fix(sea): resolve audit tools and authorize native builds

Author: jdalton

.github/workflows/ci-sea.yml

@@ -41,7 +41,17 @@ jobs:
           payload-token-client-id: ${{ vars.SOCKET_PR_CLIENT_ID }}
           payload-token-private-key: ${{ secrets.SOCKET_PR_APP_PRIVATE_KEY }}
           socket-api-token: ${{ secrets.SOCKET_API_TOKEN_FOR_CLI_AND_SFW }}
+      - name: Mint sdxgen read token
+        id: sdxgen-token
+        uses: ./.github/actions/fleet/github-payload-app-token
+        with:
+          client-id: ${{ vars.SOCKET_PR_CLIENT_ID }}
+          private-key: ${{ secrets.SOCKET_PR_APP_PRIVATE_KEY }}
+          repositories: sdxgen
       - name: Build CLI payload
+        env:
+          GH_TOKEN: ${{ github.token }}
+          SDXGEN_GITHUB_TOKEN: ${{ steps.sdxgen-token.outputs.token }}
         run: pnpm run build:cli
       - name: Build native sea
         run: pnpm run build:sea --target=host

src/core/optimize/pastoralist-audit.mts

@@ -1,53 +1,46 @@
-/**
- * Pastoralist override audit for the optimize command. Runs pastoralist's
- * update pipeline against the project so stale package-manager overrides get
- * the review record (and pruning) pastoralist maintains, before socket's own.
- *
- * @socketregistry overrides are applied.
- *
- * Key Functions: - runPastoralistAudit: spawn the pinned pastoralist bin
- * against the project root, never failing the optimize run on its errors.
- *
- * Spawned (not imported) for the same reason the package-manager agents are:
- * the dependency stays out of the CLI's CJS bundle (pastoralist's dist uses
- * top-level await, which rolldown cannot emit as CJS) while the lockfile
- * still pins the exact audited version.
- */
-
-import { fileURLToPath } from 'node:url'
+import { readFileSync } from 'node:fs'
+import { findPackageJSON } from 'node:module'
+import path from 'node:path'
+import { pathToFileURL } from 'node:url'
 
 import { debug, debugDir } from '@socketsecurity/lib-stable/debug/output'
 import { getDefaultLogger } from '@socketsecurity/lib-stable/logger/default'
 import { spawn } from '@socketsecurity/lib-stable/process/spawn/child'
+import { rootPath } from '../../constants/paths.mts'
+import { resolveNodeRuntime } from '../../util/spawn/node-runtime.mts'
+
 const logger = getDefaultLogger()
 
 export type PastoralistAuditResult = {
   ok: boolean
   reason?: string | undefined
 }
 
-/**
- * Run pastoralist's override audit against `root`: its update flow writes
- * the override review appendix and prunes overrides whose reason is gone.
- * Errors are logged and swallowed — an audit miss must never block the
- * optimization it precedes.
- */
 export async function runPastoralistAudit(
   root: string,
 ): Promise<PastoralistAuditResult> {
   let binPath: string
   try {
-    // pastoralist's exports map carries only an `import` condition for `.`
-    // (dist/index.js, the bin), so the import-condition resolver finds it
-    // where a require-resolve cannot.
-    binPath = fileURLToPath(import.meta.resolve('pastoralist'))
+    const manifest = findPackageJSON(
+      'pastoralist',
+      pathToFileURL(path.join(rootPath, 'package.json')),
+    )
+    if (!manifest) {
+      return { ok: false, reason: 'pastoralist is not installed' }
+    }
+    const packageJson = JSON.parse(readFileSync(manifest, 'utf8')) as {
+      bin: { pastoralist: string }
+    }
+    binPath = path.resolve(path.dirname(manifest), packageJson.bin.pastoralist)
   } catch (e) {
     debug('pastoralist is not resolvable from this checkout')
     debugDir(e)
     return { ok: false, reason: 'pastoralist is not installed' }
   }
 
-  const result = await spawn(process.execPath, [binPath, '--root', root], {
+  const runtime = await resolveNodeRuntime({ cwd: root })
+  const result = await spawn(runtime.executable, [binPath, '--root', root], {
+    env: runtime.environment,
     cwd: root,
     stdio: 'inherit',
   })