chore(ci): bump socket-registry actions to 444b6415 (scan auto-skip)#611
Merged
John-David Dalton (jdalton) merged 2 commits intomainfrom Apr 24, 2026
Merged
Conversation
James Tu (jmsjtu)
approved these changes
Apr 24, 2026
John-David Dalton (jdalton)
force-pushed
the
chore/registry-sha-bump-13684cd8
branch
from
4e96eba to
ea8d87f
Compare
John-David Dalton (jdalton)
changed the title
John-David Dalton (jdalton)
force-pushed
the
chore/registry-sha-bump-13684cd8
branch
from
ea8d87f to
7487ab8
Compare
John-David Dalton (jdalton)
changed the title
…CKET_TOOL_CHECKSUMS_FILE)
John-David Dalton (jdalton)
force-pushed
the
chore/registry-sha-bump-13684cd8
branch
from
7487ab8 to
1287c5f
Compare
John-David Dalton (jdalton)
changed the title
…71e83f The bumped socket-registry actions (Layer 1 commit 24ad6b61, surfaced via Layer 3 propagation SHA 0371e83f) now enforce a runtime floor of @socketsecurity/lib >= the latest npm-published version. The previous pin (5.21.0) ships a stubbed pacote fetcher that throws inside downloadPackage when the install action provisions ecc-agentshield. Bumps the consumer pin to 5.24.0 (current npm latest) and re-pins socket-registry refs to the 0371e83f propagation SHA in the same commit so CI clears both gates simultaneously.
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
John-David Dalton (jdalton)
deleted the
chore/registry-sha-bump-13684cd8
branch
2 tasks
John-David Dalton (jdalton)
added a commit
that referenced
this pull request
Apr 24, 2026
…on fix) (#615) The previous propagation SHA (0371e83f, merged via #611) shipped a guard step whose version_lt function exploded when npm view returned a Socket Firewall banner string instead of a version. f1b40c99 validates npm view output as semver before using it, falling back to the hardcoded floor (5.24.0) when the response isn't plain semver.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps
SocketDev/socket-registryaction/workflow pins to444b6415.Rolls up all three successive cascades into a single pin bump:
7ca50837):setup/action.ymlexportsSOCKET_TOOL_PNPM_*,SOCKET_TOOL_SFW_*,SOCKET_TOOL_ZIZMOR_*,SOCKET_TOOL_AGENTSHIELD_*,SOCKET_TOOL_NODE_VERSION.@socketsecurity/libresolvability guard + AgentShield install viadownloadPackage.fd589015):setup/action.ymladdsSOCKET_TOOL_CHECKSUMS_FILEenv var pointing at a stable on-runner copy ofexternal-tools.json, usable as a Docker build-context COPY source so Dockerfiles can verify pnpm/zizmor/etc. tool checksums without duplicating per-platform SHAs.444b6415): zizmor + ecc-agentshield installs now auto-skip in matrix test cells viastrategy.job-total < 2. No user-facing input — PR authors cannot disable scans via workflow inputs. Scans still run exactly once in single-cell jobs (check / lint / type-check).Mechanical bump; no consumer code changes in this repo.