Skip to content

Commit 637eda7

Browse files
lelialelia
authored
Fix reachability filtering, add config file support (#169)
* Add SARIF scoping/reachability controls, config file support Signed-off-by: lelia <lelia@socket.dev> * Add coverage for new SARIF scoping, config file behavior Signed-off-by: lelia <lelia@socket.dev> * Add config examples for different use cases Signed-off-by: lelia <lelia@socket.dev> * Refactor docs to reduce README complexity, create dedicated CLI and CI/CD guides Signed-off-by: lelia <lelia@socket.dev> * Bump version for release Signed-off-by: lelia <lelia@socket.dev> * Add shared selector/filter module Signed-off-by: lelia <lelia@socket.dev> * Refactor output handling to use shared alert selection Signed-off-by: lelia <lelia@socket.dev> * Refactor Slack diff filtering to use shared selection semantics, facts-aware reachable filtering Signed-off-by: lelia <lelia@socket.dev> * Add unit tests for shared selection logic Signed-off-by: lelia <lelia@socket.dev> * Add unit tests for new Slack behavior Signed-off-by: lelia <lelia@socket.dev> * Update output tests for strict-blocking and SARIF Signed-off-by: lelia <lelia@socket.dev> * Add JSON config examples for reference Signed-off-by: lelia <lelia@socket.dev> * Remove unnecessary backwards compat logic Signed-off-by: lelia <lelia@socket.dev> * Docs refactor for better readability, dedicated guides for CLI + CI/CD usage Signed-off-by: lelia <lelia@socket.dev> * Bump version for release Signed-off-by: lelia <lelia@socket.dev> * Fix missing version check expected in PR preview Signed-off-by: lelia <lelia@socket.dev> * Fix PR preview worklfow to use updated version check Signed-off-by: lelia <lelia@socket.dev> * Fix e2e regression tests to use correct SARIF flags and remove legacy assertions Signed-off-by: lelia <lelia@socket.dev> --------- Signed-off-by: lelia <lelia@socket.dev>
1 parent 4903ae3 commit 637eda7

29 files changed

+2701
-927
lines changed

‎.github/workflows/e2e-test.yml‎

Lines changed: 9 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -63,15 +63,6 @@ jobs:
6363
python -m pip install --upgrade pip
6464
pip install .
6565
66-
- name: Verify --sarif-reachable-only without --reach exits non-zero
67-
run: |
68-
if socketcli --sarif-reachable-only --api-token dummy 2>&1; then
69-
echo "FAIL: Expected non-zero exit"
70-
exit 1
71-
else
72-
echo "PASS: Exited non-zero as expected"
73-
fi
74-
7566
- name: Run Socket CLI scan with --sarif-file
7667
env:
7768
SOCKET_SECURITY_API_KEY: ${{ secrets.SOCKET_CLI_API_TOKEN }}
@@ -164,23 +155,28 @@ jobs:
164155
--target-path tests/e2e/fixtures/simple-npm \
165156
--reach \
166157
--sarif-file /tmp/sarif-all.sarif \
158+
--sarif-scope full \
159+
--sarif-reachability all \
167160
--disable-blocking \
168-
2>/dev/null || true
161+
2>/dev/null
169162
170-
- name: Run scan with --sarif-file --sarif-reachable-only (filtered results)
163+
- name: Run scan with --sarif-file --sarif-reachability reachable (filtered results)
171164
env:
172165
SOCKET_SECURITY_API_KEY: ${{ secrets.SOCKET_CLI_API_TOKEN }}
173166
run: |
174167
socketcli \
175168
--target-path tests/e2e/fixtures/simple-npm \
176169
--reach \
177170
--sarif-file /tmp/sarif-reachable.sarif \
178-
--sarif-reachable-only \
171+
--sarif-scope full \
172+
--sarif-reachability reachable \
179173
--disable-blocking \
180-
2>/dev/null || true
174+
2>/dev/null
181175
182176
- name: Verify reachable-only results are a subset of all results
183177
run: |
178+
test -f /tmp/sarif-all.sarif
179+
test -f /tmp/sarif-reachable.sarif
184180
python3 -c "
185181
import json
186182
with open('/tmp/sarif-all.sarif') as f:

‎.github/workflows/pr-preview.yml‎

Lines changed: 12 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -37,6 +37,17 @@ jobs:
3737
VERSION=$(hatch version | cut -d+ -f1)
3838
echo "VERSION=$VERSION" >> $GITHUB_ENV
3939
40+
- name: Check if version already exists on Test PyPI
41+
id: version_check
42+
env:
43+
VERSION: ${{ env.VERSION }}
44+
run: |
45+
if curl -s -f https://test.pypi.org/pypi/socketsecurity/${VERSION}/json > /dev/null; then
46+
echo "exists=true" >> $GITHUB_OUTPUT
47+
else
48+
echo "exists=false" >> $GITHUB_OUTPUT
49+
fi
50+
4051
- name: Build package
4152
if: steps.version_check.outputs.exists != 'true'
4253
run: |
@@ -146,4 +157,4 @@ jobs:
146157
build-args: |
147158
CLI_VERSION=${{ env.VERSION }}
148159
PIP_INDEX_URL=https://test.pypi.org/simple
149-
PIP_EXTRA_INDEX_URL=https://pypi.org/simple
160+
PIP_EXTRA_INDEX_URL=https://pypi.org/simple

‎.github/workflows/version-check.yml‎

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -18,13 +18,15 @@ jobs:
1818
- name: Check version increment
1919
id: version_check
2020
run: |
21+
python -m pip install --upgrade pip
22+
pip install packaging
23+
2124
# Get version from current PR
2225
PR_VERSION=$(grep -o "__version__.*" socketsecurity/__init__.py | awk '{print $3}' | tr -d "'")
2326
echo "PR_VERSION=$PR_VERSION" >> $GITHUB_ENV
2427
2528
# Get version from main branch
26-
git checkout origin/main
27-
MAIN_VERSION=$(grep -o "__version__.*" socketsecurity/__init__.py | awk '{print $3}' | tr -d "'")
29+
MAIN_VERSION=$(git show origin/main:socketsecurity/__init__.py | grep -o "__version__.*" | awk '{print $3}' | tr -d "'")
2830
echo "MAIN_VERSION=$MAIN_VERSION" >> $GITHUB_ENV
2931
3032
# Compare versions using Python
@@ -87,4 +89,4 @@ jobs:
8789
issue_number: prNumber,
8890
body: `❌ **Version Check Failed**\n\nPlease increment...`
8991
});
90-
}
92+
}

‎.gitignore‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,7 @@ scripts/*.py
1515
*.json
1616
*.sarif
1717
!tests/**/*.json
18+
!examples/config/*.json
1819
markdown_overview_temp.md
1920
markdown_security_temp.md
2021
.DS_Store

‎README.md‎

Lines changed: 111 additions & 817 deletions
Large diffs are not rendered by default.

‎docs/README.md‎

Lines changed: 0 additions & 10 deletions
This file was deleted.

‎docs/ci-cd.md‎

Lines changed: 119 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,119 @@
1+
# CI/CD guide
2+
3+
Use this guide for pipeline-focused CLI usage across platforms.
4+
5+
## Recommended patterns
6+
7+
### Dashboard-style reachable SARIF
8+
9+
```bash
10+
socketcli \
11+
--reach \
12+
--sarif-file results.sarif \
13+
--sarif-scope full \
14+
--sarif-grouping alert \
15+
--sarif-reachability reachable \
16+
--disable-blocking
17+
```
18+
19+
### Diff-based gating on new reachable findings
20+
21+
```bash
22+
socketcli \
23+
--reach \
24+
--sarif-file results.sarif \
25+
--sarif-scope diff \
26+
--sarif-reachability reachable \
27+
--strict-blocking
28+
```
29+
30+
## Config file usage in CI
31+
32+
Use `--config .socketcli.toml` or `--config .socketcli.json` to keep pipeline commands small.
33+
34+
Precedence order:
35+
36+
`CLI flags` > `environment variables` > `config file` > `built-in defaults`
37+
38+
Example:
39+
40+
```toml
41+
[socketcli]
42+
reach = true
43+
sarif_scope = "full"
44+
sarif_grouping = "alert"
45+
sarif_reachability = "reachable"
46+
sarif_file = "results.sarif"
47+
```
48+
49+
Equivalent JSON:
50+
51+
```json
52+
{
53+
"socketcli": {
54+
"reach": true,
55+
"sarif_scope": "full",
56+
"sarif_grouping": "alert",
57+
"sarif_reachability": "reachable",
58+
"sarif_file": "results.sarif"
59+
}
60+
}
61+
```
62+
63+
## Platform examples
64+
65+
### GitHub Actions
66+
67+
```yaml
68+
- name: Run Socket CLI
69+
run: socketcli --config .socketcli.toml --target-path .
70+
env:
71+
SOCKET_SECURITY_API_TOKEN: ${{ secrets.SOCKET_SECURITY_API_TOKEN }}
72+
```
73+
74+
### Buildkite
75+
76+
```yaml
77+
steps:
78+
- label: "Socket scan"
79+
command: "socketcli --config .socketcli.toml --target-path ."
80+
env:
81+
SOCKET_SECURITY_API_TOKEN: "${SOCKET_SECURITY_API_TOKEN}"
82+
```
83+
84+
### GitLab CI
85+
86+
```yaml
87+
socket_scan:
88+
script:
89+
- socketcli --config .socketcli.toml --target-path .
90+
variables:
91+
SOCKET_SECURITY_API_TOKEN: $SOCKET_SECURITY_API_TOKEN
92+
```
93+
94+
### Bitbucket Pipelines
95+
96+
```yaml
97+
pipelines:
98+
default:
99+
- step:
100+
script:
101+
- socketcli --config .socketcli.toml --target-path .
102+
```
103+
104+
## Workflow templates
105+
106+
Prebuilt examples in this repo:
107+
108+
- [`../workflows/github-actions.yml`](../workflows/github-actions.yml)
109+
- [`../workflows/buildkite.yml`](../workflows/buildkite.yml)
110+
- [`../workflows/gitlab-ci.yml`](../workflows/gitlab-ci.yml)
111+
- [`../workflows/bitbucket-pipelines.yml`](../workflows/bitbucket-pipelines.yml)
112+
113+
## CI gotchas
114+
115+
- `--strict-blocking` enables strict diff behavior (`new + unchanged`) for blocking evaluation and diff-based output selection.
116+
- `--sarif-scope full` requires `--reach`.
117+
- `--sarif-grouping alert` currently applies to `--sarif-scope full`.
118+
- Diff-based SARIF can validly be empty when there are no matching net-new alerts.
119+
- Keep API tokens in secret stores (`SOCKET_SECURITY_API_TOKEN`), not in config files.

0 commit comments

Comments
 (0)