From fc0289a509d6fa2822df3ec2475be09205bb8625 Mon Sep 17 00:00:00 2001
From: wenxin-jiang <wenxin_jiang@outlook.com>
Date: Mon, 14 Sep 2026 13:03:16 -0400
Subject: [PATCH 1/2] Mint read-only App token for zizmor audit

Repositories that pin actions or reusable workflows from other private
Socket repositories fail the audit: zizmor's online provenance checks
cannot list refs with the repository GITHUB_TOKEN and abort the run.

When a repository provides vars.SOCKET_PR_CLIENT_ID and
secrets.SOCKET_PR_APP_PRIVATE_KEY, mint a contents:read installation
token for the audit step; otherwise, on Dependabot PRs and on
cross-repository PRs, fall back to GITHUB_TOKEN so behavior is
unchanged. The secret access is suppressed inline for
secrets-outside-env; this workflow runs without an environment by
design.

Assisted-by: Claude Code:claude-fable-5-1
Claude-Session: https://claude.ai/code/session_01FqKyQNqkiw7aakGFPCTg9t
---
 .github/workflows/audit-gha-workflows.yml | 21 ++++++++++++++++++++-
 1 file changed, 20 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/audit-gha-workflows.yml b/.github/workflows/audit-gha-workflows.yml
index abd5cf3..ed91479 100644
--- a/.github/workflows/audit-gha-workflows.yml
+++ b/.github/workflows/audit-gha-workflows.yml
@@ -15,11 +15,30 @@ jobs:
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
+      - name: Create read-only audit token
+        id: audit-token
+        if: >-
+          ${{ vars.SOCKET_PR_CLIENT_ID != ''
+              && github.actor != 'dependabot[bot]'
+              && (github.event_name != 'pull_request'
+                  || github.event.pull_request.head.repo.full_name == github.repository) }}
+        continue-on-error: true
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        with:
+          client-id: ${{ vars.SOCKET_PR_CLIENT_ID }}
+          private-key: ${{ secrets.SOCKET_PR_APP_PRIVATE_KEY }} # zizmor: ignore[secrets-outside-env]
+          owner: SocketDev
+          permission-contents: read
+      - name: Report token source
+        env:
+          MINTED: ${{ steps.audit-token.outcome == 'success' && steps.audit-token.outputs.token != '' }}
+        run: |
+          if [ "$MINTED" = "true" ]; then echo "audit token: minted"; else echo "audit token: fallback GITHUB_TOKEN"; fi
       - name: Install zizmor
         run: pip install zizmor==1.23.1
       - name: Run zizmor
         env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GITHUB_TOKEN: ${{ steps.audit-token.outputs.token || secrets.GITHUB_TOKEN }}
         run: |
           if [ -d .github ]; then
             zizmor .github --gh-token "${GITHUB_TOKEN}" --min-severity medium

From 66ff66dae370d1cc80e00e8c2c0c93efcd9e137d Mon Sep 17 00:00:00 2001
From: wenxin-jiang <wenxin_jiang@outlook.com>
Date: Mon, 14 Sep 2026 14:18:30 -0400
Subject: [PATCH 2/2] Scope audit token to a dedicated read-only App

Review feedback: an installation-wide token from the Socket PR App
exposes every installed repository if leaked, and that App's private
key can mint write tokens, so it is not a read-only credential.

Mint from dedicated ZIZMOR_AUDIT_APP_* credentials instead, intended
for an App whose installation only grants read access, and restrict
the token to the repositories each consumer names in
ZIZMOR_AUDIT_REPOSITORIES. Minting is skipped unless both are set.

Assisted-by: Claude Code:claude-fable-5-1
Claude-Session: https://claude.ai/code/session_01FqKyQNqkiw7aakGFPCTg9t
---
 .github/workflows/audit-gha-workflows.yml | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/audit-gha-workflows.yml b/.github/workflows/audit-gha-workflows.yml
index ed91479..095356a 100644
--- a/.github/workflows/audit-gha-workflows.yml
+++ b/.github/workflows/audit-gha-workflows.yml
@@ -18,16 +18,18 @@ jobs:
       - name: Create read-only audit token
         id: audit-token
         if: >-
-          ${{ vars.SOCKET_PR_CLIENT_ID != ''
+          ${{ vars.ZIZMOR_AUDIT_APP_CLIENT_ID != ''
+              && vars.ZIZMOR_AUDIT_REPOSITORIES != ''
               && github.actor != 'dependabot[bot]'
               && (github.event_name != 'pull_request'
                   || github.event.pull_request.head.repo.full_name == github.repository) }}
         continue-on-error: true
         uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
         with:
-          client-id: ${{ vars.SOCKET_PR_CLIENT_ID }}
-          private-key: ${{ secrets.SOCKET_PR_APP_PRIVATE_KEY }} # zizmor: ignore[secrets-outside-env]
-          owner: SocketDev
+          client-id: ${{ vars.ZIZMOR_AUDIT_APP_CLIENT_ID }}
+          private-key: ${{ secrets.ZIZMOR_AUDIT_APP_PRIVATE_KEY }} # zizmor: ignore[secrets-outside-env]
+          owner: ${{ github.repository_owner }}
+          repositories: ${{ vars.ZIZMOR_AUDIT_REPOSITORIES }}
           permission-contents: read
       - name: Report token source
         env: