Skip to content

Commit 038a113

Browse files
jdaltonjdalton
authored
chore(ci): bump socket-registry SHA to ed311907 (#1180)
* chore(ci): bump socket-registry SHA to ed311907 * fix(ci): suppress pre-existing zizmor template-injection warnings in summary step * fix(ci): document permissions, fix template injection in weekly-update * chore(ci): bump socket-registry SHA to 07975491 * chore(ci): bump socket-registry SHA to 47d61c98 * chore: trim CLAUDE.md and audit skills Reduce CLAUDE.md from 26KB to 8KB (69% reduction) by removing: - File-by-file codebase descriptions (Claude reads code directly) - Verbose architecture/update mechanism sections - Redundant examples repeating the rules they illustrate - Tutorial-like explanations for standard workflows - Duplicate information already in socket-registry/CLAUDE.md - Configuration file listings discoverable from the repo - Standard language conventions Claude already knows Merged JUDGMENT/SCOPE and Critical Rules/ABSOLUTE RULES sections. Condensed Documentation Policy to a single paragraph. * fix: use third-person in skill descriptions * chore: trim skill files and fix third-person descriptions * chore(ci): bump socket-registry SHA to 1dc0e87d * chore(ci): bump socket-registry SHA to 96c2a403
1 parent 84a7a53 commit 038a113

8 files changed

Lines changed: 184 additions & 1254 deletions

File tree

‎.claude/skills/quality-scan/SKILL.md‎

Lines changed: 48 additions & 469 deletions
Large diffs are not rendered by default.

‎.claude/skills/security-scan/SKILL.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
---
22
name: security-scan
3-
description: Run a multi-tool security scan — AgentShield for Claude config, zizmor for GitHub Actions, and optionally Socket CLI for dependency scanning. Produces an A-F graded security report.
3+
description: Runs a multi-tool security scan — AgentShield for Claude config, zizmor for GitHub Actions, and optionally Socket CLI for dependency scanning. Produces an A-F graded security report.
44
---
55

66
# Security Scan

‎.claude/skills/updating-checksums/SKILL.md‎

Lines changed: 18 additions & 157 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,9 @@
11
---
22
name: updating-checksums
3-
description: Updates SHA-256 checksums from GitHub releases to external-tools.json. Triggers when user mentions "update checksums", "sync checksums", or after releasing new tool versions.
3+
description: >
4+
Syncs SHA-256 checksums from GitHub releases to external-tools.json.
5+
Triggers when user mentions "update checksums", "sync checksums", or after
6+
releasing new tool versions.
47
user-invocable: true
58
allowed-tools: Bash, Read, Edit
69
---
@@ -11,168 +14,26 @@ allowed-tools: Bash, Read, Edit
1114
Your task is to sync SHA-256 checksums from GitHub releases to the embedded `external-tools.json` file, ensuring SEA builds have up-to-date integrity verification.
1215
</task>
1316

14-
<context>
15-
**What is this?**
16-
socket-cli downloads prebuilt security tools (opengrep, python, socket-patch, sfw, trivy, trufflehog) from GitHub releases for bundling into SEA (Single Executable Application) builds. Each release may include a `checksums.txt` file with SHA-256 hashes.
17-
18-
**Architecture:**
19-
20-
- `packages/cli/external-tools.json` - Configuration with embedded checksums
21-
- `packages/cli/scripts/sync-checksums.mjs` - Sync script for GitHub release tools
22-
23-
**Tool Types in external-tools.json:**
24-
25-
| Type | Example | Checksums |
26-
|------|---------|-----------|
27-
| `github-release` | opengrep, trivy, sfw | Synced from releases |
28-
| `npm` | @coana-tech/cli, synp | SRI integrity hashes |
29-
| `pypi` | socketsecurity | May have checksums |
30-
31-
**Why Sync?**
32-
- After tool updates (new versions), checksums become stale
33-
- SEA builds verify downloads against embedded checksums
34-
- Version-controlled checksums enable audit trail
35-
</context>
36-
3717
<constraints>
38-
**CRITICAL Requirements:**
39-
- Network access required to fetch from GitHub API
40-
- Only `github-release` type tools are synced
41-
42-
**Do NOT:**
43-
- Modify checksums manually (always fetch from releases)
44-
- Skip verification after sync
45-
- Commit without reviewing changes
46-
47-
**Do ONLY:**
48-
- Fetch checksums from official GitHub releases
49-
- Update external-tools.json with new checksums
50-
- Verify the JSON is valid after update
18+
- Network access required to fetch from GitHub API.
19+
- Only `github-release` type tools are synced (not npm or pypi).
20+
- Never modify checksums manually; always fetch from releases.
21+
- Verify JSON validity after sync.
22+
- Review changes before committing.
5123
</constraints>
5224

53-
<instructions>
54-
55-
## Process
56-
57-
### Phase 1: Check Current State
58-
59-
<action>
60-
Review current embedded checksums and tool versions:
61-
</action>
62-
63-
```bash
64-
# Show current GitHub release tools in external-tools.json
65-
grep -A2 '"type": "github-release"' packages/cli/external-tools.json | head -40
66-
```
67-
68-
---
69-
70-
### Phase 2: Sync Checksums
71-
72-
<action>
73-
Run the sync script to fetch latest checksums:
74-
</action>
75-
76-
```bash
77-
# Sync all GitHub release tools
78-
node packages/cli/scripts/sync-checksums.mjs
79-
80-
# Or sync specific tool
81-
# node packages/cli/scripts/sync-checksums.mjs --tool=opengrep
82-
```
83-
84-
<validation>
85-
**Expected Output:**
86-
```
87-
Syncing checksums for 6 GitHub release tool(s)...
88-
89-
[opengrep] opengrep/opengrep @ v1.16.0
90-
Found checksums.txt, downloading...
91-
Parsed 5 checksums from checksums.txt
92-
Unchanged: 5 checksums
93-
94-
[python] astral-sh/python-build-standalone @ 3.11.14
95-
No checksums.txt found, downloading 8 assets to compute checksums...
96-
...
97-
98-
Summary: X updated, Y unchanged
99-
```
100-
101-
**If sync fails:**
102-
- Check network connectivity
103-
- Verify release exists: `gh release view <tag> --repo <owner/repo>`
104-
- Check GitHub API rate limits
105-
</validation>
106-
107-
---
108-
109-
### Phase 3: Verify Changes
110-
111-
<action>
112-
Review the updated checksums:
113-
</action>
114-
115-
```bash
116-
# Show what changed
117-
git diff packages/cli/external-tools.json
118-
119-
# Validate JSON syntax
120-
node -e "JSON.parse(require('fs').readFileSync('packages/cli/external-tools.json'))"
121-
```
25+
## Phases
12226

123-
---
124-
125-
### Phase 4: Commit Changes (if any)
126-
127-
<action>
128-
If checksums were updated, commit the changes:
129-
</action>
130-
131-
```bash
132-
# Only if there are changes
133-
git add packages/cli/external-tools.json
134-
git commit -m "chore(cli): sync external tool checksums
135-
136-
Update embedded SHA-256 checksums from GitHub releases.
137-
Enables SEA builds with up-to-date integrity verification."
138-
```
139-
140-
</instructions>
141-
142-
## Success Criteria
143-
144-
- All GitHub release tools synced from releases
145-
- external-tools.json updated with latest checksums
146-
- JSON syntax validated
147-
- Changes committed (if any updates)
27+
1. **Check Current State** - Review current checksums and tool versions in `packages/cli/external-tools.json`.
28+
2. **Sync Checksums** - Run `node packages/cli/scripts/sync-checksums.mjs`. Tries `checksums.txt` from the release first; falls back to downloading assets and computing SHA-256.
29+
3. **Verify Changes** - `git diff packages/cli/external-tools.json`; validate JSON syntax.
30+
4. **Commit Changes** - If updated, commit `packages/cli/external-tools.json`.
14831

14932
## Commands
15033

15134
```bash
152-
# Sync all GitHub release tools
153-
node packages/cli/scripts/sync-checksums.mjs
154-
155-
# Sync specific tool
156-
node packages/cli/scripts/sync-checksums.mjs --tool=opengrep
157-
158-
# Dry run (show what would change)
159-
node packages/cli/scripts/sync-checksums.mjs --dry-run
160-
161-
# Force update even if unchanged
162-
node packages/cli/scripts/sync-checksums.mjs --force
35+
node packages/cli/scripts/sync-checksums.mjs # Sync all
36+
node packages/cli/scripts/sync-checksums.mjs --tool=opengrep # Sync one
37+
node packages/cli/scripts/sync-checksums.mjs --dry-run # Preview
38+
node packages/cli/scripts/sync-checksums.mjs --force # Force update
16339
```
164-
165-
## Context
166-
167-
This skill is useful for:
168-
169-
- After updating tool versions in external-tools.json
170-
- When new GitHub releases are published
171-
- Before building SEA executables
172-
- Regular maintenance to keep checksums current
173-
174-
**Behavior:**
175-
1. First tries to download `checksums.txt` from the GitHub release
176-
2. If not available, downloads each asset and computes SHA-256 hashes
177-
3. Only updates tools with `type: "github-release"`
178-
4. npm packages use SRI integrity hashes (not handled by this script)

0 commit comments

Comments
 (0)