ci: protect dependency installs with Socket Firewall

[peakematt]

Dependency installs in the public pull request, push, scheduled Socket scan, and release paths currently run directly against the public JavaScript registry. This change routes those installs through Socket Firewall with the pinned setup action and keeps external fork pull requests low privilege with fallback enabled only for the ordinary lint and test jobs.

The release workflow keeps its current reusable workflow call and secrets: inherit behavior. It tears down Socket Firewall after release-build dependency installation and after the local npm distribution smoke so artifact upload, npm trusted publishing, and Homebrew publishing keep their existing network and credential behavior. The test job also restores public registry access before the existing Bun binary build, because Bun downloads the compile runtime outside npm-compatible package manager configuration, then re-enables Socket Firewall for the local npm distribution smoke.

The normal bun install, npm install -g socket, npx workos, npm install -g workos, and publish commands are otherwise unchanged. I verified the workflow YAML parses, actionlint accepts the changed workflows, and the Socket Firewall conformance helper only reports expected heuristic warnings for the unchanged local registry smoke and publish steps. Pull request checks cover the Linux lint and test jobs.

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.

[greptile-apps]

Confidence Score: 5/5

The PR appears safe to merge, with firewall setup and teardown placed consistently around the dependency-install operations it intends to protect.

Summary

• Adds low-privilege external-fork fallback to ordinary lint and test jobs.
• Tears down firewall routing before Bun compilation and release publishing operations.
• Re-enables firewall protection for local npm distribution smoke tests.
• Restricts applicable workflow GITHUB_TOKEN permissions to read-only repository contents.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[Checkout source] --> B[Setup Socket Firewall]
    B --> C[Install dependencies]
    C --> D{Workflow path}
    D -->|Lint or scan| E[Run protected checks]
    D -->|Test or release build| F[Teardown firewall]
    F --> G[Test and compile binaries]
    G --> H[Setup firewall again]
    H --> I[Local npm distribution smoke]
    I --> J[Teardown in release workflow]
    J --> K[Publish artifacts and packages]

Loading