fix: green socket-cli main 🔎 Check (script paths, citations, action port map, coverage badge)

README.md

@@ -1,7 +1,7 @@
 # Socket CLI
 
 [![Socket Badge](https://socket.dev/api/badge/npm/package/socket)](https://socket.dev/npm/package/socket)
-![Coverage](https://img.shields.io/badge/coverage-75.08%25-brightgreen)
+![Coverage](assets/repo/badges/coverage.svg)
 
 [![Follow @SocketSecurity](https://img.shields.io/twitter/follow/SocketSecurity?style=social)](https://twitter.com/SocketSecurity)
 [![Follow @socket.dev on Bluesky](https://img.shields.io/badge/Follow-@socket.dev-1DA1F2?style=social&logo=bluesky)](https://bsky.app/profile/socket.dev)

package.json

@@ -42,6 +42,7 @@
     "// lockstep": "",
     "lockstep": "node scripts/fleet/lockstep.mts",
     "lockstep:emit-schema": "node scripts/fleet/lockstep-emit-schema.mts",
+    "lockstep:emit-mirror-globs": "node scripts/fleet/lockstep-emit-mirror-globs.mts",
     "// Setup": "",
     "setup": "node scripts/repo/setup.mts",
     "postinstall": "node scripts/repo/setup.mts --install --quiet",

packages/cli/package.json

@@ -35,7 +35,7 @@
     "build:sea": "node --max-old-space-size=8192 --import=./scripts/load.mts scripts/build-sea.mts",
     "build:js": "node scripts/build-js.mts",
     "dev:watch": "pnpm run build:watch",
-    "check": "node ../../scripts/check.mts",
+    "check": "node ../../scripts/fleet/check.mts",
     "check-ci": "pnpm run check",
     "lint": "oxlint -c ../../.config/oxlintrc.json",
     "lint-ci": "pnpm run lint",
@@ -71,7 +71,7 @@
     "test:validate": "node --import=./scripts/load.mts scripts/validate-tests.mts",
     "test-ci": "run-s test:prepare test:unit test:validate",
     "test-pre-commit": "cross-env PRE_COMMIT=1 pnpm test",
-    "update": "node ../../scripts/update.mts",
+    "update": "node ../../scripts/fleet/update.mts",
     "verify": "node scripts/verify-package.mts",
     "wasm": "node scripts/wasm.mts",
     "wasm:build": "node scripts/wasm.mts --build",

scripts/fleet/_shared/action-port-map.mts

@@ -78,6 +78,13 @@ export const COMPOSITE_ACTION_PORTS: Readonly<
   'setup-git-signing': [
     { portedAt: 'v7.0.0', upstream: 'crazy-max/ghaction-import-gpg' },
   ],
+  // Socket-original inline Go-toolchain locator: its header states it is
+  // "written inline so we don't depend on a third-party action". It only takes
+  // inspiration from actions/setup-go's generic fallback ordering (PATH →
+  // hosted toolcache → distro package manager → bail); it ports neither that
+  // action's input surface nor its go.dev/dl download algorithm, so there is no
+  // upstream release to lock-step against.
+  'setup-go-toolchain': [],
 }
 
 // Split an `<owner>/<repo>` slug; undefined when the shape is wrong. Pure.