fix(security): socket.yml deferTo block was a silent no-op — bind only what a repo file can (Refs ops-3pdm) - #337

Approve — delta review (round 2)

githubApp binding (finding 1)

All githubApp fields bind from repo-level socket.yml. Verified via readSocketConfig() parse and Socket docs. This is not documentation-only — the file actively controls which Socket GitHub App surfaces run on the repo.

Header comment (finding 2)

Header is accurate and well-scoped. The deferTo warning is a good guardrail against regression. No overstatement in the header or the diff.

projectIgnorePaths scope change

Old file ignored node_modules, test, docs. New file ignores only node_modules. Socket will now ingest manifests in test/ and docs/ for cli. We verified in round 1 that no shipping manifests are hidden. The broader coverage is an improvement.

Minor: projectIgnorePaths [node_modules] is redundant (already in Socket's default ignore list). Harmless.

APPROVE — this removes cli's no-op issueRules block and replaces it with a file that binds only what the schema binds.

The diff deletes the silently-dropped block:

-issueRules:
-  supplyChainRisk:
-    deferTo: error
-  vulnerabilities:
-    deferTo: error
-  quality:
-    deferTo: warn
-  anomalies:
-    deferTo: error

and adds githubApp flags (enabled, projectReportsEnabled, pullRequestAlertsEnabled, dependencyOverviewEnabled: true, ignoreUsers: []). These DO bind from a repo-level socket.yml per Socket's docs — githubApp.enabled ('add a socket.yml file to your repo and set enabled to false' to disable the app), pullRequestAlertsEnabled, projectReportsEnabled, dependencyOverviewEnabled, and ignoreUsers ('prevent Pull Request Alerts from running on Pull Requests that are opened by anyone specified'). ignoreUsers: [] binds as 'no user exempt'.

Header is accurate: it separates 'WHAT THIS FILE BINDS' from 'WHAT IT CANNOT BIND' (per-alert action), attributes action enforcement to the org Security Policy + branch ruleset (not this file), and correctly warns that deferTo: is silently dropped and issueRules only takes booleans. No overstatement.

Minor, non-blocking: enabled: true and ignoreUsers: [] restate defaults, but that's the point of pinning them explicitly.