Add test

Author: tommy ho

.github/instructions/copilot-instructions.md

@@ -0,0 +1,10 @@
+## Socket MCP Server
+Before you make any changes to dependencies or manifest files, always check the dependencies scores with the depscore tool when you add or modify a dependency.  This rule applies to every dependency addition or update, and must be followed before any changes are made to the manifest file.
+
+If any score is below 0.80, consider using an alternative library. 
+
+When checking dependencies, make sure to also check the imports, not just the package.json file or other dependency manifest files.
+
+Whenever you add or update a dependency, you must check its Socket scores and print your reasoning for each category (license, maintenance, quality, supplyChain, vulnerability) in the following format:
+- If the package does not meet the score, print: "{Package}'s score for {category} is below your threshold of {score threshold}".
+- If the package does meet the score, print: "{Package}'s score for {category} meets requirement of at least {score threshold}".

.github/workflows/socket.yml

@@ -1,69 +1,28 @@
 name: socket-security-workflow
 run-name: Socket Security Github Action
-on: [push, issue_comment, pull_request]
+on:
+  push:
+    branches:
+      - main
 jobs:
   socket-security:
     permissions:
-      issues: write
-      contents: read
-      pull-requests: write
+      contents: read  # This is enough to clone the repo and read files
     runs-on: ubuntu-latest
-    if: ${{ (github.event_name == 'push' && format('refs/heads/{0}', github.event.repository.default_branch) == github.ref) || github.event_name == 'pull_request' || github.event_name == 'issue_comment'}}
     steps:
       - uses: actions/checkout@v4
         with:
-          fetch-depth: ${{ github.event_name == 'pull_request' && 2 || 0 }}
-      - name: Get changed files
-        id: changed-files
-        run: |
-            if ${{ github.event_name == 'pull_request' }}; then
-                echo "changed_files=$(git diff --name-only -r HEAD^1 HEAD | xargs)" >> $GITHUB_OUTPUT
-            else
-                echo "changed_files=$(git diff --name-only ${{ github.event.before }} ${{ github.event.after }} | xargs)" >> $GITHUB_OUTPUT
-            fi
+          fetch-depth: 0
       - uses: actions/setup-python@v5
         with:
           python-version: '3.12'
-      - name: Get PR State
-        if: github.event_name == 'pull_request'
-        run: echo "EVENT_ACTION=${{ github.event.action }}" >> $GITHUB_ENV
       - name: Install Socket CLI
         run: pip install socketsecurity --upgrade
-      - name: Check if Default Branch
-        if: ${{ always() && format('refs/heads/{0}', github.event.repository.default_branch) == github.ref }}
-        run: echo "DEFAULT_BRANCH=1" >> $GITHUB_ENV
-      - uses: actions/github-script@v7
-        id: get_pr_data
-        with:
-          script: |
-              let data = (
-                await github.rest.repos.listPullRequestsAssociatedWithCommit({
-                  commit_sha: context.sha,
-                  owner: context.repo.owner,
-                  repo: context.repo.repo,
-                })
-              ).data[0];
-              if (data === undefined) {
-                data = {
-                  'number': null,
-                  'title': null
-                }
-              }
-              
-              return data;
-      - name: Save Pull Request Number
-        run: |
-          echo "PR_NUMBER=${{ fromJson(steps.get_pr_data.outputs.result).number || github.event.issue.number || github.event.number }}"  >> $GITHUB_ENV
       - name: Run scan
         env:
           SOCKET_SECURITY_API_KEY: ${{ secrets.SOCKET_SECURITY_API_KEY }}
           GH_API_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           COMMIT_MESSAGE: ${{ github.event.head_commit.message }}
+          COMMIT_SHA: ${{ github.sha }}  # Getting the commit SHA
         run: |
-          CHANGED_FILES=$(echo "${{ steps.changed-files.outputs.changed_files }}" | tr " " "\n")
-          FILES=""
-          while IFS= read -r line; do
-            FILES="$FILES\"$line\","
-          done <<< "$CHANGED_FILES"
-          FILES=$(echo $FILES | sed 's/,*$//')
-          socketcli --files "[$FILES]" --scm github --repo ${{ github.event.repository.name }} --branch "${{ github.ref_name }}" $(if [ ! -z $DEFAULT_BRANCH ]; then echo "--default_branch"; fi) --pr_number $(if [ -z $PR_NUMBER ]; then echo 0; else echo $PR_NUMBER;fi) --committer "$GITHUB_ACTOR" --commit_message "$COMMIT_MESSAGE" --target_path $GITHUB_WORKSPACE
+          socketcli --scm github --repo ${{ github.event.repository.name }} --branch "${{ github.ref_name }}" --default-branch --pr_number 0 --commit-sha "$COMMIT_SHA" --committer "$GITHUB_ACTOR" --commit_message "$COMMIT_MESSAGE" --target_path $GITHUB_WORKSPACE --disable-blocking

socket.yml

@@ -0,0 +1,13 @@
+version: 2
+
+triggerPaths:
+  - 'package.json'
+  - 'yarn.lock'
+
+githubApp:
+  enabled: true
+  pullRequestAlertsEnabled: true # feature i'm trying to test
+  dependencyOverviewEnabled: false
+  projectReportsEnabled: true
+  ignoreUsers: []
+  disableCommentsAndCheckRuns: false