Socket Security (Action)
ActionsTags
(2)Verified
A GitHub Action for running Socket.dev
Tip
A GitHub App is also available for a fully automated SCA workflow.
There is nothing to install. Reference the action from a workflow step and the
runner fetches it at the ref you pin. The workflow step, with the mode
input filled in, is in Usage below. Pin to a commit SHA rather than a
tag; Why We Recommend Pinning explains the
trade-off.
This action can run in multiple modes:
- Socket Firewall: Free
- Socket Firewall: Enterprise
- Socket CLI: Coming soon
Socket is a security control, so the action that installs it should be pinned, too. We recommend pinning to an immutable commit SHA for the strongest supply-chain protection. If your organization prefers easier readability, pin to an immutable version tag instead. Either way, Dependabot can keep the reference current while preserving a human review gate.
Downloads and installs Socket Firewall: Free edition in your GitHub Action job, making it available to use in subsequent steps.
The published action requires an explicit sfw prefix, as shown below. Automatic shims and final PATH validation are unreleased features in the current source.
Free edition examples, inputs, and outputs
on: push
jobs:
safe-install:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- uses: SocketDev/action@ba6de6cc0565af1f42295590380973573297e31f # v1.3.2
with:
mode: firewall-free
# javascript / typescript
- run: sfw npm install # or sfw pnpm install, sfw yarn install
# rust
- run: sfw cargo fetch
# python
- run: sfw pip install -r requirements.txton: push
jobs:
safe-install:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- uses: SocketDev/action@v1.3.2
with:
mode: firewall-free
# javascript / typescript
- run: sfw npm install # or sfw pnpm install, sfw yarn install
# rust
- run: sfw cargo fetch
# python
- run: sfw pip install -r requirements.txtPrefix each package-manager command with sfw:
- uses: SocketDev/action@v1.3.2
with:
mode: firewall-free
- run: sfw npm installversion: 2
updates:
- package-ecosystem: 'github-actions'
directory: '/'
schedule:
interval: 'weekly'
cooldown:
semver-major-days: 14
semver-minor-days: 7
semver-patch-days: 3Add a cooldown period if you want an extra buffer before newly published action releases are proposed. That gives the ecosystem a little time to surface regressions before Dependabot opens an update PR in your repo.
| Input | Description | Required | Default |
|---|---|---|---|
firewall-version |
Specify the firewall version number | No | latest |
github-token |
GitHub API Token used for downloading binaries | No | ${{ github.token}} |
job-summary |
Create a job summary (all, errors, or none) |
No | all |
shims |
Create automatic shims (unreleased source only) | No | true |
use-cache |
Cache the Socket binaries (force download if false) |
No | true |
| Output | Description |
|---|---|
firewall-path-binary |
Path to the installed binary |
firewall-path-report |
Path to the generated firewall report JSON |
Downloads and installs Socket Firewall: Enterprise edition in your GitHub Action job, making it available to use in subsequent steps.
The published action requires the same explicit sfw prefix as the free edition.
Enterprise edition examples, inputs, and outputs
on: push
jobs:
safe-install:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- uses: SocketDev/action@ba6de6cc0565af1f42295590380973573297e31f # v1.3.2
with:
mode: firewall-enterprise
socket-token: ${{ secrets.SOCKET_API_KEY }}
# javascript / typescript
- run: sfw npm install # or sfw pnpm install, sfw yarn install
# rust
- run: sfw cargo fetch
# python
- run: sfw pip install -r requirements.txton: push
jobs:
safe-install:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- uses: SocketDev/action@v1.3.2
with:
mode: firewall-enterprise
socket-token: ${{ secrets.SOCKET_API_KEY }}
# javascript / typescript
- run: sfw npm install # or sfw pnpm install, sfw yarn install
# rust
- run: sfw cargo fetch
# python
- run: sfw pip install -r requirements.txtversion: 2
updates:
- package-ecosystem: 'github-actions'
directory: '/'
schedule:
interval: 'weekly'
cooldown:
semver-major-days: 14
semver-minor-days: 7
semver-patch-days: 3Add a cooldown period if you want an extra buffer before newly published action releases are proposed. That gives the ecosystem a little time to surface regressions before Dependabot opens an update PR in your repo.
| Input | Description | Required | Default |
|---|---|---|---|
firewall-version |
Specify the firewall version number | No | latest |
github-token |
GitHub API Token used for downloading binaries | No | ${{ github.token}} |
job-summary |
Create a job summary (all, errors, or none) |
No | all |
shims |
Create automatic shims (unreleased source only) | No | true |
socket-token |
Socket API Token | YES | - |
use-cache |
Cache the Socket binaries (force download if false) |
No | true |
| Output | Description |
|---|---|
firewall-path-binary |
Path to the installed binary |
firewall-path-report |
Path to the generated firewall report JSON |
The supported ecosystems depend on the edition. Current unreleased source also routes these commands through automatic shims when shims is true.
Package managers by edition
Available in both sfw-free and sfw-enterprise:
| Ecosystem | Package Manager |
|---|---|
| JavaScript/Node | npm |
| JavaScript/Node | pnpm |
| JavaScript/Node | yarn |
| Python | pip |
| Python | pip3 |
| Python | uv |
| Rust | cargo |
Additional ecosystems available with sfw-enterprise:
| Ecosystem | Package Manager | Note |
|---|---|---|
| .NET | nuget |
|
| Go | go |
Linux only |
| Ruby | bundler |
|
| Ruby | gem |
Run runtime and package-manager setup actions before the firewall action. Install dependencies afterward. A later setup step can put its binaries ahead of the firewall shims on PATH.
With automatic shims enabled, the post action fails the job if supported commands resolve outside the shim directory. This check also runs with job-summary: none. It checks the final PATH after execution. It cannot protect earlier installs or detect temporary drift that was later restored.
Run the firewall action again after changing runtimes, or use explicit sfw invocation. In current source, shims: 'false' selects explicit invocation and disables the final shim check.
With automatic shims enabled in current source, the action exports SFW_SHIM_DIR as an environment variable pointing to the shim directory. If you need to bypass sfw for a specific step (e.g. npm publish), you can temporarily disable the shims by renaming them and restore them afterwards:
Disable and restore shims around publishing
# disable shims before publishing
- name: Disable sfw shims
run: |
if [ -n "$SFW_SHIM_DIR" ] && [ -d "$SFW_SHIM_DIR" ]; then
for SHIM in "$SFW_SHIM_DIR"/*; do
[ -f "$SHIM" ] && mv "$SHIM" "${SHIM}.disabled"
done
fi
- run: npm publish
# re-enable shims after publishing
- name: Restore sfw shims
if: always()
run: |
if [ -n "$SFW_SHIM_DIR" ] && [ -d "$SFW_SHIM_DIR" ]; then
for SHIM in "$SFW_SHIM_DIR"/*.disabled; do
[ -f "$SHIM" ] && mv "$SHIM" "${SHIM%.disabled}"
done
fiCurrent source validates each downloaded firewall binary against a checksum pinned in the action source.
Requires Node 24+ and pnpm.
pnpm install
pnpm run build
pnpm run check --allsrc/ holds the action sources and dist/ holds the bundle a workflow runner
actually executes. A consumer resolves the action at a git tag and runs the
committed dist/main.js and dist/post.js, with no node_modules beside
them. That makes dist/ part of the source of truth: run pnpm run build and
commit the result in the same change as any src/ edit, or the next tag ships
a bundle that silently does not contain your change. The
committed-dist-is-current check is the gate that catches a miss.
MIT
Socket Security (Action) is not certified by GitHub. It is provided by a third-party and is governed by separate terms of service, privacy policy, and support documentation.
Verified
Tags
(2)Socket Security (Action) is not certified by GitHub. It is provided by a third-party and is governed by separate terms of service, privacy policy, and support documentation.