* ci: use GitHub API to produce verified commits in socket-fix workflow
Replace git commit/push with the GitHub Git Data API (blobs, trees,
commits) so the resulting PR commit is signed and verified by GitHub,
matching the approach used in update-dep.yml.
* ci: disable socket fix CI mode to prevent auto-PR creation
* ci: address code review feedback on open-pr step
- Add set -eEo pipefail / shopt -s inherit_errexit
- Use git status --porcelain to catch new and deleted files
- Read file mode from git index instead of hardcoding 100644
- Use base64 -w 0 to avoid line-wrap corruption
- Handle existing branch on workflow rerun
- Handle existing PR on workflow rerun
- Support comma-separated issue_link for multiple GHSAs
- Include WDP/Leo PR links in body when refs are provided
* ci: address second round of code review feedback
- Fetch HEAD_SHA from master ref via API to guard against workflow
dispatch on a non-master ref
- Switch to git status --porcelain=v1 -z (NUL-delimited) to handle
filenames with spaces and rename/copy entries correctly
- Use @<(...) process substitution for blob content to avoid hitting
shell argument length limits on large files like package-lock.json
* ci: fix gh pr create missing --head and rename tree deletion
- Add --head "$BRANCH" to gh pr create so the PR is opened from the
API-created branch rather than the currently checked-out branch
- Emit a null-sha tree entry for the source path of rename operations
so the old path is removed from the resulting commit
Extends the brave-core socket-fix workflow to accept optional commit
hashes for web-discovery-project (DEPS) and @brave/leo (package.json).
When provided, the workflow updates these references before running
socket fix, enabling a single PR for both upstream hash bumps and
direct transitive dependency fixes. Also makes issue_link required
so brave-core PRs always close the tracking issue.
* ci: add Socket Fix workflow
Adds a workflow_dispatch CI workflow to apply socket fix for a given
set of GHSA IDs and open a pull request with the changes.
* ci: pin node to v24 major and add CI/skip label to generated PRs
* ci: use brave-builds user for consistency with other workflows
* ci: add security label and issue_link input to socket-fix workflow
Mihai PLESA