Repository navigation
[codex] fix Socket security workflow - #185
Merged
Merged
Conversation
DannyDesert
marked this pull request as ready for review
May 4, 2026 18:26
DannyDesert
added a commit
that referenced
this pull request
May 4, 2026
## Summary - add a public-release readiness regression test that blocks Troy-specific AWS/Discord/private-network IDs in public deploy/docs/prompt surfaces - remove active Strategist Builder/Deployer directive publications and update the objective workflow examples to route through Architect/AO-era ownership - make AO a first-class AWS Terraform service with private Cloud Map service discovery, Core -> AO URL wiring, AO -> Core callback URL wiring, AO storage/concurrency config, and fail-fast GitHub/AO auth checks - scrub deployment helper docs/scripts and Terraform comments/defaults so the product does not publish private deployment IDs - fix Terraform validation blockers in Secrets Manager for_each handling and S3 lifecycle configuration ## Coverage against existing PRs - PR #183 already covers local compose/CLI AO install defaults; this PR covers the AWS Terraform deploy path and public-release leakage checks. - PR #184 covers broader config wiring drift; this PR only removes the remaining active Strategist Builder/Deployer publications and adds a focused regression guard. - PR #185 is a Socket workflow fix and is not duplicated here. - PR #186 covers GitHub readiness doctor checks; this PR adds AWS deploy-time GitHub/AO auth requirements. - PR #187 covers dynamic repo registration; this PR only passes GitHub/AO repo identity through AWS deployment config. ## Verification - `npx vitest run packages/core/tests/public-release-readiness.test.ts` - `npm run validate-configs --workspace=packages/core` - `terraform -chdir=deploy/aws validate` - `npm run typecheck` - `npm test` - `npm run build` ## Notes - `terraform validate` proves syntax/module wiring. The new GitHub/AO `check` blocks are plan-time guardrails and require real variable values during an AWS plan/apply. - The full test suite currently emits an existing Vitest warning about a nested `vi.mock` in `packages/core/tests/discord-executor.test.ts`; tests still pass. Co-authored-by: Troy Murray <troy@graviton.xyz>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
mode: diffpath with Socket's documented CLI workflow.SOCKET_SECURITY_API_KEYprecheck so the job degrades clearly when the secret is not configured.Verification
SocketDev/actionormode: diff; workflow containssocketcliandSOCKET_SECURITY_API_KEY..github/workflows/socket-security.ymlparses and contains thesocket-securityjob.run:script passesbash -n.SOCKET_SECURITY_API_KEYemitsenabled=false, warning, and job summary.SOCKET_SECURITY_API_KEYemitsenabled=true.git diff --checkNotes
SOCKET_SECURITY_API_KEYsecret or variable configured, so the workflow will skip with a visible warning until that secret is added..github/workflows/socket-security.yml; the protected-path guard is expected to require thehuman-approvedlabel.