fix(ci): point workflows at the org-level SOCKET_API_TOKEN_FOR_CLI_AND_SFW secret - #1490
Merged
Merged
Conversation
…D_SFW secret The repo-level SOCKET_API_TOKEN and SOCKET_API_KEY secrets were removed when these moved to the organization level, where the token is now named SOCKET_API_TOKEN_FOR_CLI_AND_SFW. Both old names resolved to an empty string, which failed the e2e suite outright and silently downgraded every CI job from sfw-enterprise to sfw-free. SOCKET_RELEASE_APP_PRIVATE_KEY and SOCKET_RELEASE_CLIENT_ID kept their names at the org level, so those references are left alone.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
The repo-level
SOCKET_API_TOKENandSOCKET_API_KEYsecrets were removed when these moved to the organization level, where the token is now namedSOCKET_API_TOKEN_FOR_CLI_AND_SFW. Both old names silently resolved to an empty string.Two symptoms:
SOCKET_CLI_API_TOKENarrived empty, socmd-scan-reach.e2e.test.mtsthrewSOCKET_CLI_API_TOKEN environment variable not setandcmd-fix.e2e.test.mtscollected zero tests.Download sfwstep picks its tier with[ -n "$SOCKET_API_KEY" ] && USE_ENTERPRISE=true, so an empty value quietly took the free path. Lint / Type Check / Test Matrix stayed green while no longer exercising sfw-enterprise.Changes
Six references, all to the same org-level secret:
e2e-tests.ymlSOCKET_CLI_API_TOKENci.ymlSOCKET_API_KEYnpm-publish.ymlSOCKET_API_KEYSOCKET_RELEASE_APP_PRIVATE_KEYandSOCKET_RELEASE_CLIENT_IDkept their names at the org level, so those references are deliberately untouched.Verifying the fix
SOCKET_CLI_API_TOKENnow arrives masked (***) instead of blank, the suite runs for ~3m instead of aborting after 42s, andcmd-fix.e2e.test.mtspasses where it previously collected zero tests. Both sfw repos (SocketDev/firewall-release,SocketDev/sfw-free) are public, so the enterprise download path works with the workflow's owngithub.token.Restoring the token uncovered three reach tests that were already failing on
v1.xand were previously masked by the missing token:multi-ecosystem filtering › --reach-ecosystems pypinpm-test-workspace-mono › reachability on workspace monotarget and cwd flags › --cwd sets working directoryexpected [ '.', '.', '.' ] to include 'packages/package-a'This PR changes only secret names, and it sits on
v1.xwith Coana15.10.9, so this run is a clean baseline for them. A separate dispatch on15.10.10produced the identical three failures (3 failed | 15 passed), confirming the pending Coana bump neither causes nor worsens them.Worth noting separately: the
Probe tier1 legacy_mode (DIAGNOSTIC - REMOVE AFTER USE)step can no longer work regardless of the token —api.socket.devreturns a Cloudflare interstitial to its plaincurl, so the JSON parse always fails. It challenges on request shape, not auth; the same HTML comes back with a valid token. It should probably just be removed.