From 21dc638974e14944352694e596cd964fea479794 Mon Sep 17 00:00:00 2001
From: tps-flint <flint@tps.dev>
Date: Wed, 2 Sep 2026 05:25:35 -0700
Subject: [PATCH] =?UTF-8?q?fix(security):=20socket.yml=20issueRules=20defe?=
 =?UTF-8?q?rTo=20block=20was=20a=20silent=20no-op=20=E2=80=94=20bind=20onl?=
 =?UTF-8?q?y=20what=20a=20repo=20file=20can=20(Refs=20ops-3pdm)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 socket.yml | 31 +++++++++++++++++++------------
 1 file changed, 19 insertions(+), 12 deletions(-)

diff --git a/socket.yml b/socket.yml
index 9f48f29..17eb040 100644
--- a/socket.yml
+++ b/socket.yml
@@ -1,14 +1,21 @@
+# Socket.dev repo config (socket.yml v2; schema = @socketsecurity/config 3.0.1).
+#
+# WHAT THIS FILE BINDS: which Socket GitHub App surfaces run on this repo (the
+# "Socket Security: Pull Request Alerts" and "Project Report" checks, the PR
+# dependency table), the paths Socket ignores, and that no user is exempt.
+#
+# WHAT IT CANNOT BIND: the ACTION per alert type (block / warn / monitor / ignore).
+# That lives in the org Security Policy in the Socket dashboard, scoped by repo
+# label, and is enforced here by the branch ruleset requiring the
+# "Socket Security: Pull Request Alerts" check. A `deferTo:` block in this file is
+# SILENTLY DROPPED by the parser (verified 2026-09-02 with readSocketConfig, ops-3pdm)
+# — do not add one. `issueRules` here only takes booleans keyed by alert type.
 version: 2
 projectIgnorePaths:
-  - "node_modules"
-  - "test"
-  - "docs"
-issueRules:
-  supplyChainRisk:
-    deferTo: error
-  vulnerabilities:
-    deferTo: error
-  quality:
-    deferTo: warn
-  anomalies:
-    deferTo: error
+  - node_modules
+githubApp:
+  enabled: true
+  projectReportsEnabled: true
+  pullRequestAlertsEnabled: true
+  dependencyOverviewEnabled: true
+  ignoreUsers: []