ci: add centralized vuln remediation workflow

[ulziibay-kernel]

Thin caller to the reusable 3-stage pipeline (triage → fix → PR) in kernel/security-workflows.

Made with Cursor

---

Note

Low Risk
Low risk: adds a scheduled/manual GitHub Actions workflow plus a simple socket.yml version file, without changing application/runtime logic.

Overview
Adds a new GitHub Actions workflow (.github/workflows/vuln-remediation.yml) that runs on a weekly cron and via manual dispatch to invoke the centralized kernel/security-workflows vulnerability remediation pipeline, with permissions to create PRs and write contents.

Introduces socket.yml with version: 2 to enable Socket security tooling configuration.

^{Reviewed by Cursor Bugbot for commit a3a7c5a. Bugbot is set up for automated code reviews on this repo. Configure here.}

[firetiger-agent]

Firetiger deploy monitoring skipped

This PR didn't match the auto-monitor filter configured on your GitHub connection:

Any PR that changes the kernel API. Monitor changes to API endpoints (packages/api/cmd/api/) and Temporal workflows (packages/api/lib/temporal) in the kernel repo

Reason: PR modifies CI/vulnerability workflow configuration, not kernel API endpoints or Temporal workflows.

To monitor this PR anyway, reply with @firetiger monitor this.

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit a3a7c5a. Configure here.}

[cursor]

Wrong package manager configured in remediation workflow

High Severity

The setup-bun: true input is passed to the reusable workflow, but this project uses pnpm as its package manager everywhere — package.json declares "packageManager": "pnpm@10.30.1", all CI jobs in ci.yml set up pnpm via pnpm/action-setup@v4, and the repo contains a pnpm-lock.yaml. The remediation workflow will likely install dependencies with the wrong tool, producing incorrect fixes or failing entirely.

 

^{Reviewed by Cursor Bugbot for commit a3a7c5a. Configure here.}