chore: protect package installs with Socket Firewall

.github/workflows/ci.yml

@@ -6,6 +6,9 @@ on:
       - 'main'
   pull_request: {}
 
+permissions:
+  contents: read
+
 defaults:
   run:
     shell: bash
@@ -19,10 +22,18 @@ jobs:
         node: [22, 24]
     steps:
       - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # 6.1.0
+        with:
+          persist-credentials: false
       - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
         with:
           node-version: ${{ matrix.node }}
 
+      - name: Configure Socket Firewall
+        uses: workos/setup-socket-firewall@ca93dd8aa351f54f4729fe3377a9be23c631c25d
+        with:
+          token: ${{ secrets.PUBLIC_SOCKET_FIREWALL_TOKEN }}
+          allow-external-fork-fallback: true
+
       - name: Install Dependencies
         run: |
           npm install

.github/workflows/release-please.yml

@@ -35,3 +35,5 @@ jobs:
     needs: release-please
     if: ${{ needs.release-please.outputs.release_created == 'true' }}
     uses: ./.github/workflows/release.yml
+    secrets:
+      PUBLIC_SOCKET_FIREWALL_TOKEN: ${{ secrets.PUBLIC_SOCKET_FIREWALL_TOKEN }}

.github/workflows/release.yml

@@ -3,6 +3,9 @@ name: Release
 on:
   workflow_dispatch:
   workflow_call:
+    secrets:
+      PUBLIC_SOCKET_FIREWALL_TOKEN:
+        required: true
 
 jobs:
   publish:
@@ -17,6 +20,11 @@ jobs:
         with:
           node-version: 24
 
+      - name: Configure Socket Firewall
+        uses: workos/setup-socket-firewall@ca93dd8aa351f54f4729fe3377a9be23c631c25d
+        with:
+          token: ${{ secrets.PUBLIC_SOCKET_FIREWALL_TOKEN }}
+
       - name: Install Dependencies
         run: npm install
 
@@ -26,5 +34,8 @@ jobs:
       - name: Run Tests
         run: npm run test
 
+      - name: Teardown Socket Firewall
+        uses: workos/setup-socket-firewall/teardown@ca93dd8aa351f54f4729fe3377a9be23c631c25d
+
       - name: Publish
         run: npm publish --tag latest --access public --provenance

.github/workflows/runtime-tests.yml

@@ -2,19 +2,30 @@ name: Runtime Compatibility Tests
 
 on: [push, pull_request]
 
+permissions:
+  contents: read
+
 jobs:
   runtime-compatibility:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # 6.1.0
+        with:
+          persist-credentials: false
       - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
         with:
           node-version: 22
       - uses: denoland/setup-deno@22d081ff2d3a40755e97629de92e3bcbfa7cf2ed # 2.0.5
         with:
           deno-version: 2.x
-      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # 2.2.0
 
+      - name: Configure Socket Firewall
+        uses: workos/setup-socket-firewall@ca93dd8aa351f54f4729fe3377a9be23c631c25d
+        with:
+          token: ${{ secrets.PUBLIC_SOCKET_FIREWALL_TOKEN }}
+          allow-external-fork-fallback: true
+
+      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # 2.2.0
       - name: Install and build
         run: |
           npm install

.github/workflows/workos-node-dep-bump.yml

@@ -110,6 +110,11 @@ jobs:
             cat /tmp/repos.txt
           fi
 
+      - name: Configure Socket Firewall
+        uses: workos/setup-socket-firewall@ca93dd8aa351f54f4729fe3377a9be23c631c25d
+        with:
+          token: ${{ secrets.PUBLIC_SOCKET_FIREWALL_TOKEN }}
+
       - name: Bump dependencies
         env:
           GH_TOKEN: ${{ steps.generate-token.outputs.token }}
@@ -118,6 +123,8 @@ jobs:
           RELEASE_TAG: ${{ needs.check-version.outputs.tag }}
         run: |
           echo "Target major: $NEW_MAJOR | Dry run: $DRY_RUN"
+          BUMP_RECORDS=/tmp/workos-node-dep-bumps.tsv
+          : > "$BUMP_RECORDS"
 
           if [ ! -s /tmp/repos.txt ]; then
             echo "No repos to process."
@@ -199,6 +206,37 @@ jobs:
 
               git add package.json package-lock.json pnpm-lock.yaml 2>/dev/null || true
               git commit -m "chore!: bump @workos-inc/node to ^${NEW_MAJOR}.0.0"
+              printf '%s\t%s\t%s\t%s\t%s\t%s\t%s\n' \
+                "$REPO_NAME" "$REPO" "$WORK_DIR" "$BRANCH" "$CURRENT" "$NEW_CONSTRAINT" "$RELEASE_TAG" \
+                >> "$BUMP_RECORDS"
+
+            ) || echo "   Failed — skipping"
+
+            echo "   Done ✓"
+
+          done < /tmp/repos.txt
+
+      - name: Teardown Socket Firewall
+        uses: workos/setup-socket-firewall/teardown@ca93dd8aa351f54f4729fe3377a9be23c631c25d
+
+      - name: Push dependency bumps
+        env:
+          GH_TOKEN: ${{ steps.generate-token.outputs.token }}
+          NEW_MAJOR: ${{ needs.check-version.outputs.major }}
+        run: |
+          BUMP_RECORDS=/tmp/workos-node-dep-bumps.tsv
+
+          if [ ! -s "$BUMP_RECORDS" ]; then
+            echo "No dependency bumps to push."
+            exit 0
+          fi
+
+          while IFS=$'\t' read -r REPO_NAME REPO WORK_DIR BRANCH CURRENT NEW_CONSTRAINT RELEASE_TAG; do
+            [ -z "$REPO" ] && continue
+            echo "── $REPO_NAME ($REPO)"
+
+            (
+              cd "$WORK_DIR"
 
               # Push idempotently — force-with-lease if branch exists from a prior run
               if git ls-remote --exit-code --heads origin "$BRANCH" >/dev/null 2>&1; then
@@ -228,5 +266,4 @@ jobs:
 
             rm -rf "$WORK_DIR"
             echo "   Done ✓"
-
-          done < /tmp/repos.txt
+          done < "$BUMP_RECORDS"