Repository navigation
Socket Security GitHub App for nodejs/doc-kit聽#1105
Description
Hey folks 馃憢
I'd like to request the Socket Security GitHub App to be installed on nodejs/doc-kit, and only there for now.
Why
doc-kit's Dependabot PRs auto-merge after one code-owner approval, and our only dependency gate today is GitHub's Dependency Review, which only knows about published CVEs. Socket checks what a new or updated package actually does (install scripts, network/shell/filesystem access, obfuscated code, typosquats, maintainer changes, known malware) and reports it on the PR as a check run and a comment.
It also covers a gap our pnpm settings can't: about a third of doc-kit's runtime dependencies are published by a single npm account without provenance, so pnpm's trustPolicy has nothing to compare them against. We're tightening the rest of the setup in nodejs/doc-kit#1178.
Express, webpack and Electron already run it, and it's free for open source.
Permissions
| Scope | Permission |
|---|---|
| Repository | Checks: read & write |
| Repository | Contents: read & write (write is only for Socket's patch PRs, which we won't use) |
| Repository | Pull requests: read & write |
| Repository | Issues, Merge queues, Metadata: read |
| Organization | Members: read |
| Account | Email addresses: read |
We'd configure it through a socket.yml in the repo and make its PR check required once it has run.
REF
- https://docs.socket.dev/docs/permissions
- https://docs.socket.dev/docs/socket-for-github-installation
cc @nodejs/tsc @nodejs/web-infra
Activity