From b194c00e22fa6a771c5165866e8972f63ab82a3d Mon Sep 17 00:00:00 2001 From: jdalton Date: Sat, 25 Jul 2026 17:04:52 -0400 Subject: [PATCH 1/2] fix: repoint moved fleet script paths and wire lockstep:emit-mirror-globs The scripts/repo migration moved check.mts and update.mts into scripts/fleet/, but packages/cli/package.json still pointed its "check" and "update" scripts at the old ../../scripts/*.mts paths, failing check-script-paths-resolve. The lockstep-emit-mirror-globs.mts script cascaded in (and its sibling lockstep:emit-schema is wired), but the root package.json never got the matching lockstep:emit-mirror-globs alias, so the updating-lockstep skill docs cited a pnpm script that did not resolve, failing check-pnpm-run-citations-resolve. - packages/cli/package.json: check -> ../../scripts/fleet/check.mts - packages/cli/package.json: update -> ../../scripts/fleet/update.mts - package.json: add lockstep:emit-mirror-globs pointing at the existing scripts/fleet/lockstep-emit-mirror-globs.mts shim --- package.json | 1 + packages/cli/package.json | 4 ++-- 2 files changed, 3 insertions(+), 2 deletions(-) diff --git a/package.json b/package.json index af23e7c86b..e692148cbd 100644 --- a/package.json +++ b/package.json @@ -42,6 +42,7 @@ "// lockstep": "", "lockstep": "node scripts/fleet/lockstep.mts", "lockstep:emit-schema": "node scripts/fleet/lockstep-emit-schema.mts", + "lockstep:emit-mirror-globs": "node scripts/fleet/lockstep-emit-mirror-globs.mts", "// Setup": "", "setup": "node scripts/repo/setup.mts", "postinstall": "node scripts/repo/setup.mts --install --quiet", diff --git a/packages/cli/package.json b/packages/cli/package.json index 2ae7f0ca9b..407970386a 100644 --- a/packages/cli/package.json +++ b/packages/cli/package.json @@ -35,7 +35,7 @@ "build:sea": "node --max-old-space-size=8192 --import=./scripts/load.mts scripts/build-sea.mts", "build:js": "node scripts/build-js.mts", "dev:watch": "pnpm run build:watch", - "check": "node ../../scripts/check.mts", + "check": "node ../../scripts/fleet/check.mts", "check-ci": "pnpm run check", "lint": "oxlint -c ../../.config/oxlintrc.json", "lint-ci": "pnpm run lint", @@ -71,7 +71,7 @@ "test:validate": "node --import=./scripts/load.mts scripts/validate-tests.mts", "test-ci": "run-s test:prepare test:unit test:validate", "test-pre-commit": "cross-env PRE_COMMIT=1 pnpm test", - "update": "node ../../scripts/update.mts", + "update": "node ../../scripts/fleet/update.mts", "verify": "node scripts/verify-package.mts", "wasm": "node scripts/wasm.mts", "wasm:build": "node scripts/wasm.mts --build", From bd0da6621ef53c727142824e95a26d6b7a2b4a3c Mon Sep 17 00:00:00 2001 From: jdalton Date: Sun, 26 Jul 2026 18:11:25 -0400 Subject: [PATCH 2/2] =?UTF-8?q?fix:=20green=20remaining=20=F0=9F=94=8E=20C?= =?UTF-8?q?heck=20residuals=20(action=20port=20map=20+=20coverage=20badge)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Two fleet-drift 🔎 Check failures on main, independent of the script-path/citation fix: - action-ports-are-lock-stepped: the setup-go-toolchain composite had no port-map entry. Its action.yml states it is "written inline so we don't depend on a third-party action" and only borrows actions/setup-go's generic fallback ordering, porting neither its input surface nor its go.dev/dl download algorithm — so it is Socket-original (`[]`), not a lock-stepped port. - coverage-badge-is-current: the README carried a shields.io badge with a decimal percent (coverage-75.08%25) that the migrator's integer-only matcher could not recognize, tripping the unrecognized-form gate. Repointed to the canonical repo-local asset badges/coverage.svg (the generated placeholder SVG already exists and is tracked). --- README.md | 2 +- scripts/fleet/_shared/action-port-map.mts | 7 +++++++ 2 files changed, 8 insertions(+), 1 deletion(-) diff --git a/README.md b/README.md index bce15c70db..38805cbc3d 100644 --- a/README.md +++ b/README.md @@ -1,7 +1,7 @@ # Socket CLI [![Socket Badge](https://socket.dev/api/badge/npm/package/socket)](https://socket.dev/npm/package/socket) -![Coverage](https://img.shields.io/badge/coverage-75.08%25-brightgreen) +![Coverage](assets/repo/badges/coverage.svg) [![Follow @SocketSecurity](https://img.shields.io/twitter/follow/SocketSecurity?style=social)](https://twitter.com/SocketSecurity) [![Follow @socket.dev on Bluesky](https://img.shields.io/badge/Follow-@socket.dev-1DA1F2?style=social&logo=bluesky)](https://bsky.app/profile/socket.dev) diff --git a/scripts/fleet/_shared/action-port-map.mts b/scripts/fleet/_shared/action-port-map.mts index 2b0cdee58d..830cc63d66 100644 --- a/scripts/fleet/_shared/action-port-map.mts +++ b/scripts/fleet/_shared/action-port-map.mts @@ -78,6 +78,13 @@ export const COMPOSITE_ACTION_PORTS: Readonly< 'setup-git-signing': [ { portedAt: 'v7.0.0', upstream: 'crazy-max/ghaction-import-gpg' }, ], + // Socket-original inline Go-toolchain locator: its header states it is + // "written inline so we don't depend on a third-party action". It only takes + // inspiration from actions/setup-go's generic fallback ordering (PATH → + // hosted toolcache → distro package manager → bail); it ports neither that + // action's input surface nor its go.dev/dl download algorithm, so there is no + // upstream release to lock-step against. + 'setup-go-toolchain': [], } // Split an `/` slug; undefined when the shape is wrong. Pure.