From f3053783137842fbef6c5d8ee9c7372322d79e2c Mon Sep 17 00:00:00 2001
From: Matt Peake <matt.peake@workos.com>
Date: Tue, 8 Sep 2026 09:24:00 -0400
Subject: [PATCH 1/2] ci: route release publish install through Socket Firewall

Wrap the reusable publish workflow's dependency install with the pinned workos/setup-socket-firewall setup and teardown pair so release-time installs are guarded against malicious packages. Teardown restores public npm registry access before build and publish, so no dependency download happens after it. The reusable workflow declares only the PUBLIC_SOCKET_FIREWALL_TOKEN secret and release-please passes it explicitly instead of inheriting all secrets. Publish command, npm registry, and OIDC provenance semantics are unchanged.
---
 .github/workflows/release-please.yml |  2 ++
 .github/workflows/release.yml        | 20 ++++++++++++++++++++
 2 files changed, 22 insertions(+)

diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml
index 92b5d72..68da855 100644
--- a/.github/workflows/release-please.yml
+++ b/.github/workflows/release-please.yml
@@ -34,3 +34,5 @@ jobs:
     needs: release-please
     if: ${{ needs.release-please.outputs.release_created == 'true' }}
     uses: ./.github/workflows/release.yml
+    secrets:
+      PUBLIC_SOCKET_FIREWALL_TOKEN: ${{ secrets.PUBLIC_SOCKET_FIREWALL_TOKEN }}
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 3e47e34..31f5f90 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -3,6 +3,13 @@ name: Release
 on:
   workflow_dispatch:
   workflow_call:
+    secrets:
+      PUBLIC_SOCKET_FIREWALL_TOKEN:
+        description: >-
+          Socket Firewall auth token used to route dependency installs through
+          the WorkOS Socket Firewall. The caller passes
+          secrets.PUBLIC_SOCKET_FIREWALL_TOKEN explicitly.
+        required: true
 
 defaults:
   run:
@@ -26,10 +33,23 @@ jobs:
           registry-url: 'https://registry.npmjs.org'
           cache: 'pnpm'
 
+      # Route dependency downloads through Socket Firewall. setup-node above has
+      # already written the npm registry auth placeholder, so this must run
+      # after it and stay active through every dependency download below.
+      - name: Enable Socket Firewall
+        uses: workos/setup-socket-firewall@ca93dd8aa351f54f4729fe3377a9be23c631c25d # v1
+        with:
+          token: ${{ secrets.PUBLIC_SOCKET_FIREWALL_TOKEN }}
+
       - name: Install Dependencies
         run: |
           pnpm install
 
+      # Restore public npm registry access before build and publish. No
+      # dependency download may occur after this step.
+      - name: Disable Socket Firewall
+        uses: workos/setup-socket-firewall/teardown@ca93dd8aa351f54f4729fe3377a9be23c631c25d # v1
+
       - name: Build project
         run: |
           pnpm run build

From 7e6fbce3e2d46e8bcb20332f6a7d7f8e67e8b835 Mon Sep 17 00:00:00 2001
From: Matt Peake <matt.peake@workos.com>
Date: Tue, 8 Sep 2026 16:40:43 -0400
Subject: [PATCH 2/2] ci: extend Socket Firewall coverage to CI

---
 .github/workflows/ci.yml      | 12 ++++++++++++
 .github/workflows/release.yml | 16 ++++++++++++----
 2 files changed, 24 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index eeedd8e..03a5e12 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -6,6 +6,9 @@ on:
       - 'main'
   pull_request: {}
 
+permissions:
+  contents: read
+
 defaults:
   run:
     shell: bash
@@ -19,6 +22,15 @@ jobs:
         node: [20, 22, 24]
     steps:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        with:
+          persist-credentials: false
+
+      - name: Enable Socket Firewall
+        uses: workos/setup-socket-firewall@ca93dd8aa351f54f4729fe3377a9be23c631c25d # v1
+        with:
+          token: ${{ secrets.PUBLIC_SOCKET_FIREWALL_TOKEN }}
+          allow-external-fork-fallback: true
+
       - uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4
         with:
           version: 10
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 31f5f90..796cd97 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -24,6 +24,15 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+
+      # Activate now so the pnpm manager bootstrap is also routed through
+      # Socket Firewall. setup-node below may rewrite npmrc for publishing, so
+      # the registry config is refreshed again before the project install.
+      - name: Enable Socket Firewall
+        uses: workos/setup-socket-firewall@ca93dd8aa351f54f4729fe3377a9be23c631c25d # v1
+        with:
+          token: ${{ secrets.PUBLIC_SOCKET_FIREWALL_TOKEN }}
+
       - uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4
         with:
           version: 10
@@ -33,10 +42,9 @@ jobs:
           registry-url: 'https://registry.npmjs.org'
           cache: 'pnpm'
 
-      # Route dependency downloads through Socket Firewall. setup-node above has
-      # already written the npm registry auth placeholder, so this must run
-      # after it and stay active through every dependency download below.
-      - name: Enable Socket Firewall
+      # Re-apply after setup-node writes the npm registry auth placeholder,
+      # then keep Socket Firewall active through the project install below.
+      - name: Refresh Socket Firewall registry
         uses: workos/setup-socket-firewall@ca93dd8aa351f54f4729fe3377a9be23c631c25d # v1
         with:
           token: ${{ secrets.PUBLIC_SOCKET_FIREWALL_TOKEN }}