ci: route publish and Socket CLI installs through Socket Firewall (#15)

* ci: route publish and Socket CLI installs through Socket Firewall

Wrap public npm-compatible dependency downloads in the release publisher and
the nightly Socket CLI job with the pinned workos/setup-socket-firewall action,
then tear it down to restore public registry access before build, credentials,
and publication.

- release.yml: configure firewall after registry-mutating setup-node, keep it
  active across `pnpm install`, and tear down before build/publish. Declare the
  named public firewall secret on workflow_call.
- release-please.yml: pass PUBLIC_SOCKET_FIREWALL_TOKEN explicitly to the
  reusable publisher (no secrets: inherit).
- socket-tier1-analysis.yml: firewall the scheduled `npm install -g socket`
  with its own setup/teardown pair.

* ci: cover contribution installs with Socket Firewall

---------

Co-authored-by: Matt Peake <peakematt@users.noreply.github.com>

Author: peakematt

.github/workflows/ci.yml

@@ -6,6 +6,9 @@ on:
       - 'main'
   pull_request: {}
 
+permissions:
+  contents: read
+
 defaults:
   run:
     shell: bash
@@ -16,6 +19,15 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        with:
+          persist-credentials: false
+
+      - name: Configure Socket Firewall
+        uses: workos/setup-socket-firewall@ca93dd8aa351f54f4729fe3377a9be23c631c25d # v1
+        with:
+          token: ${{ secrets.PUBLIC_SOCKET_FIREWALL_TOKEN }}
+          allow-external-fork-fallback: true
+
       - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6
       - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
@@ -73,6 +85,15 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        with:
+          persist-credentials: false
+
+      - name: Configure Socket Firewall
+        uses: workos/setup-socket-firewall@ca93dd8aa351f54f4729fe3377a9be23c631c25d # v1
+        with:
+          token: ${{ secrets.PUBLIC_SOCKET_FIREWALL_TOKEN }}
+          allow-external-fork-fallback: true
+
       - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6
       - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:

.github/workflows/release-please.yml

@@ -31,3 +31,7 @@ jobs:
     needs: release-please
     if: ${{ needs.release-please.outputs.release_created == 'true' }}
     uses: ./.github/workflows/release.yml
+    # Pass the named public Socket Firewall secret explicitly. Never use
+    # secrets: inherit for a reusable workflow.
+    secrets:
+      PUBLIC_SOCKET_FIREWALL_TOKEN: ${{ secrets.PUBLIC_SOCKET_FIREWALL_TOKEN }}

.github/workflows/release.yml

@@ -3,6 +3,12 @@ name: Release
 on:
   workflow_dispatch:
   workflow_call:
+    secrets:
+      PUBLIC_SOCKET_FIREWALL_TOKEN:
+        description: >-
+          Socket Firewall auth token for public npm-compatible dependency
+          downloads. Callers must pass this secret explicitly; never inherit.
+        required: true
 
 defaults:
   run:
@@ -17,16 +23,39 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+
+      # Activate Socket Firewall before the pnpm manager action so that
+      # bootstrap is covered too. setup-node below writes registry config for
+      # npm publishing, so the firewall is configured again after setup-node.
+      - name: Configure Socket Firewall for pnpm manager
+        uses: workos/setup-socket-firewall@ca93dd8aa351f54f4729fe3377a9be23c631c25d # v1
+        with:
+          token: ${{ secrets.PUBLIC_SOCKET_FIREWALL_TOKEN }}
+
       - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6
       - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
         with:
           node-version: 24
           registry-url: 'https://registry.npmjs.org'
           cache: 'pnpm'
 
+      # Re-apply after the registry-mutating setup-node above and before the
+      # workspace dependency install. This keeps the firewall active through
+      # `pnpm install` while preserving setup-node's publish auth placeholder.
+      - name: Configure Socket Firewall for workspace install
+        uses: workos/setup-socket-firewall@ca93dd8aa351f54f4729fe3377a9be23c631c25d # v1
+        with:
+          token: ${{ secrets.PUBLIC_SOCKET_FIREWALL_TOKEN }}
+
       - name: Install Dependencies
         run: pnpm install
 
+      # Remove only SFW-owned npm/DNS configuration and restore public registry
+      # access before build, credentials, and publication. No dependency
+      # download occurs after this step (`pnpm run build` is offline tsc).
+      - name: Restore public package registry
+        uses: workos/setup-socket-firewall/teardown@ca93dd8aa351f54f4729fe3377a9be23c631c25d # v1
+
       - name: Build project
         run: pnpm run build
 

.github/workflows/socket-tier1-analysis.yml

@@ -32,10 +32,19 @@ jobs:
           echo "distinct_id: $DISTINCT_ID"
       - name: Checkout code
         uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+      # Route the Socket CLI global install through the WorkOS Socket Firewall.
+      - name: Configure Socket Firewall
+        uses: workos/setup-socket-firewall@ca93dd8aa351f54f4729fe3377a9be23c631c25d # v1
+        with:
+          token: ${{ secrets.PUBLIC_SOCKET_FIREWALL_TOKEN }}
       - name: Install Socket CLI
         # Pinned so a compromised release can't run arbitrary code next to
         # SOCKET_SECURITY_API_TOKEN; bump deliberately.
         run: npm install -g socket@1.1.145
+      # Restore public registry access before the scan runs; no dependency
+      # download occurs after this step.
+      - name: Restore public package registry
+        uses: workos/setup-socket-firewall/teardown@ca93dd8aa351f54f4729fe3377a9be23c631c25d # v1
       - name: Run Tier 1 reachability scan
         env:
           SOCKET_SECURITY_API_TOKEN: ${{ secrets.SOCKET_API_KEY }}