ci: route release publish install through Socket Firewall

[peakematt]

This repository installs public npm packages in three GitHub Actions paths: ordinary CI, the package release workflow, and the scheduled Socket reachability scan. Before this change, the CI install was still unscreened, and the release workflow only covered the package install itself.

This change routes those dependency downloads through the WorkOS Socket Firewall. CI now runs with read-only contents permission, checks out without persisted credentials, and enables the action's validated external-fork fallback only for the ordinary public pull_request path. Same-repository pull requests and main pushes still fail closed when the public firewall token is unavailable.

The release workflow now configures the firewall before the pnpm manager setup, configures it again after actions/setup-node writes the npm registry setting, and tears it down immediately after pnpm install. The build and publish commands stay the same, including public access, trusted publishing provenance, latest/next tagging, and prerelease routing.

The scheduled Socket analysis still uses its separate Socket API token. Its npm CLI install is screened by the firewall, then the public registry is restored before the scan uploads manifests to Socket.

Verify by checking .github/workflows/ci.yml, .github/workflows/release.yml, and .github/workflows/socket-tier1-analysis.yml, then run actionlint .github/workflows/*.yml.

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.

[greptile-apps]

Confidence Score: 5/5

The PR appears safe to merge, with the previously reported unscreened reachability downloads now covered by the firewall.

Summary

• CI gains read-only repository permissions, non-persisted checkout credentials, and external-fork fallback for public pull requests.
• Release setup screens both the pnpm bootstrap and dependency installation, then restores the public registry before build and publish.
• Scheduled reachability analysis keeps the firewall active through the scan and restores the registry afterward, resolving the previous finding.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[Checkout] --> B[Configure Socket Firewall]
    B --> C[Install package manager or Socket CLI]
    C --> D[Configure firewall again when setup-node rewrites registry]
    D --> E[Install or analyze dependencies]
    E --> F[Restore public npm registry]
    F --> G[Build and publish or finish scan]

Loading

_{Reviews (2) · Last reviewed commit: "ci: keep Socket Firewall active during r..."}