Add Socket Basics security scanning workflow by kanwalpreetd · Pull Request #5460 · stellar/stellar-core

kanwalpreetd · 2026-09-17T17:44:17Z

More info: https://stellarorg.atlassian.net/wiki/spaces/SCRT/pages/5901680652/Socket+Basics+Integration+Guide

Copilot

Copilot review overview

🟡 Changes recommended

The missing-completion-marker path can report an error while still exiting successfully.

Review effort: Balanced
Findings: 1

Open (1)

Treat missing completion marker as a failure · New

What changed in this PR

Adds scheduled and on-demand Socket Basics security scanning.

Changes:

Configures SAST, secret, and Dockerfile scanning.
Adds scan exclusions and rule suppressions.
Runs a pinned scanner image and reports findings.

File	Description
`.github/workflows/socket-basics.yml`	Defines the security scan workflow.
`.socket-basics.json`	Configures scanners and exclusions.
`.semgrepignore`	Excludes generated, vendored, and test paths.
`.trivyignore`	Suppresses selected Dockerfile rules.

💡 Configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

Copilot

Copilot review overview

🟡 Changes recommended

The workflow can report success after scanner or upload failures, and intended golden-data exclusions do not match actual paths.

Review effort: Balanced
Findings: 1 · 1

Open (2)

Require all connector and upload success markers before reporting success · New
Fix golden-data exclusions to match suffixed repository directories · New

Resolved since last review (1)

Treat missing completion marker as a failure

Copilot

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

Copilot

Copilot review overview

🟡 Changes recommended

Trivy exclusions are ineffective, golden directories remain scanned, and abnormal container failures can be reported as successful.

Review effort: Balanced
Findings: 1 · 3 · 1

Open (5)

Require all connector and upload success markers before reporting success
Preserve abnormal Docker exit statuses · New
Use full canonical Trivy rule IDs for exclusions · New
Fix golden-data exclusions to match suffixed repository directories
Exclude actual generated golden directories from OpenGrep scans · New

Copilot

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

Copilot

Copilot review overview

🟡 Changes recommended

Secret scanning broadly excludes tracked tests, fixtures, examples, and lockfiles, creating significant detection blind spots.

Review effort: Balanced
Findings: 1 · 4 · 1

Open (6)

Require all connector and upload success markers before reporting success
TruffleHog exclusions create secret-scanning blind spots · New
Use full canonical Trivy rule IDs for exclusions
Preserve abnormal Docker exit statuses
Fix golden-data exclusions to match suffixed repository directories
Exclude actual generated golden directories from OpenGrep scans

Copilot

Copilot review overview

🔵 Needs a closer look

The SAST exclusion references a nonexistent directory, leaving both generated LCM golden directories in scope.

Review effort: Balanced
Findings: 1 · 3 · 1

Open (5)

Require all connector and upload success markers before reporting success
TruffleHog exclusions create secret-scanning blind spots
Use full canonical Trivy rule IDs for exclusions
Fix golden-data exclusions to match suffixed repository directories
Exclude actual generated golden directories from OpenGrep scans

Resolved since last review (1)

Preserve abnormal Docker exit statuses

Copilot

Copilot review overview

🟡 Changes recommended

The Trivy exclusions use incomplete rule IDs and therefore will not suppress the intended findings.

Review effort: Balanced
Findings: 1 · 4 · 1

Open (6)

Require all connector and upload success markers before reporting success
Add AVD- prefixes to Trivy ignore entries · New
TruffleHog exclusions create secret-scanning blind spots
Use full canonical Trivy rule IDs for exclusions
Fix golden-data exclusions to match suffixed repository directories
Exclude actual generated golden directories from OpenGrep scans

Runs SAST through OpenGrep, secret scanning through TruffleHog, and Dockerfile misconfiguration scanning through Trivy, submitting results to Socket.dev. .github/workflows/socket-basics.yml scheduled weekly + manual dispatch .socket-basics.json scanner configuration .semgrepignore SAST path exclusions .trivyignore Dockerfile lint rules with no security dimension (only present where the repo has a Dockerfile) Separate from socket-scan.yml, which covers dependency CVEs and Tier 1 reachability. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Copilot

Copilot review overview

🔵 Needs a closer look

The extensive security-scan suppressions and third-party scanner integration warrant final human validation.

Review effort: Balanced
Findings: None

Resolved since last review (6)

Require all connector and upload success markers before reporting success
Add AVD- prefixes to Trivy ignore entries
TruffleHog exclusions create secret-scanning blind spots
Use full canonical Trivy rule IDs for exclusions
Fix golden-data exclusions to match suffixed repository directories
Exclude actual generated golden directories from OpenGrep scans

Copilot

Copilot review overview

🔵 Needs a closer look

The broad security-scanner suppression policy and pinned external image require final human validation.

Review effort: Balanced
Findings: None

The generic test patterns (63 directory names, 23 file globs) were applied to TruffleHog as well as OpenGrep. Excluding test code from SAST is sound, but a credential committed to a test file is as live as one anywhere else, and trufflehog_exclude_dir stops the file being opened -- making it a permanent blind spot for every future secret in those paths. Measured across all 120 repos: dropping the test patterns surfaces 77 additional detections in 20 files across 7 repos, and all 77 are false positives -- 43 are UUIDs and random column values in CSV migration fixtures, the rest one generated ECDSA test key pasted into nine files, localhost postgres DSNs, and test JWTs. Those 20 files are now listed individually, so every other test file is scanned for secrets. .semgrepignore is unchanged; SAST keeps its test exclusions. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Copilot

Copilot review overview

🔵 Needs a closer look

The broad security-scan suppressions require human validation against actual scanner output.

Review effort: Balanced
Findings: None

The job inherited GitHub's 360-minute default. Measured scan work across all 120 repos is 30.3s at the slowest and 8.3s at the median, so 30 minutes leaves roughly sixty times the observed worst case while still failing a hung run in minutes rather than hours. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Copilot

Copilot review overview

🔵 Needs a closer look

Scanner and upload failures can currently produce a successful workflow result.

Review effort: Balanced
Findings: None

Previously missed (1)

In code that hasn't changed since last review

Fail the job when scanner connectors or result upload fail

.github/workflows/socket-basics.yml:49

This direct invocation trusts the scanner's exit status, but the pinned scanner runs connectors with fail_fast: false, catches Socket API submission failures, and then exits based only on the high/critical finding count. An OpenGrep, TruffleHog, Trivy, or dashboard-upload failure can therefore leave this weekly job green with partial or missing results. Gate success on completion of every enabled connector and a successful full-scan upload, or pin a scanner release that fails closed for those errors.

The Protocol 30 merge added src/rust/soroban/p29 and p30 as submodules. repo_ignores() reads .gitmodules, so regenerating .semgrepignore picks them up alongside p21-p28; without this they would be scanned as first-party code once checked out. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Copilot

Copilot review overview

🟡 Changes recommended

Scanner failures can currently produce successful, incomplete security runs.

Review effort: Balanced
Findings: 1

Open (1)

Enabled security scans can fail silently and still produce green runs · New

Previously missed (1)

In code that hasn't changed since last review

Comment incorrectly claims trivy_disabled_rules is unsupported

.trivyignore:4

This explanation is incorrect for the configured Socket Basics generation: upstream exposes trivy_disabled_rules as a JSON configuration key (it is documented and present as far back as v3.0.0). Keeping the comment as written will mislead future tuning work into maintaining a separate ignore mechanism unnecessarily.

+            -e GITHUB_REPOSITORY \
+            -e GITHUB_REF_NAME \
+            -e GITHUB_SHA \
+            ghcr.io/socketdev/socket-basics@sha256:d463bae84f21d0240d5e197acb81e95144a966a20ab7cd05cca3a70e1796a4bb \


Copilot

Copilot review overview

🔵 Needs a closer look

The secret-bearing third-party security workflow and extensive suppression policy warrant final human security review.

Review effort: Balanced
Findings: 1 · 1

Open (2)

Enabled security scans can fail silently and still produce green runs
Clarify preferred Trivy suppression mechanism · New

+# Trivy reads this file from the working directory. socket-basics has no config
+# key that can disable a Trivy rule, so this is the only lever.


kanwalpreetd force-pushed the master branch 4 times, most recently from 62a98c8 to 34c0284 Compare September 26, 2026 01:30

kanwalpreetd marked this pull request as ready for review September 28, 2026 12:40

Copilot AI balanced review requested due to automatic review settings September 28, 2026 12:40

Copilot started reviewing on behalf of kanwalpreetd September 28, 2026 12:41

View session

Copilot AI reviewed Sep 28, 2026

View reviewed changes

Comment thread .github/workflows/socket-basics.yml Outdated

Copilot AI review requested due to automatic review settings September 29, 2026 07:18

kanwalpreetd force-pushed the master branch from 34c0284 to 4fd5b64 Compare September 29, 2026 07:18

Copilot started reviewing on behalf of kanwalpreetd September 29, 2026 07:18

View session

Copilot AI reviewed Sep 29, 2026

View reviewed changes

Comment thread .github/workflows/socket-basics.yml Outdated

Comment thread .socket-basics.json Outdated

Copilot AI review requested due to automatic review settings September 29, 2026 08:53

kanwalpreetd force-pushed the master branch from 4fd5b64 to 4a8aea5 Compare September 29, 2026 08:53

Copilot AI reviewed Sep 29, 2026

Copilot AI review requested due to automatic review settings September 29, 2026 09:32

kanwalpreetd force-pushed the master branch from 4a8aea5 to 7a688f4 Compare September 29, 2026 09:32

Copilot started reviewing on behalf of kanwalpreetd September 29, 2026 09:32

View session

Copilot AI reviewed Sep 29, 2026

View reviewed changes

Comment thread .github/workflows/socket-basics.yml Outdated

Comment thread .trivyignore

Comment thread .semgrepignore Outdated

Copilot AI balanced review requested due to automatic review settings September 29, 2026 22:05

kanwalpreetd force-pushed the master branch from 7a688f4 to 3e1d482 Compare September 29, 2026 22:05

Copilot AI reviewed Sep 29, 2026

Copilot AI balanced review requested due to automatic review settings September 29, 2026 22:43

kanwalpreetd force-pushed the master branch from 3e1d482 to 80ec448 Compare September 29, 2026 22:43

Copilot started reviewing on behalf of kanwalpreetd September 29, 2026 22:44

View session

Copilot AI reviewed Sep 29, 2026

View reviewed changes

Comment thread .socket-basics.json Outdated

Copilot AI balanced review requested due to automatic review settings September 29, 2026 23:19

kanwalpreetd force-pushed the master branch from 80ec448 to 27c40de Compare September 29, 2026 23:19

Copilot started reviewing on behalf of kanwalpreetd September 29, 2026 23:19

View session

Copilot AI reviewed Sep 29, 2026

View reviewed changes

kanwalpreetd force-pushed the master branch from 27c40de to f274ab2 Compare September 30, 2026 00:18

Copilot started reviewing on behalf of kanwalpreetd September 30, 2026 00:19

View session

Copilot AI reviewed Sep 30, 2026

View reviewed changes

Comment thread .trivyignore

Copilot AI balanced review requested due to automatic review settings October 2, 2026 00:49

kanwalpreetd force-pushed the master branch from f274ab2 to 60ae97a Compare October 2, 2026 00:49

Copilot started reviewing on behalf of kanwalpreetd October 2, 2026 00:50

View session

Merge branch 'master' into master

594f7ce