chore(deps): bump SocketDev/socket-basics to v3.1.0

Merged
WI
2mo ago
+1-1

Bumps the pinned Socket Basics digest from 6b71cdf (v3.0.0) to 5b615c8 (v3.1.0).

Why now

v3.1.0 shipped 2026-09-03. It is a minor, backwards-compatible release, but two of its fixes bear directly on how this workflow invokes the action:

  • #105 — changed_files resolved to zero files inside the Docker container action due to a git dubious-ownership error.
  • #98 — changed_files was not honored from every config source, and failed silently when it wasn't.

Both bugs can cause a scan to quietly cover nothing while still reporting success. Because this workflow runs continue-on-error: true and is informational-only, a silent no-op scan would be invisible here. That makes this a correctness fix for PR-scoped scanning, not just a version refresh.

Also included upstream: pr_comment_enabled / pr_comment_collapse_all PR-comment controls (#97) — not adopted in this PR, no input changes.

Full upstream diff: https://github.com/SocketDev/socket-basics/compare/v3.0.0...v3.1.0

Verification

  • Digest 5b615c89d17764ab46de2f2de63122ca2ef6a4be confirmed via the GitHub API to be the chore(release): 3.1.0 commit carrying the v3.1.0 tag in SocketDev/socket-basics.
  • No breaking changes in the release notes; no action inputs added, removed, or renamed, so the with: block is unchanged.
  • Workflow YAML re-parsed clean.

Scope

One line. No change to triggers, permissions, the fork-PR guard, or the audit-logging step.