ci: protect npm installs with Socket Firewall

[peakematt]

authkit-js downloads public npm packages in normal continuous integration, its reusable release workflow, and its scheduled Socket analysis workflow. Those downloads currently bypass the WorkOS Socket Firewall, while the release must still publish directly to npm.

This change protects each download with action-only release ca93dd8aa351f54f4729fe3377a9be23c631c25d. The selected-repository PUBLIC_SOCKET_FIREWALL_TOKEN secret is passed only to the setup action. Public fork pull requests can use the validated public-registry fallback, while same-repository and default-branch jobs remain fail-closed. Fork-reachable permissions are read-only and checkout credentials are no longer persisted.

The reusable release workflow receives only the named firewall secret. It installs through Socket Firewall after setup-node, then invokes teardown at the same release SHA before building or publishing. The scheduled Socket CLI install uses the same setup/install/teardown boundary. Existing test, build, trusted-publishing, release-selection, and reachability-analysis behavior is unchanged. The pull_request_target title-lint workflow does not execute contributor-controlled code and remains outside the install path.

Verify the workflow structure with:

go run github.com/rhysd/actionlint/cmd/actionlint@v1.7.10 .github/workflows/*.yml

The rollout classifier reports all three npm download jobs as protected with no ordering, release-reference, token, publication, or trust violations. The earlier public pilot provides external-fork and publication-boundary evidence for this shared workflow shape. No real package publication is performed by this change.

[linear-code]

HELP-725

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.

[greptile-apps]

Confidence Score: 5/5

The PR appears safe to merge with no actionable correctness, security, or repository-rule violations identified.

Summary

• Protects dependency installation in CI, release, and scheduled Socket analysis workflows.
• Restricts workflow permissions and disables persisted checkout credentials.
• Passes the firewall token explicitly into the reusable release workflow.
• Restores the public npm registry before release build and publication.
• Keeps CI firewall routing active through its remaining npm-driven checks.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart TD
  A[Workflow checkout] --> B[Set up Node]
  B --> C[Configure Socket Firewall]
  C --> D[Install npm dependencies]
  D --> E{Workflow}
  E -->|CI| F[Format, build, and test]
  E -->|Release| G[Teardown firewall]
  G --> H[Build and publish directly to npm]
  E -->|Socket analysis| I[Teardown firewall]
  I --> J[Run reachability analysis]

Loading