ci: route publish dependency installs through Socket Firewall

[peakematt]

The release workflow and regular CI both download public npm packages before code runs or publishes. This change routes those public package downloads through WorkOS Socket Firewall, including the pnpm/action-setup bootstrap and the project pnpm install steps.

CI remains safe for external fork pull requests: workflow permissions are read-only, checkout does not persist credentials, and Socket Firewall enables the validated external-fork fallback only in those ordinary pull_request jobs. The same jobs stay fail-closed when the public token is available on trusted push, same-repository pull request, or Dependabot runs. The title-check pull_request_target workflow still does not checkout or execute repository code.

The release publish job stays fail-closed with no fork fallback. Socket Firewall now starts before pnpm setup and actions/setup-node, then teardown restores the public registry immediately after the last dependency download and before the local build and pnpm publish. Release Please, tag selection, public access, provenance, OpenID Connect, and the publish commands are unchanged.

Manual verification: read the workflow order in .github/workflows/ci.yml and .github/workflows/release.yml, then check the latest pull request checks. CI and Lint PR Title pass on the current head. The release workflow is still main-only and was not manually dispatched.

[devin-ai-integration]

Devin Review found 1 potential issue.

[greptile-apps]

Confidence Score: 5/5

The PR appears safe to merge with no actionable new issues identified.

Summary

• CI configures the firewall before pnpm bootstrap and dependency installation, with external-fork fallback enabled.
• Release configures the firewall after Node setup, installs dependencies, and restores the public registry before building and publishing.
• Both workflows pin the firewall setup and teardown actions to a commit SHA.

Diagram

sequenceDiagram
  participant GH as GitHub Actions
  participant Node as setup-node
  participant FW as Socket Firewall
  participant pnpm
  participant npm as Public npm Registry

  GH->>Node: Configure Node and public registry
  GH->>FW: Configure firewall registry
  GH->>pnpm: Bootstrap pnpm
  pnpm->>FW: Install dependencies
  GH->>FW: Restore public registry
  GH->>pnpm: Build project
  pnpm->>npm: Publish with provenance

Loading

_{Reviews (3) · Last reviewed commit: "ci: use one Socket Firewall setup in rel..."}