SocketDev · lelia · Mar 23, 2026 · Mar 23, 2026 · Mar 23, 2026 · Mar 23, 2026
@@ -4,9 +4,11 @@ on:
   push:
     branches: [main]
   pull_request:
+  workflow_dispatch:
 
 jobs:
   e2e-scan:
+    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871
@@ -48,6 +50,7 @@ jobs:
           fi
 
   e2e-sarif:
+    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871
@@ -87,6 +90,7 @@ jobs:
           "
 
   e2e-reachability:
+    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871

@@ -5,6 +5,7 @@ on:
 
 jobs:
   preview:
+    if: github.event.pull_request.head.repo.full_name == github.repository
     runs-on: ubuntu-latest
     permissions:
       id-token: write

@@ -50,3 +50,23 @@ jobs:
           uv sync --extra test
       - name: 🧪 run tests
         run: uv run pytest -q tests/unit/ tests/core/
+
+  unsupported-python-install:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871
+        with:
+          fetch-depth: 1
+          persist-credentials: false
+      - name: 🐍 setup python
+        uses: actions/setup-python@f677139bbe7f9c59b41e40162b753c062f5d49a3
+        with:
+          python-version: "3.10"
+      - name: 🚫 verify install is rejected on unsupported python
+        run: |
+          python -m pip install --upgrade pip
+          if pip install .; then
+            echo "Expected pip install . to fail on Python 3.10"
+            exit 1
+          fi
@@ -42,7 +42,7 @@ jobs:
 
       - name: Manage PR Comment
         uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea
-        if: always()
+        if: always() && github.event.pull_request.head.repo.full_name == github.repository
         env:
           MAIN_VERSION: ${{ env.MAIN_VERSION }}
           PR_VERSION: ${{ env.PR_VERSION }}

@@ -6,8 +6,8 @@ build-backend = "hatchling.build"
 
 [project]
 name = "socketsecurity"
-version = "2.2.78"
-requires-python = ">= 3.10"
+version = "2.2.79"
+requires-python = ">= 3.11"
 license = {"file" = "LICENSE"}
 dependencies = [
     'requests',
@@ -166,4 +166,3 @@ include = ["socketsecurity", "LICENSE"]
 dev = [
     "pre-commit>=4.3.0",
 ]
-
@@ -1,3 +1,3 @@
 __author__ = 'socket.dev'
-__version__ = '2.2.78'
+__version__ = '2.2.79'
 USER_AGENT = f'SocketPythonCLI/{__version__}'
@@ -1,5 +1,7 @@
+from pathlib import Path
 import pytest
 from unittest.mock import patch
+import tomllib
 from socketsecurity.core.socket_config import SocketConfig
 from socketsecurity.config import CliConfig
 
@@ -162,3 +164,16 @@ def test_config_file_json_sets_defaults(self, tmp_path):
         assert config.sarif_scope == "full"
         assert config.sarif_grouping == "alert"
         assert config.sarif_reachability == "reachable"
+
+
+def test_pyproject_requires_python_matches_tomllib_usage():
+    pyproject = tomllib.loads(Path("pyproject.toml").read_text(encoding="utf-8"))
+    requires_python = pyproject["project"]["requires-python"]
+
+    assert requires_python.startswith(">=")
+
+    minimum_version = tuple(int(part) for part in requires_python.removeprefix(">=").split(".")[:2])
+    config_module = Path("socketsecurity/config.py").read_text(encoding="utf-8")
+
+    if "import tomllib" in config_module:
+        assert minimum_version >= (3, 11)