From d7bebaf52dcd8ef49e66d7ce517c36f06fce7f4e Mon Sep 17 00:00:00 2001 From: Matt Peake Date: Tue, 8 Sep 2026 20:25:04 -0400 Subject: [PATCH 1/3] chore: protect package installs with Socket Firewall --- .github/workflows/ci.yml | 11 ++++++ .github/workflows/release.yml | 8 +++++ .github/workflows/runtime-tests.yml | 13 ++++++- .github/workflows/workos-node-dep-bump.yml | 41 ++++++++++++++++++++-- 4 files changed, 70 insertions(+), 3 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 1c2a06ae5..d251171dc 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -6,6 +6,9 @@ on: - 'main' pull_request: {} +permissions: + contents: read + defaults: run: shell: bash @@ -19,10 +22,18 @@ jobs: node: [22, 24] steps: - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # 6.1.0 + with: + persist-credentials: false - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0 with: node-version: ${{ matrix.node }} + - name: Configure Socket Firewall + uses: workos/setup-socket-firewall@ca93dd8aa351f54f4729fe3377a9be23c631c25d + with: + token: ${{ secrets.PUBLIC_SOCKET_FIREWALL_TOKEN }} + allow-external-fork-fallback: true + - name: Install Dependencies run: | npm install diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 46d45bebf..06457eaff 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -17,6 +17,11 @@ jobs: with: node-version: 24 + - name: Configure Socket Firewall + uses: workos/setup-socket-firewall@ca93dd8aa351f54f4729fe3377a9be23c631c25d + with: + token: ${{ secrets.PUBLIC_SOCKET_FIREWALL_TOKEN }} + - name: Install Dependencies run: npm install @@ -26,5 +31,8 @@ jobs: - name: Run Tests run: npm run test + - name: Teardown Socket Firewall + uses: workos/setup-socket-firewall/teardown@ca93dd8aa351f54f4729fe3377a9be23c631c25d + - name: Publish run: npm publish --tag latest --access public --provenance diff --git a/.github/workflows/runtime-tests.yml b/.github/workflows/runtime-tests.yml index e7c37df9d..0650d25b8 100644 --- a/.github/workflows/runtime-tests.yml +++ b/.github/workflows/runtime-tests.yml @@ -2,19 +2,30 @@ name: Runtime Compatibility Tests on: [push, pull_request] +permissions: + contents: read + jobs: runtime-compatibility: runs-on: ubuntu-latest steps: - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # 6.1.0 + with: + persist-credentials: false - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0 with: node-version: 22 - uses: denoland/setup-deno@22d081ff2d3a40755e97629de92e3bcbfa7cf2ed # 2.0.5 with: deno-version: 2.x - - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # 2.2.0 + - name: Configure Socket Firewall + uses: workos/setup-socket-firewall@ca93dd8aa351f54f4729fe3377a9be23c631c25d + with: + token: ${{ secrets.PUBLIC_SOCKET_FIREWALL_TOKEN }} + allow-external-fork-fallback: true + + - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # 2.2.0 - name: Install and build run: | npm install diff --git a/.github/workflows/workos-node-dep-bump.yml b/.github/workflows/workos-node-dep-bump.yml index 979a16391..81d32dd7d 100644 --- a/.github/workflows/workos-node-dep-bump.yml +++ b/.github/workflows/workos-node-dep-bump.yml @@ -110,6 +110,11 @@ jobs: cat /tmp/repos.txt fi + - name: Configure Socket Firewall + uses: workos/setup-socket-firewall@ca93dd8aa351f54f4729fe3377a9be23c631c25d + with: + token: ${{ secrets.PUBLIC_SOCKET_FIREWALL_TOKEN }} + - name: Bump dependencies env: GH_TOKEN: ${{ steps.generate-token.outputs.token }} @@ -118,6 +123,8 @@ jobs: RELEASE_TAG: ${{ needs.check-version.outputs.tag }} run: | echo "Target major: $NEW_MAJOR | Dry run: $DRY_RUN" + BUMP_RECORDS=/tmp/workos-node-dep-bumps.tsv + : > "$BUMP_RECORDS" if [ ! -s /tmp/repos.txt ]; then echo "No repos to process." @@ -199,6 +206,37 @@ jobs: git add package.json package-lock.json pnpm-lock.yaml 2>/dev/null || true git commit -m "chore!: bump @workos-inc/node to ^${NEW_MAJOR}.0.0" + printf '%s\t%s\t%s\t%s\t%s\t%s\t%s\n' \ + "$REPO_NAME" "$REPO" "$WORK_DIR" "$BRANCH" "$CURRENT" "$NEW_CONSTRAINT" "$RELEASE_TAG" \ + >> "$BUMP_RECORDS" + + ) || echo " Failed — skipping" + + echo " Done ✓" + + done < /tmp/repos.txt + + - name: Teardown Socket Firewall + uses: workos/setup-socket-firewall/teardown@ca93dd8aa351f54f4729fe3377a9be23c631c25d + + - name: Push dependency bumps + env: + GH_TOKEN: ${{ steps.generate-token.outputs.token }} + NEW_MAJOR: ${{ needs.check-version.outputs.major }} + run: | + BUMP_RECORDS=/tmp/workos-node-dep-bumps.tsv + + if [ ! -s "$BUMP_RECORDS" ]; then + echo "No dependency bumps to push." + exit 0 + fi + + while IFS=$'\t' read -r REPO_NAME REPO WORK_DIR BRANCH CURRENT NEW_CONSTRAINT RELEASE_TAG; do + [ -z "$REPO" ] && continue + echo "── $REPO_NAME ($REPO)" + + ( + cd "$WORK_DIR" # Push idempotently — force-with-lease if branch exists from a prior run if git ls-remote --exit-code --heads origin "$BRANCH" >/dev/null 2>&1; then @@ -228,5 +266,4 @@ jobs: rm -rf "$WORK_DIR" echo " Done ✓" - - done < /tmp/repos.txt + done < "$BUMP_RECORDS" From f3ddddd997b4f5b9c039c0a5133e43e17144f107 Mon Sep 17 00:00:00 2001 From: Matt Peake Date: Tue, 8 Sep 2026 20:37:50 -0400 Subject: [PATCH 2/3] chore: inherit secrets for release workflow --- .github/workflows/release-please.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml index 3e2fd437a..1e9e0ec6e 100644 --- a/.github/workflows/release-please.yml +++ b/.github/workflows/release-please.yml @@ -35,3 +35,4 @@ jobs: needs: release-please if: ${{ needs.release-please.outputs.release_created == 'true' }} uses: ./.github/workflows/release.yml + secrets: inherit From 0dfd100322a6cf4a37d711e1a3b7a24a77b14be3 Mon Sep 17 00:00:00 2001 From: Matt Peake Date: Thu, 10 Sep 2026 18:55:54 -0400 Subject: [PATCH 3/3] chore: limit release workflow secret forwarding --- .github/workflows/release-please.yml | 3 ++- .github/workflows/release.yml | 3 +++ 2 files changed, 5 insertions(+), 1 deletion(-) diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml index 1e9e0ec6e..945e83e7b 100644 --- a/.github/workflows/release-please.yml +++ b/.github/workflows/release-please.yml @@ -35,4 +35,5 @@ jobs: needs: release-please if: ${{ needs.release-please.outputs.release_created == 'true' }} uses: ./.github/workflows/release.yml - secrets: inherit + secrets: + PUBLIC_SOCKET_FIREWALL_TOKEN: ${{ secrets.PUBLIC_SOCKET_FIREWALL_TOKEN }} diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 06457eaff..e9c89b86b 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -3,6 +3,9 @@ name: Release on: workflow_dispatch: workflow_call: + secrets: + PUBLIC_SOCKET_FIREWALL_TOKEN: + required: true jobs: publish: