflow credential exposure and narrow or remove the broad security-rule suppressions.

Review effort: Lite
Findings: 1 · 2

Open (3)

• Prevent repository token exposure to third-party container · New
• Add a bounded timeout to the scan job
• Broad override hides sensitive logs in walletStore.js

[Copilot]

Copilot review overview

🟡 Changes recommended

The workflow can report success after a partial scan when the scanner exits nonzero.

Review effort: Lite
Findings: 2 · 2

Open (4)

• Scanner failures are ignored after partial component writes · New
• Prevent repository token exposure to third-party container
• Add a bounded timeout to the scan job
• Broad override hides sensitive logs in walletStore.js

[Copilot]

Copilot review overview

🟡 Changes recommended

The workflow incorrectly fails successful scans that produce zero findings.

Review effort: Lite
Findings: 2 · 3

Open (5)

• Scanner failures are ignored after partial component writes
• Prevent repository token exposure to third-party container
• Do not treat zero components as scan failure · New
• Add a bounded timeout to the scan job
• Broad override hides sensitive logs in walletStore.js

[Copilot]

Copilot review overview

🔵 Needs a closer look

Fix workflow failure handling and narrow the broad scanning exclusions.

Review effort: Lite
Findings: 1 · 3

Open (4)

• Scanner failures are ignored after partial component writes
• Do not treat zero components as scan failure
• Add a bounded timeout to the scan job
• Broad override hides sensitive logs in walletStore.js

Resolved since last review (1)

• Prevent repository token exposure to third-party container

[Copilot]

Copilot review overview

🟡 Changes recommended

Unresolved critical and moderate findings affect secret coverage and security workflow correctness.

Review effort: Lite
Findings: 2 · 3

Open (5)

• Do not exclude tracked test and fixture paths from secret scanning · New
• Scanner failures are ignored after partial component writes
• Do not treat zero components as scan failure
• Add a bounded timeout to the scan job
• Broad override hides sensitive logs in walletStore.js

[Copilot]

Copilot review overview

🟡 Changes recommended

The workflow can succeed without submitting results when the API secret is missing.

Review effort: Lite
Findings: 1 · 4

Open (5)

• Do not exclude tracked test and fixture paths from secret scanning
• Fail scheduled scan when SOCKET_SECURITY_API_TOKEN is missing · New
• Do not treat zero components as scan failure
• Add a bounded timeout to the scan job
• Broad override hides sensitive logs in walletStore.js

Resolved since last review (1)

• Scanner failures are ignored after partial component writes

[Copilot]

Copilot review overview

🔵 Needs a closer look

Broad suppressions can hide real security issues and must be narrowed or removed.

Review effort: Lite
Findings: 1 · 3

Open (4)

• Do not exclude tracked test and fixture paths from secret scanning
• Fail scheduled scan when SOCKET_SECURITY_API_TOKEN is missing
• Add a bounded timeout to the scan job
• Broad override hides sensitive logs in walletStore.js

Resolved since last review (1)

• Do not treat zero components as scan failure

[Copilot]

Copilot review overview

🔵 Needs a closer look

Security-scanning workflow changes warrant final human review.

Review effort: Lite
Findings: 1 · 3

Open (4)

• Do not exclude tracked test and fixture paths from secret scanning
• Fail scheduled scan when SOCKET_SECURITY_API_TOKEN is missing
• Add a bounded timeout to the scan job
• Broad override hides sensitive logs in walletStore.js

[Copilot]

Copilot review overview

🟢 Approval recommended

No unresolved review issues were identified.

Review effort: Lite
Findings: None

Resolved since last review (4)

• Do not exclude tracked test and fixture paths from secret scanning
• Fail scheduled scan when SOCKET_SECURITY_API_TOKEN is missing
• Add a bounded timeout to the scan job
• Broad override hides sensitive logs in walletStore.js