rUv 16a55f7a53 chore(security): document Socket.dev alert baseline + remove broken pages.yml workflow (#2340) ...

Two coupled changes from triaging the Socket alerts on the published
claude-flow@3.10.40 (https://socket.dev/npm/package/claude-flow/alerts/3.10.40)
and the persistent Deploy Pages CI failure.

1) docs/security/socket-baseline.md — comprehensive triage:

   - What's protected today (root overrides for protobufjs/uuid/+25 others,
     supply-chain-audit CI job in v3-ci.yml line 629 already enforces
     npm audit + lockfile integrity + allowlist + typosquat + publisher
     trust).
   - What's NOT cleanly fixable: npm overrides only apply to the root of
     the dep tree. When claude-flow is a consumer's dep, our overrides are
     ignored, so a clean install of claude-flow@3.10.40 still pulls in the
     vulnerable protobufjs/uuid cascade through @xenova/transformers (no
     patched upstream version exists yet). Documented with the actual
     CVE chain and three concrete paths forward, all tracked in #2339.
   - Inherent flags: 13 alert categories (network/filesystem/env-var/shell
     access, install scripts, native code, etc.) that describe normal
     CLI/agent behaviour, not bugs. Documented one-by-one with the
     justification for each.
   - False positives: explicitly triages Socket's "did you mean z-schema?"
     suggestion against our zod dep (which is the 10M-weekly-download
     canonical schema library, not a typosquat), plus the AI-heuristic
     categories that are weak signals.
   - Operational policy: when to add overrides, when to update this doc,
     when to revisit.

2) Remove .github/workflows/pages.yml:

   - The workflow has FAILED on every single run since first appearing
     2026-05-30 (10+ consecutive failures, including the f5a180423 merge
     from earlier today).
   - Root cause: GitHub Pages is not enrolled on this repo
     (gh api repos/ruvnet/ruflo/pages returns HTTP 404). The workflow's
     actions/configure-pages@v4 step fails with "Get Pages site failed.
     Please verify that the repository has Pages enabled".
   - Nothing has ever been deployed from this workflow, so removing it
     loses no functionality. If Pages is wanted later, the proper sequence
     is: enable Pages in repo Settings → Security and analysis → Pages,
     then re-add a workflow with the right enablement/source config.
   - Without this removal, any push to main that touches docs/** (which
     this PR does) re-triggers the same failure, polluting CI status and
     specifically violating the "all build actions must pass" intent
     stated for this work.

Refs ruvnet/ruflo#2339

2026-06-09 13:36:29 -04:00

..

socket-baseline.md

chore(security): document Socket.dev alert baseline + remove broken pages.yml workflow (#2340)

2026-06-09 13:36:29 -04:00