From f696fce453db9fd35fc8647e19127cb22c4ceba6 Mon Sep 17 00:00:00 2001 From: Martin Torp Date: Mon, 10 Aug 2026 08:52:13 +0200 Subject: [PATCH] fix(ci): point workflows at the org-level SOCKET_API_TOKEN_FOR_CLI_AND_SFW secret The repo-level SOCKET_API_TOKEN and SOCKET_API_KEY secrets were removed when these moved to the organization level, where the token is now named SOCKET_API_TOKEN_FOR_CLI_AND_SFW. Both old names resolved to an empty string, which failed the e2e suite outright and silently downgraded every CI job from sfw-enterprise to sfw-free. SOCKET_RELEASE_APP_PRIVATE_KEY and SOCKET_RELEASE_CLIENT_ID kept their names at the org level, so those references are left alone. --- .github/workflows/ci.yml | 6 +++--- .github/workflows/e2e-tests.yml | 4 ++-- .github/workflows/npm-publish.yml | 2 +- 3 files changed, 6 insertions(+), 6 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index dd64727cb..45c866d95 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -117,7 +117,7 @@ jobs: shell: bash env: GH_TOKEN: ${{ github.token }} - SOCKET_API_KEY: ${{ secrets.SOCKET_API_KEY }} # zizmor: ignore[secrets-outside-env] + SOCKET_API_KEY: ${{ secrets.SOCKET_API_TOKEN_FOR_CLI_AND_SFW }} # zizmor: ignore[secrets-outside-env] run: | # zizmor: ignore[github-env] # Pinned version + per-platform checksum pairs. Bumping a tool # requires updating the matching version AND every platform's @@ -293,7 +293,7 @@ jobs: shell: bash env: GH_TOKEN: ${{ github.token }} - SOCKET_API_KEY: ${{ secrets.SOCKET_API_KEY }} # zizmor: ignore[secrets-outside-env] + SOCKET_API_KEY: ${{ secrets.SOCKET_API_TOKEN_FOR_CLI_AND_SFW }} # zizmor: ignore[secrets-outside-env] run: | # zizmor: ignore[github-env] # Pinned version + per-platform checksum pairs. Bumping a tool # requires updating the matching version AND every platform's @@ -475,7 +475,7 @@ jobs: shell: bash env: GH_TOKEN: ${{ github.token }} - SOCKET_API_KEY: ${{ secrets.SOCKET_API_KEY }} # zizmor: ignore[secrets-outside-env] + SOCKET_API_KEY: ${{ secrets.SOCKET_API_TOKEN_FOR_CLI_AND_SFW }} # zizmor: ignore[secrets-outside-env] run: | # zizmor: ignore[github-env] # Pinned version + per-platform checksum pairs. Bumping a tool # requires updating the matching version AND every platform's diff --git a/.github/workflows/e2e-tests.yml b/.github/workflows/e2e-tests.yml index ddf8a611c..6015be6a6 100644 --- a/.github/workflows/e2e-tests.yml +++ b/.github/workflows/e2e-tests.yml @@ -162,7 +162,7 @@ jobs: - name: Probe tier1 legacy_mode (DIAGNOSTIC - REMOVE AFTER USE) if: matrix.node-version == 22 env: - SOCKET_CLI_API_TOKEN: ${{ secrets.SOCKET_API_TOKEN }} # zizmor: ignore[secrets-outside-env] + SOCKET_CLI_API_TOKEN: ${{ secrets.SOCKET_API_TOKEN_FOR_CLI_AND_SFW }} # zizmor: ignore[secrets-outside-env] run: | set -eu auth=$(printf '%s:' "$SOCKET_CLI_API_TOKEN" | base64 -w0) @@ -186,5 +186,5 @@ jobs: - name: Run e2e tests env: - SOCKET_CLI_API_TOKEN: ${{ secrets.SOCKET_API_TOKEN }} # zizmor: ignore[secrets-outside-env] + SOCKET_CLI_API_TOKEN: ${{ secrets.SOCKET_API_TOKEN_FOR_CLI_AND_SFW }} # zizmor: ignore[secrets-outside-env] run: pnpm run e2e-tests diff --git a/.github/workflows/npm-publish.yml b/.github/workflows/npm-publish.yml index bd418d577..d7ecf9b4e 100644 --- a/.github/workflows/npm-publish.yml +++ b/.github/workflows/npm-publish.yml @@ -206,7 +206,7 @@ jobs: shell: bash env: GH_TOKEN: ${{ github.token }} - SOCKET_API_KEY: ${{ secrets.SOCKET_API_KEY }} # zizmor: ignore[secrets-outside-env] + SOCKET_API_KEY: ${{ secrets.SOCKET_API_TOKEN_FOR_CLI_AND_SFW }} # zizmor: ignore[secrets-outside-env] run: | # zizmor: ignore[github-env] # Pinned version + per-platform checksum pairs. Bumping a tool # requires updating the matching version AND every platform's