ci: route npm dependency downloads through Socket Firewall

[peakematt]

CI and release jobs install npm dependencies straight from the public registry, so a compromised or typosquatted package could execute inside a job that holds publish access. This change routes those dependency downloads through the WorkOS Socket Firewall, screening the traffic before it reaches a runner, while leaving the published package, its provenance, and release timing unchanged.

Every job that runs npm install now configures workos/setup-socket-firewall immediately after actions/setup-node and before the first download, pinned to the reviewed v1 commit. The firewall points npm at socket-firewall.workos.dev and null-routes the public registry hosts for the rest of the job, so a package the firewall rejects never lands. The CI jobs also run on pull requests from forks, which cannot read organization secrets, so they set allow-external-fork-fallback: true. The action only honors that fallback for a genuine external-fork pull request into this public repository and still fails closed for trusted, same-repository, and Dependabot runs. Those jobs drop to contents: read and check out without persisted credentials to match the low-privilege contract the fallback requires.

The publish path needs the firewall while it installs and builds, then needs the public registry back before it publishes. release.yml keeps Socket Firewall active through npm install and the offline tsc build, runs the matching teardown at the same commit to restore registry.npmjs.org, and only then runs npm publish. Because the build compiles offline and publish downloads nothing, no dependency fetch happens after teardown. Trusted publishing through OpenID Connect and --provenance is untouched. The reusable release.yml declares a single named secret and release-please.yml passes it explicitly instead of inheriting every secret.

To verify, read release.yml: Configure Socket Firewall sits after Setup Node, and Restore public package registry sits after the build and before Publish. actionlint passes on all three workflows.

One operational requirement follows from this: Dependabot npm jobs install through the firewall too, so PUBLIC_SOCKET_FIREWALL_TOKEN must be present in both the Actions and the Dependabot secret stores, otherwise those runs fail closed by design.

[devin-ai-integration]

Devin Review found 1 potential issue.

[devin-ai-integration]

🔍 Protection boundary needs clarification

The description says the firewall covers npm run build, but teardown now precedes it. Clarify which protection boundary reviewers are approving.

---

Was this helpful? React with 👍 or 👎 to provide feedback.

[greptile-apps]

Confidence Score: 5/5

The PR appears safe to merge, with no outstanding correctness, security, or repository-rule issues.

Summary

• Adds pinned Socket Firewall setup to all CI jobs before dependency installation.
• Restricts CI permissions and disables persisted checkout credentials.
• Explicitly passes the firewall token into the reusable release workflow.
• Keeps the firewall active through the offline build, then restores the public registry before publishing.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart LR
    A[Checkout without persisted credentials] --> B[Setup Node]
    B --> C[Configure Socket Firewall]
    C --> D[npm install]
    D --> E[Offline build]
    E --> F[Restore public npm registry]
    F --> G[npm publish with provenance]

Loading

_{Reviews (2) · Last reviewed commit: "Keep Socket Firewall active through rele..."}