From 150ac67357bb5925915d5c5fe66fc6314cf8ec42 Mon Sep 17 00:00:00 2001 From: Marguerite Martinez Date: Tue, 1 Sep 2026 12:28:51 -0400 Subject: [PATCH 1/2] Update Socket Basics job call path Points the CI workflow at ynab-sast-scanner instead of shared-actions, adds the new App-token secret, and removes the legacy shared-actions caller comment. Co-Authored-By: Claude Sonnet 5 --- .github/workflows/socket-basics.yml | 7 ++----- 1 file changed, 2 insertions(+), 5 deletions(-) diff --git a/.github/workflows/socket-basics.yml b/.github/workflows/socket-basics.yml index a19fb451d..1cd8574e1 100644 --- a/.github/workflows/socket-basics.yml +++ b/.github/workflows/socket-basics.yml @@ -6,10 +6,7 @@ on: jobs: socket-basics-security-scan: - # We intentionally run this shared action from @main, not from a pinned sha - # this is because we control the shared-actions repo, so there is not a significant risk of malicious changes being pushed. - # Plus, the shared action does use pinned dependencies, and so will be updated fairly often. When we do that, we do not - # want to have to update the sha in every repo that uses this shared action, before such updates apply. - uses: ynab/shared-actions/.github/workflows/socket-basics.yml@main + uses: ynab/ynab-sast-scanner/.github/workflows/socket-basics.yml@main secrets: SOCKET_SECURITY_API_KEY: ${{ secrets.SOCKET_SECURITY_API_KEY }} + SAST_SUPPRESSIONS_APP_PRIVATE_KEY: ${{ secrets.SAST_SUPPRESSIONS_APP_PRIVATE_KEY }} From 70fee80f60107bada3054d34329dc7b74c1ad3d8 Mon Sep 17 00:00:00 2001 From: Marguerite Martinez Date: Wed, 2 Sep 2026 08:47:32 -0400 Subject: [PATCH 2/2] Restore the @main-vs-pinned-sha rationale comment Per Grant's review feedback, matching evergreen#30007. Co-Authored-By: Claude Sonnet 5 --- .github/workflows/socket-basics.yml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/.github/workflows/socket-basics.yml b/.github/workflows/socket-basics.yml index 1cd8574e1..5ddf328a3 100644 --- a/.github/workflows/socket-basics.yml +++ b/.github/workflows/socket-basics.yml @@ -6,6 +6,10 @@ on: jobs: socket-basics-security-scan: + # We intentionally run this shared action from @main, not from a pinned sha + # this is because we control the ynab-sast-scanner repo, so there is not a significant risk of malicious changes being pushed. + # Plus, the shared action does use pinned dependencies, and so will be updated fairly often. When we do that, we do not + # want to have to update the sha in every repo that uses this shared action, before such updates apply. uses: ynab/ynab-sast-scanner/.github/workflows/socket-basics.yml@main secrets: SOCKET_SECURITY_API_KEY: ${{ secrets.SOCKET_SECURITY_API_KEY }}