mirror of
https://github.com/diegosouzapw/OmniRoute.git
synced 2026-09-19 13:23:50 +03:00
db5ae3c33d
* docs(dependencies): clarify socket.yml is registry-side scan, not CI gate * docs(dependencies): add changelog fragment for socket.yml scope note Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> --------- Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com>
35 lines
1.2 KiB
YAML
35 lines
1.2 KiB
YAML
# Socket.dev / Socket GitHub app configuration.
|
|
# Documentation: https://docs.socket.dev/docs/socket-yml
|
|
#
|
|
# NOTE: This file does NOT enforce a CI/PR gate. No workflow in
|
|
# .github/workflows, no package.json script, and no Makefile target invokes
|
|
# Socket.dev. It only shapes `projectIgnorePaths` for Socket's registry-side
|
|
# post-publish scan of the published npm artifact (see
|
|
# docs/security/SOCKET_DEV_FINDINGS.md).
|
|
#
|
|
# OmniRoute bundles privileged opt-in features (MITM proxy, Zed credential
|
|
# import, embedded service supervisor, Cloud Sync) inside the Next.js
|
|
# standalone build output. The v3.8.6 release applies in-tree mitigations for
|
|
# the six `gptMalware` findings raised against v3.8.5. The maintainer-signed
|
|
# attestation lives at:
|
|
#
|
|
# docs/security/SOCKET_DEV_FINDINGS.md
|
|
#
|
|
# Each flagged function carries an inline `SECURITY-AUDITOR-NOTE:` block.
|
|
version: 2
|
|
|
|
projectIgnorePaths:
|
|
# Test fixtures, scratch directories, and design documentation are not
|
|
# shipped to users.
|
|
- "tests/"
|
|
- "_tasks/"
|
|
- "_references/"
|
|
- "_ideia/"
|
|
- "_mono_repo/"
|
|
- "docs/"
|
|
- "coverage/"
|
|
- "playwright-report/"
|
|
- "test-results/"
|
|
|
|
# triggerPaths default is "*" — keep it.
|