Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/js-pr-validation.yml:
- Around line 280-320: Declare the socket_use_cache boolean input in
.github/workflows/js-pr-validation.yml lines 280-320 with a safe default, pass
it as use-cache in the Socket Firewall configuration at
.github/workflows/js-pr-validation.yml lines 486-496, and document the matching
input-table row in docs/js-pr-validation.md lines 83-92.

In `@docs/js-pr-validation.md`:
- Line 14: Update the Socket supply chain documentation to state that the
pipeline is enabled by default and callers can disable it with run_socket:
false; remove the inaccurate “opt-in” wording.

In `@src/security/socket-firewall/action.yml`:
- Around line 92-99: Update the guarded “Setup Node.js” step to remove the cache
and cache-dependency-path settings, then add a cache-clearing step before the
Socket Firewall package-manager install that clears the selected npm, Yarn, or
pnpm cache based on inputs.package-manager.
- Around line 117-149: In src/security/socket-firewall/action.yml lines 117-149,
remove the unsupported shims input from the SocketDev/action step and prefix
each package-manager command in the install step with sfw while preserving the
existing arguments and exit-code capture. In
src/security/socket-firewall/README.md lines 41-43, update the documentation to
describe explicit sfw invocation rather than package-manager shimming.

In `@src/security/socket-scan/action.yml`:
- Around line 49-51: Update the SARIF output handling in the guard and scan
steps so sarif_file is assigned only after [[ -f "$SARIF_FILE" ]] confirms the
report exists; leave it empty when creation fails or is not requested. Change
the composite action’s sarif-file output mapping to
steps.scan.outputs.sarif_file, and apply the same behavior to the additional
referenced output paths.
- Around line 119-124: Remove the FAIL_ON_FINDINGS-based condition that adds
--disable-blocking to ARGS, so advisory runs preserve Socket CLI API failure
exit codes. Keep --disable-blocking only for the DRY_RUN case if required, and
leave the evaluator’s existing success/failure gate unchanged.
- Around line 117-129: Update the “Run Socket scan” path in the socket-scan
action so the `socketcli` invocation is skipped entirely when `inputs.dry-run`
is true, rather than only appending `--disable-blocking`; gate the step using
the existing `steps.guard` output and the `dry-run` input, and keep the current
dry-run summary output as the only behavior in that mode. Reference the
`socketcli` call and the surrounding shell block that builds `ARGS` so the
normal scan flow remains unchanged when dry-run is false.

In `@src/security/socket-scan/README.md`:
- Around line 58-80: Add a concise rationale section to the README for the
third-party actions used by the Socket Scan workflow: explain that
actions/checkout provides the repository contents and required history for
scanning, and that actions/setup-python supplies the Python runtime needed by
the composite action. Keep the documentation focused on the purpose of each
action.

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@src/security/socket-scan/action.yml`:
- Around line 79-82: Update the “Install Socket CLI” step in action.yml to
install a specifically reviewed socketsecurity version instead of using the
unconstrained --upgrade option; include package hashes if the workflow’s pip
installation supports hash pinning, while preserving the existing guard
condition and execution flow.

---

Outside diff comments:
In @.github/workflows/js-pr-validation.yml:
- Around line 473-501: Split the current socket job into separate Firewall and
scan jobs: keep the Firewall job limited to contents: read, and place the scan
in its own job with only the permissions it needs, gated by socket_enable_scan.
Update socket-gate to depend on and aggregate both job results, preserving the
existing changes and input conditions while ensuring write permissions are not
granted to the Firewall path.

In `@src/security/socket-firewall/action.yml`:
- Around line 105-236: Make dry-run preview-only in
src/security/socket-firewall/action.yml lines 105-236: guard the Install Socket
Firewall, Clear package manager cache, Install dependencies through Socket
Firewall, and Evaluate Socket Firewall result steps so they are skipped when
inputs.dry-run is true, while retaining resolved-configuration notices. Update
src/security/socket-firewall/README.md line 64 to state that dry-run does not
install tooling, clear caches, or install dependencies.

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/frontend-pr-analysis.yml:
- Around line 249-257: Replace the mutable feat/js-pr-validation-socket
reference in the setup-node-guarded action at
.github/workflows/frontend-pr-analysis.yml ranges 249-257, 288-296, 320-328,
360-368, 558-566, 597-605, 665-673, 705-713, 770-778, 810-818, 861-869, and
983-992 with `@develop` until the composite action is released, then use `@v1` after
publication.

In @.github/workflows/js-pr-validation.yml:
- Around line 315-318: Expose the Socket App polling interval across all
referenced sites: declare socket_app_poll_interval with a default of 15
alongside socket_app_timeout in .github/workflows/js-pr-validation.yml:315-318,
pass it to socket-app-gate as poll-interval-seconds in
.github/workflows/js-pr-validation.yml:530-538, and add the matching documented
input row in docs/js-pr-validation.md:89-94.

In `@docs/frontend-pr-analysis-workflow.md`:
- Around line 143-149: Update the package-manager command table to reflect
guarded installs as the default: prefix the default npm, yarn, and pnpm commands
with sfw, or add distinct guarded and unguarded rows while preserving the
existing unguarded commands for enable_socket_firewall: false.

In `@src/security/socket-app-gate/action.yml`:
- Around line 86-97: The polling loop’s success condition in the Socket App
check flow must not pass when only one check has appeared. Update the condition
around TOTAL and PENDING to require all expected checks, including both Project
Report and Pull Request Alerts, before writing timed_out=false and breaking;
otherwise continue polling until the complete check set is present and no checks
remain pending.

In `@src/security/socket-reporter/action.yml`:
- Around line 114-128: Update the socket-reporter invocation and its blocking
calculation around APP_STATUS so App Gate handling uses the configured
on-inconclusive and on-missing-app policies in addition to app-fail-on-findings.
Propagate the App Gate outcome or both policy inputs into the reporter, ensuring
PR Blocked and gate results remain consistent for all app verdicts.

In `@src/setup/setup-node-guarded/action.yml`:
- Around line 82-85: Update the missing-lockfile branch in the setup action to
set and expose a skipped result, then use that result to bypass cached Node
setup, dependency installation, and final result evaluation. Follow the existing
skip contract in the upstream socket-firewall action, while preserving the
warning and successful early exit.

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Outside diff comments:
In `@src/security/socket-reporter/action.yml`:
- Around line 93-96: Update the findings-file handling around APP_FINDINGS_FILE
before fs.readFileSync: resolve the configured path against the workspace,
reject absolute paths and any path outside the workspace, and reject symlinks
using lstat or equivalent validation before reading. Preserve the existing
appEnabled, existence, and JSON parsing flow for validated workspace-local
files.

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@src/security/socket-reporter/action.yml`:
- Line 248: Update the Markdown rendering helpers used by fixBlock and the
existing package and Firewall renderers to apply one shared Markdown encoder to
every report-controlled package, finding type, and fix value, including f.pkg,
f.type, and fixText(f.fix). Ensure the encoder handles backticks, pipes, and
line breaks consistently before values are inserted into PR comments, while
preserving the existing fixBlock behavior.

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@src/security/socket-firewall/README.md`:
- Line 10: Update the install-time layer description in the README to state that
it reports blocked packages and findings and enforces the fail-on-block policy,
while clarifying that Socket App verdicts and per-package API findings remain
provided by socket-app-gate and socket-api-report.

---

Duplicate comments:
In `@src/security/socket-api-report/README.md`:
- Around line 142-150: Add the missing diff-scan resolver before api-report in
src/security/socket-api-report/README.md lines 142-150, keep upstream steps
failure-tolerant, and define the example job with runs-on:
blacksmith-4vcpu-ubuntu-2404. In src/security/socket-reporter/README.md lines
102-119, add socket-app-gate before api-report, pass its report-url, keep
upstream steps failure-tolerant, and specify the same runner so both examples
are complete YAML.

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@src/security/socket-api-report/action.yml`:
- Around line 315-317: The credentialed Socket API helper get must reject
redirects rather than allowing urllib.request.urlopen to follow them. Update get
to use a redirect handler that blocks redirects, then handle the resulting
redirect failure at the diff_scan_id call site as an advisory skip while
preserving normal response processing.
- Around line 315-324: Update the diff-scan validation around the `fresh`
assignment to parse `results` as a list of objects and set `fresh` only when at
least one result has an `id` equal to `diff_scan_id`; treat non-object or
non-list responses as empty results, while preserving the existing JSON decode
fallback and subsequent stale-scan handling.

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@src/security/socket-api-report/action.yml`:
- Around line 305-313: Update the shared HTTP request handling used by post and
get to use a redirect-rejecting urllib opener, preventing credentialed requests
from following redirects. Preserve redirect responses as the existing advisory
skip outcome, and keep the current status/body handling for non-redirect
responses.
- Around line 321-325: Validate decoded JSON and nested result shapes in the
response-handling helpers around the existing JSON parsing at lines 322, 339,
and 362. Normalize only mapping payloads, ensure results are lists of mappings,
and treat invalid payloads or entries such as null as advisory skips returning
the existing empty/None outcome, while preserving skipped=true and
classified-count emission.
- Around line 335-344: Update the known diff-scan lookup in base_scan_from to
fetch the requested scan by ID or paginate through all diff-scan result pages
until known_id is found, preserving the existing before_full_scan_id return
behavior. Ensure missing or invalid responses still return None, and add a
regression case covering an ID beyond the first 30 results.

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/js-pr-validation.yml:
- Around line 623-625: Remove the temporary probe-package: 'abab' diagnostic
input from the workflow configuration, ensuring the normal API report no longer
performs unrelated probe or quota work. Do not retain it in the production
pull-request path; only preserve it if gated behind a development-only option
defaulting to false.

In `@src/security/socket-api-report/action.yml`:
- Around line 42-45: Remove the temporary probe-package interface end to end:
delete its input declaration, caller usage, environment mapping, and diagnostic
logging, including the related logic near the workflow invocation and report
handling. Keep the action’s supported inputs and normal scan behavior unchanged;
do not document this temporary interface.

---

Outside diff comments:
In @.github/workflows/js-pr-validation.yml:
- Around line 644-661: Update the “Gate - Fail on Socket findings” step to pass
inputs.dry_run as DRY_RUN. When DRY_RUN is true, emit a ::notice:: containing
the computed FAILED result and exit successfully without enforcing failures;
preserve the existing error annotation and nonzero exit behavior for normal
runs.

---

Duplicate comments:
In @.github/workflows/js-pr-validation.yml:
- Line 555: Replace every `@feat/js-pr-validation-socket` reference in the
workflow’s composite action steps with the repository-approved promoted
reference, including the occurrences near the affected security and validation
steps. Ensure no temporary feature-branch references remain in
`.github/workflows/js-pr-validation.yml`.
- Around line 529-580: Add the optional socket-scan action to the socket job
alongside socket-firewall and socket-app-gate, wiring its inputs and advisory
result into the existing reporting and gating behavior. Preserve the PR
objective that socket-scan is an optional paid scan; alternatively remove the
corresponding paid-scan input and documentation if the scan is intentionally
unsupported.
- Around line 595-598: Update the comment-fetching logic around JQ, BODY, and ID
to aggregate all paginated Socket Security comments before selecting the latest
candidate, then validate its diff-scan metadata against the current repository,
pull request number, and head SHA. Only pass the scan ID to socket-api-report
when all metadata matches the current App run; otherwise set ID to an empty
value. Reuse the existing workflow context and report-input symbols rather than
trusting the first matching historical comment.
- Around line 280-366: Update the Socket App Gate invocation to pass the
declared socket_app_poll_interval input as poll-interval-seconds alongside
timeout-seconds, preserving the composite action’s configurable polling
behavior. If no invocation can use this input, remove socket_app_poll_interval
and its related documentation instead.

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Outside diff comments:
In `@src/security/socket-api-report/action.yml`:
- Around line 417-445: Validate the diff payload before classification: require
the decoded value to be a dictionary, ensure diff_scan and artifacts are
dictionaries when present, and require the added, updated, and replaced buckets
to be lists. In the parsing and validation flow around the shape diagnostic and
buckets assignment, call bail with the invalid-payload message and "warning"
instead of setting an empty diff or publishing classification outputs; preserve
valid nested and fallback artifact bucket handling.

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Outside diff comments:
In @.github/workflows/frontend-pr-analysis.yml:
- Around line 983-992: Update the Docker smoke-test workflow so Socket Firewall
protection is established before docker/build-push-action executes, rather than
only in the later “Setup Node.js and install dependencies” step. Ensure the
caller-selected Dockerfile’s dependency downloads and lifecycle scripts run
through an equivalent guarded path, while preserving the existing guard,
firewall-version, and fail-on-block inputs.

In @.github/workflows/js-pr-validation.yml:
- Around line 591-594: Update the BODY query in the pull-request comment
retrieval flow to use gh api pagination with slurping, so all comment pages are
combined before the JQ filter selects the latest socket-security[bot] comment.
Preserve the existing diff-scan ID extraction from BODY.

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Outside diff comments:
In @.github/workflows/js-pr-validation.yml:
- Line 548: Replace every temporary feat/js-pr-validation-socket action
reference in the workflow steps around Checkout code with the published `@v1`
composite action reference, including all additionally flagged occurrences.
Ensure no feature-branch references remain so reusable workflow action
resolution uses the published version.
- Around line 612-629: Update the Socket API Report step to pass
secrets.SOCKET_SECURITY_API_KEY through its socket-api-key input so the action
runs when callers provide the key. Also update the corresponding documentation
entry in js-pr-validation.md to describe that the key is consumed by the API
report action.
- Around line 315-318: Add the optional reusable-workflow input
socket_app_poll_interval with a default of 15, pass it through to the
socket-app-gate action’s poll-interval-seconds setting, and document the new
caller input in docs/js-pr-validation.md near the existing Socket App
configuration.
- Around line 645-667: Update the “Gate - Fail on Socket findings” step to read
the workflow’s dry_run input and, when it is true, emit the computed FAILED
result with ::notice:: and skip the enforcement exit. Preserve the existing
error output and exit 1 behavior for non-dry-run executions, covering Firewall,
App Gate, and API blocking findings.
- Around line 10-19: Remove the has_breaking_changes output from the
workflow_call outputs in js-pr-validation.yml and remove its corresponding
documentation entry in docs/js-pr-validation.md. Leave breaking_change_approved
and breaking_change_result unchanged unless a verified caller requires the
removed output.

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@src/security/socket-api-report/action.yml`:
- Around line 416-418: Validate obj in the diff-scan extraction flow before
reading its fields, and require both the selected diff_scan and its artifacts
value to be mappings before reading buckets or setting has_baseline. Treat
invalid or non-object payloads as unattributed or skipped, preserving blocking
classification rather than accepting fallback {} as a valid baseline; apply the
same mapping guard around obj in the shown extraction logic.

In `@src/security/socket-reporter/action.yml`:
- Around line 116-120: Update the cell formatter in the action’s
report-rendering logic to escape Markdown link and HTML delimiters by handling
[, ], <, and > in addition to the existing pipe, backslash, backtick, and
newline escaping. Ensure all report-controlled values, including f.fix rendered
at the remediation output, pass through this updated cell function.

---

Outside diff comments:
In @.github/workflows/js-pr-validation.yml:
- Around line 572-585: Update the conditions for the Socket App Gate step and
the related Socket steps around the symbols at lines 592-610 and 612-628 to
require !inputs.dry_run in addition to their existing predicates. Ensure dry
runs skip all Socket polling, comment-reading, and socket-api-report activity,
while preserving the verbose preview-only output at lines 671-681.

In `@src/security/socket-api-report/action.yml`:
- Around line 197-202: Update the request logic surrounding opener.open and
r.read to enforce a monotonic total deadline rather than relying only on the
180-second idle timeout. Track the deadline across connection and response
reads, abort when it expires, and return the established response shape with
skipped=true; preserve HTTPError handling and existing response data for
requests completed before the deadline.

In `@src/security/socket-firewall/action.yml`:
- Around line 92-106: Add the dry-run guard to the `if` conditions for both `Set
up pnpm` and `Setup Node.js`, requiring `inputs.dry-run != 'true'` alongside the
existing conditions. Ensure neither toolchain setup action runs in dry-run mode
while preserving their current behavior otherwise.

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@src/security/socket-api-report/action.yml`:
- Around line 483-503: Harden buckets_of and the attribution loop to validate
diff_scan is a mapping, each selected added/updated/replaced/removed bucket is a
list, and every artifact entry is a mapping before accessing fields or setting
has_baseline. Treat any invalid structure as no attribution, using the existing
warning path, while preserving skipped and classified count emission instead of
allowing exceptions to terminate the process.

In `@src/security/socket-app-gate/action.yml`:
- Around line 104-114: Update the polling loop around the stable-set branch to
validate DEADLINE immediately after reading each snapshot and before evaluating
TOTAL, PENDING, or SIG stability. Ensure expiration exits with the existing
timeout behavior, preventing confirmation sleeps or continuously changing
completed snapshots from bypassing timeout-seconds.

In `@src/setup/setup-node-guarded/action.yml`:
- Around line 43-45: Update the Outputs table in the setup-node-guarded README
to document the public skipped output from the action metadata, stating that it
is true when the guarded path finds no lockfile and false for the unguarded
path.