ci: protect npm installs with Socket Firewall

[peakematt]

authkit-js downloads public npm packages in normal continuous integration, its reusable release workflow, and its scheduled Socket analysis workflow. Those downloads currently bypass the WorkOS Socket Firewall, while the release must still publish directly to npm.

This change protects each download with action-only release ca93dd8aa351f54f4729fe3377a9be23c631c25d. The selected-repository PUBLIC_SOCKET_FIREWALL_TOKEN secret is passed only to the setup action. Public fork pull requests can use the validated public-registry fallback, while same-repository and default-branch jobs remain fail-closed. Fork-reachable permissions are read-only and checkout credentials are no longer persisted.

The reusable release workflow receives only the named firewall secret. It installs through Socket Firewall after setup-node, then invokes teardown at the same release SHA before building or publishing. The scheduled Socket CLI install uses the same setup/install/teardown boundary. Existing test, build, trusted-publishing, release-selection, and reachability-analysis behavior is unchanged. The pull_request_target title-lint workflow does not execute contributor-controlled code and remains outside the install path.

Verify the workflow structure with:

go run github.com/rhysd/actionlint/cmd/actionlint@v1.7.10 .github/workflows/*.yml

The rollout classifier reports all three npm download jobs as protected with no ordering, release-reference, token, publication, or trust violations. The earlier public pilot provides external-fork and publication-boundary evidence for this shared workflow shape. No real package publication is performed by this change.

[linear-code]

HELP-725

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.

[greptile-apps]

Greptile Summary

This PR places Socket Firewall setup and teardown boundaries around every npm dependency download in CI, release, and scheduled Socket analysis workflows while preserving direct npm publication.

• Restricts workflow permissions and prevents checkout credentials from persisting.
• Allows public-fork CI to use the configured fallback while trusted jobs remain secret-backed.
• Passes the named firewall secret into the reusable release workflow.
• Removes firewall credentials before executing project source, analysis, or publication steps.

Confidence Score: 5/5

The PR appears safe to merge, with no concrete changed-code failure established.

The workflow callers, secret forwarding, permission intersection, install ordering, teardown placement, and direct npm publication boundary are internally consistent, and no actionable defect remains.

Important Files Changed

Filename	Overview
.github/workflows/ci.yml	Adds read-only permissions, disables persisted checkout credentials, and wraps npm ci with firewall setup and teardown while supporting external-fork fallback.
.github/workflows/release-please.yml	Explicitly forwards the named Socket Firewall secret to the reusable release workflow.
.github/workflows/release.yml	Declares the reusable-workflow secret contract and protects dependency installation before restoring the public publication boundary.
.github/workflows/socket-tier1-analysis.yml	Restricts permissions and wraps the global Socket CLI installation with firewall setup and teardown.

Sequence Diagram

sequenceDiagram
  participant Job as GitHub Actions job
  participant Setup as Socket Firewall setup
  participant NPM as npm
  participant Teardown as Firewall teardown
  participant Work as Build, test, analysis, or publish
  Job->>Setup: Configure firewall with named secret
  Setup-->>Job: Protect package downloads
  Job->>NPM: npm ci / npm install
  NPM-->>Job: Dependencies installed
  Job->>Teardown: Remove firewall credentials
  Teardown-->>Job: Restore post-install environment
  Job->>Work: Execute project or publication step

Loading

_{Reviews (1): Last reviewed commit: "ci: protect npm installs with Socket Fir..." | Re-trigger Greptile}