Socket Basics SAST: add workflow and gitignore entries

[sgrammargs]

Summary

• Adds .github/workflows/socket-basics.yml — calls the shared Socket Basics reusable workflow at @main
• Adds .socket-scans/ and .socket.facts.json to .gitignore

Dependencies

Requires ynab/shared-actions#233 to be merged first.

Test plan

• Trigger on a PR — verify the socket-basics-security-scan job runs and posts a comment
• Verify no unexpected findings block the PR

🤖 Generated with Claude Code

[sgrammargs]

@copilot add sha pinning to the action in this PR to fix the failing auto-labeler ci failure

[sgrammargs]

@copilot add sha pinning to the action in this PR to fix the failing auto-labeler ci failure

whomp. whomp.

[buffym]

@copilot setup sha pinning for the actions in this repo to fix the failing ci.

[Copilot]

@copilot add sha pinning to the action in this PR to fix the failing auto-labeler ci failure

Updated in commit eb944f3. I pinned the GitHub Actions references used by the repo workflows to full commit SHAs to satisfy the policy check.

@copilot setup sha pinning for the actions in this repo to fix the failing ci.

Completed in commit eb944f3. I pinned the existing workflow action references in this repo to full-length SHAs to address the failing CI policy check.

[buffym]

@copilot explain why the build and test J2V8 is failing ci?

[Copilot]

@copilot explain why the build and test J2V8 is failing ci?

Build and test J2V8 is failing before the build/test commands run. In both jobs (Build J2V8 for Linux and Build J2V8 for Android), the step Download monolithic libraries and extract to v8.out downloads only ~194 bytes from http://download.eclipsesource.com/j2v8/v8/libv8_9.3.345.11_monolith.zip, then unzip fails with End-of-central-directory signature not found (exit code 9). So the root cause is the monolith artifact download returning a non-zip payload, not the SHA pinning changes.

[buffym]

@copilot any way to fix the monolith download ci issue?

[Copilot]

@copilot any way to fix the monolith download ci issue?

Yes — fixed in 8eb048d. I updated build_and_test.yml to download the monolith over HTTPS with curl --fail --location --retry ... and added unzip -tq validation before extraction in both Linux and Android jobs, so bad/non-zip responses fail fast and valid redirects are handled.

[buffym]

@copilot I think you are unzipping to the wrong directory with your most recent "fix"

[Copilot]

@copilot I think you are unzipping to the wrong directory with your most recent "fix"

I checked the latest failing run (28631306986) and the archive is extracting into v8.out as expected (v8.out/linux.x64, v8.out/android.*, v8.out/include). The current failure is happening in the next step with python2 build.py exiting 127 (python2 not found on the runner), not from extraction pathing.

[buffym]

@copilot help me fix the failing builds now at the next step

[Copilot]

@copilot help me fix the failing builds now at the next step

Fixed in 38cab82. I added pinned actions/setup-python (Python 2.7) steps to both Linux and Android jobs in build_and_test.yml, so the next python2 build.py ... step can run on current GitHub runners where python2 is not preinstalled.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	github/​actions/​upload-artifact@​631c3ac5d8cc76468d617056d13b8b27e16b2f92 ⏵ 043fb46d1a93c77aae656e7c1c64a875d1fc6a0a	-1		+11
	github/​actions/​setup-java@​b6e674f4b717d7b0ae3baee0fbe79f498905dfde ⏵ 1bcf9fb12cf4aa7d266a90ae39939e61372fe520	+1				+40

View full report