Route CI dependency installs through Socket Firewall

[peakematt]

The continuous integration job installs npm dependencies straight from the public registry with npm ci, which leaves the install open to a compromised or typosquatted package reaching the runner unchecked. This change routes those downloads through the WorkOS Socket Firewall so packages are inspected before they are installed.

The firewall step is placed between actions/setup-node and npm ci, the point where Node is ready but nothing has been fetched yet. It authenticates with the PUBLIC_SOCKET_FIREWALL_TOKEN secret. Because this repository is public, it also enables allow-external-fork-fallback so pull requests from forks, which never receive secrets, can still run their checks against the public registry. Runs on main, dependency-update branches, and same-repo pull requests keep the firewall fully active because the token is present for them, and the action only permits the public fallback for a genuine external-fork pull request, so protection is never silently dropped on a trusted run. The actions/checkout step no longer persists the Git credential, since this job only needs to read the code.

To verify, open the pull request's checks and confirm the Socket Firewall step reports active before npm ci, with install, lint, format, and type-check all passing. The dependency set, lockfile, and build commands are unchanged, so a green run means the firewall stays transparent to the existing checks.

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.

[greptile-apps]

Confidence Score: 5/5

The workflow change appears safe to merge, with no concrete correctness, security, or repository-rule violations identified.

Summary

• Pins the Socket Firewall action to a commit SHA.
• Authenticates trusted runs using PUBLIC_SOCKET_FIREWALL_TOKEN.
• Allows fallback for external-fork pull requests without access to secrets.
• Leaves the existing install, lint, format, and type-check commands unchanged.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart LR
    A[Checkout without persisted credentials] --> B[Set up Node.js and npm cache]
    B --> C[Configure Socket Firewall]
    C --> D[npm ci]
    D --> E[Lint]
    E --> F[Format check]
    F --> G[Type check]

Loading