chore: protect package installs with Socket Firewall

[peakematt]

Public pull request and release jobs currently install npm packages before Socket Firewall is active. This change adds the pinned Socket Firewall action before those installs so package downloads go through the WorkOS firewall registry. For public pull requests, checkout now avoids persisted credentials and the workflow keeps read-only permissions before enabling the action's external-fork fallback.

The npm publish workflow now tears down the same pinned action after build and test, before npm publish. The dependency-bump workflow keeps the existing version bump, lockfile, push, and pull request commands, but it now commits dependency updates while Socket Firewall is active and only pushes or opens downstream pull requests after teardown.

Manual verification: inspect the edited workflows and run actionlint -shellcheck= .github/workflows/ci.yml .github/workflows/runtime-tests.yml .github/workflows/release.yml .github/workflows/workos-node-dep-bump.yml.

Testing: the edited workflows pass GitHub Actions syntax checks with actionlint; the Socket Firewall conformance check reports no simple red flags for the changed install paths.

[linear-code]

HELP-725

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.

[greptile-apps]

Confidence Score: 5/5

The PR appears safe to merge, with no outstanding actionable findings.

Summary

• Adds Socket Firewall setup before npm and Bun-related dependency installation.
• Tears down Socket Firewall before package publication and downstream repository pushes.
• Separates dependency-bump commits from later push and pull-request operations.
• Replaces inherited secrets with explicit forwarding of PUBLIC_SOCKET_FIREWALL_TOKEN.
• The previous over-scoped-secrets finding is resolved by the current implementation.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[Checkout and runtime setup] --> B[Configure Socket Firewall]
    B --> C[Install dependencies]
    C --> D[Build and test]
    D --> E[Teardown Socket Firewall]
    E --> F[Publish package or push dependency bumps]

Loading

_{Reviews (2) · Last reviewed commit: "chore: limit release workflow secret for..."}