Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>

Warn when scan results cannot be uploaded because socket_org is unavailable after API key configuration.

Co-authored-by: lelia <2418071+lelia@users.noreply.github.com>

* fix: support local SAST ignore overrides by rule id, path

Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>

* fix: skip ignored SAST findings in blocking logic

Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>

* fix: strip common CI workspace prefixes from filepaths before matching

Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>

* chore: add tests for GHA and common CI checkout path routes

Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>

* docs: describe new low severity label option

Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>

* chore: add low severity config to notifications

Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>

* fix: check severity label on reruns, improve error logging, add tests

Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>

* fix: clear stale labels when findings are downgraded, ignored, or resolved

Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>

* fix: reconcile severity labels on all-clear reruns

Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>

* fix: update existing PR comments to add all-clear message

Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>

* fix: update phrasing in test assertion for PR comment body

Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>

* docs: update docs to reflect new override and PR comment lifecycle capabilities

Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>

* chore: revert action manifest back to proper GHCR image path

Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>

* fix: add diagnostics, logging for invalid SAST override filepaths

Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>

* chore: point action manifest at Dockerfile for branch testing

Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>

* fix: scope all-clear PR message to the correct scanner comment

Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>

* chore: restore action manifest to GHCR image path

Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>

* fix: reconcile PR comments on all-clear reruns

---------

Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>

…red (#83)

Findings suppressed via *_disabled_rules or a local SAST ignore override are
forced to action 'ignore' and tagged with an actionReason by the normalizer.
OpenGrepScanner.generate_notifications() filtered by severity only, so a
suppressed critical/high finding still posted to the PR comment, Slack, Jira,
and the other notifiers even though the dashboard treats it as ignored.

Skip alerts carrying an actionReason ('disabled_rule' or 'sast_ignore_override')
when building notification groups. Gate on the explicit reason rather than
action == 'ignore', because 'ignore' is also the default action the normalizer
derives for low-severity findings -- those must still notify when a user opts in
to low severities. Suppressed alerts still ship in the uploaded facts; only
notifications are gated.

Adds a regression test for the OpenGrep PR-comment path: a suppressed finding is
excluded while an active finding survives, a fully-suppressed component yields no
notifications, and an opted-in low-severity finding still notifies.

Fixes CE-285

…g observability (#61)

* fix: custom SAST config normalization + precedence handling

Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>

* fix: harden custom SAST rule selection + filtering behavior

Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>

* docs: clarify custom SAST config, predence, rule-path semantics

Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>

* fix: include custom rules in all-language scans

---------

Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>

* docs: document required API token scopes for Socket Basics

* docs: clarify Socket Basics token scopes

---------

Co-authored-by: lelia <2418071+lelia@users.noreply.github.com>

Log the selected configuration source during Config initialization.

Co-authored-by: lelia <2418071+lelia@users.noreply.github.com>

Applies the PolyForm Shield License 1.0.0

…79) (#88)

PR #79 renamed LICENSE to LICENSE.md, which deviates from standard OSS
naming conventions and broke references that point at the extensionless
LICENSE file:

- Dockerfile:61 COPY ... LICENSE ... (Docker build failed, file missing)
- pyproject.toml license = {file = "LICENSE"} (packaging failed)

Renames LICENSE.md back to LICENSE and drops the now-unnecessary
!LICENSE.md exception from .gitignore. Both references above resolve
correctly again with no further changes.

Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>

…kflows (#78)

* chore(deps): bundle dependency updates + harden supply-chain review

Bundles 8 open Dependabot PRs into one verified change and hardens the
Dependabot config + dependency-review workflows, mirroring the work in
socket-sdk-python#84 and socket-python-cli#207/#217. Adds a supply-chain
watch for the four core OSS tools Dependabot cannot cleanly track.

- uv.lock: idna 3.10->3.18 (CVE-2026-45409), pygments 2.19.2->2.20.0,
  pytest 8.4.2->9.0.3, urllib3 2.6.3->2.7.0
- _docker-pipeline.yml: bump 4 docker/* actions (setup-buildx, login,
  metadata, build-push)
- dependabot.yml: add uv ecosystem, group every ecosystem into
  minor/patch + major bundles, scan composite actions
- dependency-review.yml (was dependabot-review.yml): runs on every PR;
  free/enterprise sfw split; report artifacts; app_tests docker smoke
- core-tool-watch.yml + scripts/check_core_tools.py: discover latest
  versions of opengrep/trufflehog/trivy/socketdev and score them through
  the Socket API (socketdev SDK purl.post); drift issue + report artifact
- python-tests.yml: uv.lock drift guard

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* fix(ci): drop socket-firewall environment gate, add required coverage gate

Mirroring the Python CLI/SDK used `environment: socket-firewall` to scope the
SFW token, but that environment can carry a required-reviewers approval gate.
Because the enterprise SFW check can't be a required status check (it would
block Dependabot/fork PRs that only run the free edition), maintainers could
merge without approving the deployment -- the meaningful check silently never
ran, and approvers could rubber-stamp their own PRs. On the scheduled
core-tool-watch job an approval gate would hang the cron run outright.

- Remove `environment:` from python-sfw-smoke-enterprise and core-tool-watch;
  use a plain repo/org SOCKET_SFW_API_TOKEN (zizmor secrets-outside-env is
  already disabled here, so no lint cost). Job split still isolates the token
  to the enterprise job only.
- Add always-on `dependency-review-gate` job: pass when no python deps changed,
  else require the free (Dependabot/fork) or enterprise (maintainer) smoke job
  to have succeeded. Mark THIS as the single required status check -- safe on
  every PR, no manual gate, no bypass.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* fix(ci): scope SFW token via environment (no approval rule), harden gate

Adopt the socket-python-cli#224 pattern uniformly. The environment was never
the problem -- the required-reviewers approval RULE on it was. Keep the
environment for secret scoping; forbid the rule.

- Restore `environment: socket-firewall` on python-sfw-smoke-enterprise and the
  core-tool-watch analyze job so SOCKET_SFW_API_TOKEN is scoped to those jobs.
  Header documents that the environment must have NO reviewers rule, with the
  gh api command to enforce it (reviewers: null).
- dependency-review-gate (Pattern 2 aggregator): now also needs
  docker-smoke-app-tests; fails on any failure/cancelled result (success and
  skipped pass) AND requires the trust-appropriate SFW edition to have
  succeeded when Python deps changed. Runs if: always() so the required context
  is always created -- no Pattern 1 bypass twin needed. Must land on main before
  being added to branch protection.

Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>

* fix(ci): degrade SFW enterprise to free when token absent; upload JSON report

Live CI exposed two things on the now-enabled Actions:
- socketdev/action firewall-enterprise HARD-ERRORS on an empty token (no
  silent fallback), so a trusted dep PR opened before the SOCKET_SFW_API_TOKEN
  secret exists fails and the required gate blocks merge. setup-sfw now resolves
  the effective mode and falls back to firewall-free when enterprise is
  requested without a token -- still a real supply-chain check, ships green
  today, auto-upgrades to enterprise the moment the secret is added. Token is
  read via env, never interpolated into the script.
- socketdev/action writes a structured report to $SFW_JSON_REPORT_PATH; both
  smoke jobs now capture it and upload it alongside the tee'd log.

Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>

* feat(core-tool-watch): add Semgrep upstream proxy for OpenGrep Socket scoring

OpenGrep ships as a GitHub-release binary that Socket has no data for under
its pkg:github coordinate, so the watcher reported 'no data' for it. OpenGrep
is a hard fork of Semgrep, so fall back to scoring the upstream Semgrep
lineage (pkg:pypi/semgrep) as a project-health proxy.

The proxy is report-only and never build-failing: it does not analyze
OpenGrep's own release artifacts, so a Semgrep alert must not block an
OpenGrep build. The pinned/latest verdicts show the proxy result labeled
'(via semgrep upstream proxy)' when the primary coordinate has no data, and
the JSON report records it under a separate 'proxy' key.

The npm 'opengrep' package is a single-version squat (not the official
distribution) and is deliberately not used as a coordinate.

Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>

* chore(deps): bundle 3 newly-filed Dependabot PRs (#81, #86, #87)

- requests >=2.31.0 -> >=2.33.0 (#87); targeted 'uv lock --upgrade-package
  requests' resolves 2.34.2 (newer than Dependabot's 2.33.0) and pulls
  light-s3-client 0.0.40 -- the only two packages Dependabot's own PR touched.
- actions/setup-python 6.2.0 -> 6.3.0 in python-tests.yml (#86, SHA verified
  against the v6.3.0 tag). The group's setup-buildx 4.1.0 bump is already in
  this branch.
- docker/metadata-action 6.1.0 (#81) is already applied here (identical SHA) --
  #81 is fully superseded, no code change.

All three PRs to be closed manually as superseded by #78.

Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>

* fix(core-tool-watch): address Cursor Bugbot findings on #78

Five hardening fixes flagged by Bugbot:

1. Critical alerts now fail-on-malware (was malware-only). Track any_critical
   separately and exit non-zero on malware OR critical, matching the documented
   intent; add a 'critical' GitHub output.
2. Pins are read from BOTH Dockerfiles. app_tests/Dockerfile pins the same core
   tools (trufflehog/trivy/opengrep) independently; the reader only saw the root
   Dockerfile, so a divergent app_tests bump went unscored. Tool.pinned is now a
   list of every distinct pinned version, all of which are scored.
3. Watch mode no longer fails on latest. Only PINNED (in-use) versions are
   fail-worthy; the discovered latest is scored for drift reporting only, so a
   scheduled watch can't go red on an upstream release we haven't adopted.
4. dependency-review-gate fails closed when inspect fails. A failed inspect left
   DEPS_CHANGED/IS_TRUSTED empty, so the coverage rules silently passed and a PR
   with dep changes could merge with no Socket Firewall run. Added Rule 0.
5. Socket API errors fail closed in build mode. A swallowed analyze_purls
   exception let --fail-on-malware exit 0 with pinned versions unverified; now
   a scoring error (token present) fails the run.

Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>

* fix(ci): address 2 more Bugbot findings on #78

1. Drift issue never opened (High). gh issue list --jq '.[0].number' prints
   the literal string 'null' when no open core-tool-drift issue exists; 'null'
   is non-empty in bash, so the first scheduled drift run would call
   'gh issue edit null' instead of creating the issue. Use '// empty' so an
   absent issue yields an empty string and the create branch runs.

2. Tests ignored the lockfile (Medium). python-tests installed deps via
   'pip install -e .[dev]' (a fresh resolution) while only asserting the lock
   separately, so tests could run against different versions than uv.lock.
   Switch to 'uv sync --locked --extra dev' + 'uv run --no-sync pytest' so
   tests run against exactly the locked set.

Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>

* fix(ci): restore bare LICENSE to unblock CI (mirrors #88)

Temporary: pull #88's fix into this branch so CI's merge-with-main ref builds.
PR #79 renamed the license to LICENSE.md and deleted the empty LICENSE, but
pyproject.toml and the Dockerfile still reference LICENSE, so hatchling and the
Docker build fail against current main. This restores the PolyForm content into
bare LICENSE (rename LICENSE.md -> LICENSE) and drops the now-moot !LICENSE.md
.gitignore exception.

Revert this commit and pull latest main once #88 lands there (main will then
carry the identical fix).

Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>

* fix(core-tool-watch): per-event concurrency group + document Dependabot secret gap

- Include github.event_name in the concurrency group so a merge to main
  can't cancel the in-flight weekly watch run (or vice versa).
- Document that Dependabot-triggered pull_request runs never receive the
  environment-scoped SOCKET_SFW_API_TOKEN (only Dependabot secrets), so
  build-mode scoring silently degrades to drift-only there; note the
  'gh secret set --app dependabot' mirror needed for pre-merge coverage.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* feat(deps-review): route Dependabot through sfw-enterprise; isolate core-tool-watch scan env

Dependabot-triggered runs can read a *Dependabot-store* secret (set via
'gh secret set SOCKET_SFW_API_TOKEN --app dependabot'), so the free-tier
routing for Dependabot -- a workaround for the assumption that its runs
could never hold a token -- is gone:

- dependency-review.yml: trusted == any in-repo (non-fork) PR, now
  including Dependabot. Its dep bumps get full org-policy (enterprise)
  enforcement; forks stay on the anonymous free edition. setup-sfw's
  existing empty-token fallback covers the window until the Dependabot
  secret mirror exists.
- core-tool-watch.yml: sync the scan's Python env from the DEFAULT
  BRANCH lockfile (second checkout at .scan-env) so the token-holding
  step never imports packages bumped by the PR under review -- it only
  reads the PR's pins. Makes the Dependabot token mirror safe here too.
- dependency-review.yml: import smokes use 'uv run --no-sync' so the
  post-firewall step can't re-sync outside sfw (Bugbot finding).
- check_core_tools.py: docstring/help now honestly describe the strict
  fail thresholds (curated malware-class list + high/critical), which
  are intentional (Bugbot finding).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(core-tool-watch): sync scan env with --no-install-project

The scan env checkout of main fails to build the socket-basics package
editable while main carries the LICENSE.md rename breakage (#79, fix
pending in #88). The scan only imports the dependencies (socketdev SDK),
never socket_basics itself, so skip installing the project entirely --
also insulates this guard from any future main-side packaging breakage.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(core-tool-watch): org-scoped purl endpoint + fail closed on empty API result

Two related hardenings from external review of purl.post() usage:

- Pass org_slug (resolved via client.org.get) when the installed SDK
  supports it: socketdev >= 3.1 (socket-sdk-python#76) deprecates the
  legacy POST /v0/purl in favor of POST /v0/orgs/{slug}/purl, and a
  future major may drop the legacy route. The pinned 3.0.29 predates
  the parameter, so it is signature-gated -- activates automatically
  when the scan env's lockfile bumps the SDK.

- Raise on an empty purl.post result: the SDK swallows ANY non-200
  (expired token, dropped endpoint, outage) into [], which previously
  flowed through as 'no data' verdicts and exit 0 -- fail-open. Every
  run scores coordinates Socket definitely has data for, so empty is
  an API failure; raising routes it into the existing scoring_error
  fail-closed path under --fail-on-malware.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(core-tool-watch): resolve org slug only when unambiguous

Match socket-python-cli's get_org_id_slug() semantics: pass org_slug to
purl.post only when the token maps to exactly one org; multi-org tokens
fall back to the legacy endpoint with a notice rather than guessing and
scoring under the wrong org's policies.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(core-tool-watch): fail closed on unverified pinned coordinates

Bugbot: a non-empty but incomplete Socket batch (or a pinned coordinate
that never matches a returned analysis row) previously passed as 'no
data' with exit 0 -- the guard could green-light a build without
verifying every pin it exists to gate.

Tools now declare socket_coverage (default True); with a token and a
successful scoring pass, any covered pinned coordinate missing from the
results is collected as unverified and fails a --fail-on-malware run,
listing the exact coordinates. OpenGrep sets socket_coverage=False:
its pkg:github coordinate is the documented no-data case with the
report-only semgrep proxy, and must not perma-fail the guard. The
unverified list is also surfaced in the JSON report.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

---------

Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>