Add Socket Basics security scanning

.github/workflows/socket-basics.yml

@@ -0,0 +1,16 @@
+name: Socket Basics Security Scan
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened]
+
+jobs:
+  socket-basics-security-scan:
+    # We intentionally run this shared action from @main, not from a pinned sha
+    # this is because we control the ynab-sast-scanner repo, so there is not a significant risk of malicious changes being pushed.
+    # Plus, the shared action does use pinned dependencies, and so will be updated fairly often.  When we do that, we do not
+    # want to have to update the sha in every repo that uses this shared action, before such updates apply.
+    uses: ynab/ynab-sast-scanner/.github/workflows/socket-basics.yml@main
+    secrets:
+      SOCKET_SECURITY_API_KEY: ${{ secrets.SOCKET_SECURITY_API_KEY }}
+      SAST_SUPPRESSIONS_APP_PRIVATE_KEY: ${{ secrets.SAST_SUPPRESSIONS_APP_PRIVATE_KEY }}

spec/recurly_v2/adjustment_spec.rb

@@ -115,6 +115,7 @@
         stub_api_request :get, 'adjustments/abcdef1234567890', 'adjustments/show-200-nosub'
 
         adjustment = Adjustment.find 'abcdef1234567890'
+        # nosemgrep: ruby-unsafe-deserialization
         adjustment_from_dump = Marshal.load(Marshal.dump(adjustment))
 
         adjustment.instance_variables.must_equal adjustment_from_dump.instance_variables
@@ -124,6 +125,7 @@
         stub_api_request :get, 'adjustments/abcdef1234567890', 'adjustments/show-200-nosub'
 
         adjustment = Adjustment.find 'abcdef1234567890'
+        # nosemgrep: ruby-unsafe-deserialization
         adjustment_from_dump = Marshal.load(Marshal.dump(adjustment))
 
         adjustment.type.must_equal adjustment_from_dump.type

spec/recurly_v2/billing_info_spec.rb

@@ -227,6 +227,7 @@
         :get, 'accounts/abcdef1234567890/billing_info', 'billing_info/show-200-bank-account'
       )
       billing_info = BillingInfo.find 'abcdef1234567890'
+      # nosemgrep: ruby-unsafe-deserialization
       billing_info_from_dump = Marshal.load(Marshal.dump(billing_info))
 
       billing_info.instance_variables.must_equal billing_info_from_dump.instance_variables
@@ -237,6 +238,7 @@
         :get, 'accounts/abcdef1234567890/billing_info', 'billing_info/show-200-bank-account'
       )
       billing_info = BillingInfo.find 'abcdef1234567890'
+      # nosemgrep: ruby-unsafe-deserialization
       billing_info_from_dump = Marshal.load(Marshal.dump(billing_info))
 
       billing_info.type.must_equal billing_info_from_dump.type

spec/recurly_v2/credit_payment_spec.rb

@@ -33,6 +33,7 @@
       stub_api_request :get, 'credit_payments/12345', 'credit_payments/show-200'
       credit_payment = CreditPayment.find('12345')
 
+      # nosemgrep: ruby-unsafe-deserialization
       credit_payment_from_dump = Marshal.load(Marshal.dump(credit_payment))
       credit_payment.instance_variables.must_equal credit_payment_from_dump.instance_variables
     end
@@ -41,6 +42,7 @@
       stub_api_request :get, 'credit_payments/12345', 'credit_payments/show-200'
       credit_payment = CreditPayment.find('12345')
 
+      # nosemgrep: ruby-unsafe-deserialization
       credit_payment_from_dump = Marshal.load(Marshal.dump(credit_payment))
       credit_payment.type.must_equal credit_payment_from_dump.type
     end

spec/recurly_v2/transaction_spec.rb

@@ -60,6 +60,7 @@
     it 'must return the same instance variables' do
       stub_api_request(:get, 'transactions/abcdef1234567890', 'transactions/show-200')
       transaction = Transaction.find 'abcdef1234567890'
+      # nosemgrep: ruby-unsafe-deserialization
       transaction_from_dump = Marshal.load(Marshal.dump(transaction))
 
       transaction.instance_variables.must_equal transaction_from_dump.instance_variables
@@ -68,6 +69,7 @@
     it 'must return the same values' do
       stub_api_request(:get, 'transactions/abcdef1234567890', 'transactions/show-200')
       transaction = Transaction.find 'abcdef1234567890'
+      # nosemgrep: ruby-unsafe-deserialization
       transaction_from_dump = Marshal.load(Marshal.dump(transaction))
 
       transaction.type.must_equal transaction_from_dump.type