From bcd3151a92645dc08ea705e7acbf2e204fac6f0d Mon Sep 17 00:00:00 2001 From: Matt Peake Date: Tue, 8 Sep 2026 16:42:18 -0400 Subject: [PATCH 1/2] ci: protect dependency installs with Socket Firewall --- .github/workflows/lint.yml | 12 ++++++++++++ .github/workflows/release.yml | 18 ++++++++++++++++++ .github/workflows/socket-tier1-analysis.yml | 7 +++++++ .github/workflows/test.yml | 12 ++++++++++++ 4 files changed, 49 insertions(+) diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml index ae3106ca..f7b0c9eb 100644 --- a/.github/workflows/lint.yml +++ b/.github/workflows/lint.yml @@ -5,12 +5,24 @@ on: branches: [main] pull_request: +permissions: + contents: read + jobs: lint: name: Lint runs-on: ubuntu-latest steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # 7.0.1 + with: + persist-credentials: false + + - name: Setup Socket Firewall + uses: workos/setup-socket-firewall@ca93dd8aa351f54f4729fe3377a9be23c631c25d + with: + token: ${{ secrets.PUBLIC_SOCKET_FIREWALL_TOKEN }} + allow-external-fork-fallback: true + configure-bun: true - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # 2.2.0 with: diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 42332128..05d5cebb 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -58,6 +58,12 @@ jobs: with: ref: ${{ inputs.tag_name }} + - name: Setup Socket Firewall + uses: workos/setup-socket-firewall@ca93dd8aa351f54f4729fe3377a9be23c631c25d + with: + token: ${{ secrets.PUBLIC_SOCKET_FIREWALL_TOKEN }} + configure-bun: true + - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # 2.2.0 with: bun-version: 1.3.14 @@ -65,6 +71,9 @@ jobs: - name: Install all target-specific dependencies run: bun install --frozen-lockfile --os="*" --cpu="*" + - name: Teardown Socket Firewall + uses: workos/setup-socket-firewall/teardown@ca93dd8aa351f54f4729fe3377a9be23c631c25d + # prebuild regenerates the manifests with the same WORKOS_BUILD_TARGET, # so the pinned Agent SDK download metadata (version, URL, checksum) # matches the compile target. @@ -226,9 +235,18 @@ jobs: # registry and drive the real `npx workos` / `npm install -g workos` # flows (linux-x64 binary executes on this runner). A packaging # regression fails here instead of after touching npmjs.org. + - name: Setup Socket Firewall + uses: workos/setup-socket-firewall@ca93dd8aa351f54f4729fe3377a9be23c631c25d + with: + token: ${{ secrets.PUBLIC_SOCKET_FIREWALL_TOKEN }} + configure-bun: true + - name: Smoke test npm distribution against a local registry run: bun run ./scripts/npm-dist-smoke.ts + - name: Teardown Socket Firewall + uses: workos/setup-socket-firewall/teardown@ca93dd8aa351f54f4729fe3377a9be23c631c25d + - name: Determine npm tag id: npm-tag env: diff --git a/.github/workflows/socket-tier1-analysis.yml b/.github/workflows/socket-tier1-analysis.yml index 0fccfe0f..26adab8d 100644 --- a/.github/workflows/socket-tier1-analysis.yml +++ b/.github/workflows/socket-tier1-analysis.yml @@ -12,6 +12,9 @@ on: description: 'Required by the return-dispatch action' required: true +permissions: + contents: read + concurrency: group: ${{ github.workflow }}-${{ github.ref_name }} cancel-in-progress: true @@ -27,6 +30,10 @@ jobs: echo "distinct_id: ${{ github.event.inputs.distinct_id }}" - name: Checkout code uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # 7.0.1 + - name: Setup Socket Firewall + uses: workos/setup-socket-firewall@ca93dd8aa351f54f4729fe3377a9be23c631c25d + with: + token: ${{ secrets.PUBLIC_SOCKET_FIREWALL_TOKEN }} - name: Install Socket CLI run: npm install -g socket - name: Run Tier 1 reachability scan diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index 5940ec97..1d455a9e 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -5,12 +5,24 @@ on: branches: [main] pull_request: +permissions: + contents: read + jobs: test: name: Test runs-on: ubuntu-latest steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # 7.0.1 + with: + persist-credentials: false + + - name: Setup Socket Firewall + uses: workos/setup-socket-firewall@ca93dd8aa351f54f4729fe3377a9be23c631c25d + with: + token: ${{ secrets.PUBLIC_SOCKET_FIREWALL_TOKEN }} + allow-external-fork-fallback: true + configure-bun: true - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # 2.2.0 with: From c23c119423e53a6c35df7d1f5773eaed17fe34f1 Mon Sep 17 00:00:00 2001 From: Matt Peake Date: Tue, 8 Sep 2026 16:44:30 -0400 Subject: [PATCH 2/2] ci: restore registry before binary smoke tests --- .github/workflows/test.yml | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index 1d455a9e..77853390 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -18,6 +18,7 @@ jobs: persist-credentials: false - name: Setup Socket Firewall + id: socket-firewall uses: workos/setup-socket-firewall@ca93dd8aa351f54f4729fe3377a9be23c631c25d with: token: ${{ secrets.PUBLIC_SOCKET_FIREWALL_TOKEN }} @@ -31,6 +32,10 @@ jobs: - name: Install run: bun install --frozen-lockfile + - name: Teardown Socket Firewall + if: steps.socket-firewall.outputs.active == 'true' + uses: workos/setup-socket-firewall/teardown@ca93dd8aa351f54f4729fe3377a9be23c631c25d + - name: Test run: bun run test @@ -96,6 +101,13 @@ jobs: # selection, and the launcher's no-binary error path — from a hermetic # environment. This exercises the npm machinery the in-repo launcher # check can't (registry fetch, optionalDependencies, npx cache/bin). + - name: Setup Socket Firewall for npm distribution smoke + uses: workos/setup-socket-firewall@ca93dd8aa351f54f4729fe3377a9be23c631c25d + with: + token: ${{ secrets.PUBLIC_SOCKET_FIREWALL_TOKEN }} + allow-external-fork-fallback: true + configure-bun: true + - name: Smoke test npm distribution against a local registry env: WORKOS_NPM_ALLOW_MISSING: '1'