* ci: use GitHub API to produce verified commits in socket-fix workflow
Replace git commit/push with the GitHub Git Data API (blobs, trees,
commits) so the resulting PR commit is signed and verified by GitHub,
matching the approach used in update-dep.yml.
* ci: disable socket fix CI mode to prevent auto-PR creation
* ci: address code review feedback on open-pr step
- Add set -eEo pipefail / shopt -s inherit_errexit
- Use git status --porcelain to catch new and deleted files
- Read file mode from git index instead of hardcoding 100644
- Use base64 -w 0 to avoid line-wrap corruption
- Handle existing branch on workflow rerun
- Handle existing PR on workflow rerun
- Support comma-separated issue_link for multiple GHSAs
- Include WDP/Leo PR links in body when refs are provided
* ci: address second round of code review feedback
- Fetch HEAD_SHA from master ref via API to guard against workflow
dispatch on a non-master ref
- Switch to git status --porcelain=v1 -z (NUL-delimited) to handle
filenames with spaces and rename/copy entries correctly
- Use @<(...) process substitution for blob content to avoid hitting
shell argument length limits on large files like package-lock.json
* ci: fix gh pr create missing --head and rename tree deletion
- Add --head "$BRANCH" to gh pr create so the PR is opened from the
API-created branch rather than the currently checked-out branch
- Emit a null-sha tree entry for the source path of rename operations
so the old path is removed from the resulting commit
Kyle Den Hartog
52b04a59b6