ci: route publish dependency installs through Socket Firewall

[peakematt]

The release workflow and regular CI both download public npm packages before code runs or publishes. This change routes those public package downloads through WorkOS Socket Firewall, including the pnpm/action-setup bootstrap and the project pnpm install steps.

CI remains safe for external fork pull requests: workflow permissions are read-only, checkout does not persist credentials, and Socket Firewall enables the validated external-fork fallback only in those ordinary pull_request jobs. The same jobs stay fail-closed when the public token is available on trusted push, same-repository pull request, or Dependabot runs. The title-check pull_request_target workflow still does not checkout or execute repository code.

The release publish job stays fail-closed with no fork fallback. Socket Firewall now starts before pnpm setup and actions/setup-node, then teardown restores the public registry immediately after the last dependency download and before the local build and pnpm publish. Release Please, tag selection, public access, provenance, OpenID Connect, and the publish commands are unchanged.

Manual verification: read the workflow order in .github/workflows/ci.yml and .github/workflows/release.yml, then check the latest pull request checks. CI and Lint PR Title pass on the current head. The release workflow is still main-only and was not manually dispatched.

[devin-ai-integration]

Devin Review found 1 potential issue.

[devin-ai-integration]

🔴 Release installs lose firewall authentication

In release jobs, setup-node replaces NPM_CONFIG_USERCONFIG after the firewall writes its token. pnpm install selects the firewall registry but reads credentials from the replacement file. The publish job fails on an unauthorized dependency download.

Prompt for agents

The publish job configures Socket Firewall before actions/setup-node. setup-node receives registry-url and then creates RUNNER_TEMP/.npmrc, exports NPM_CONFIG_USERCONFIG to that file, and adds only its npm registry placeholder. Socket Firewall configured the token in HOME/.npmrc because NPM_CONFIG_USERCONFIG did not exist yet. The later pnpm install retains PNPM_CONFIG_REGISTRY pointing at Socket Firewall but loads credentials from setup-node's temporary file, so the firewall token is unavailable. Reorder or repeat configuration so Socket Firewall writes authentication into the final NPM_CONFIG_USERCONFIG while still protecting the pnpm/action-setup bootstrap, then preserve the teardown before publication.

---

Was this helpful? React with 👍 or 👎 to provide feedback.

[greptile-apps]

Confidence Score: 5/5

The PR appears safe to merge; no actionable correctness, security, or repository-rule violations were established.

Summary

• Adds read-only repository permissions and disables persisted checkout credentials in CI.
• Configures external-fork fallback for ordinary pull-request CI jobs.
• Keeps release installation fail-closed by requiring the firewall token.
• Adds explicit firewall teardown after dependency installation.

Diagram

sequenceDiagram
  participant G as GitHub Runner
  participant F as Socket Firewall
  participant P as pnpm Setup
  participant N as Node Setup
  participant D as Dependency Install
  participant B as Build/Test/Publish
  G->>F: Configure firewall
  G->>P: Install pnpm
  G->>N: Configure Node
  G->>D: pnpm install
  G->>F: Restore public registry
  G->>B: Run local workflow steps

Loading