Add Socket Basics security scanning workflow

[kanwalpreetd]

More info: https://stellarorg.atlassian.net/wiki/spaces/SCRT/pages/5901680652/Socket+Basics+Integration+Guide

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

[Copilot]

Copilot review overview

🟡 Changes recommended

The workflow advertises Trivy scanning while the configuration disables it, making the stated coverage inaccurate.

Review effort: Lite
Findings: 1

Open (1)

• Workflow documentation inaccurately advertises disabled Trivy scanning · New

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

[Copilot]

Copilot review overview

🟡 Changes recommended

Preserve unexpected non-zero scan exits or validate explicit scan completion before reporting success.

Review effort: Lite
Findings: 1 · 1

Open (2)

• Preserve scan failures when partial facts file exists · New
• Workflow documentation inaccurately advertises disabled Trivy scanning

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

[Copilot]

Copilot review overview

🟡 Changes recommended

The workflow has critical and moderate issues in scan-result validation that can misreport failures or clean scans.

Review effort: Lite
Findings: 2 · 1

Open (3)

• Accept valid empty component lists as successful scans · New
• Preserve scan failures when partial facts file exists
• Workflow documentation inaccurately advertises disabled Trivy scanning

[Copilot]

Copilot review overview

🟡 Changes recommended

The workflow can mask high/critical findings and report success when result submission is not verified.

Review effort: Lite
Findings: 2 · 1

Open (3)

• Propagate scanner status to fail on high or critical findings · New
• Accept valid empty component lists as successful scans
• Workflow documentation inaccurately advertises disabled Trivy scanning

Resolved since last review (1)

• Preserve scan failures when partial facts file exists

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

[Copilot]

Copilot review overview

🟢 Approval recommended

No unresolved blocking issues were identified.

Review effort: Lite
Findings: None

Resolved since last review (3)

• Propagate scanner status to fail on high or critical findings
• Accept valid empty component lists as successful scans
• Workflow documentation inaccurately advertises disabled Trivy scanning

[stellar-triage-bot]

🤖 Automated message from Kaan's Automated Triage Bot.

Thanks, Kanwalpreet. The final workflow is much tighter than the first rounds. It is clean on the points I can check:

• Triggers are schedule and workflow_dispatch only, so fork PR code never runs with the Socket token.
• permissions: contents: read and persist-credentials: false keep the GitHub token out of the container.
• actions/checkout@df4cb1c is the real v6.0.3 commit. It is the same pin as socket-scan.yml.
• The image digest sha256:d463bae… resolves on ghcr.io and is the 3.1.0 tag. The newest tag is 3.4.0.
• Every key in .socket-basics.json matches upstream docs/parameters.md. All five sast_ignore_overrides paths exist on main.
• Copilot's four findings are resolved at this head. The header no longer claims Trivy, and the script no longer rewrites the exit code.

One small suggestion: add # 3.1.0 next to the digest, so a reader knows the version without a registry lookup.

This PR adds a workflow, so I do not merge it. @kaankacar the decision is yours: add a second Socket workflow (SAST and secret scanning) next to socket-scan.yml. It sends the repo contents and the org SOCKET_SECURITY_API_TOKEN to the pinned 3.1.0 container, and it suppresses five SAST rules. The first real run happens only after merge, on Saturday's cron or a manual dispatch.