ci: protect npm installs with Socket Firewall - #104
Draft
peakematt wants to merge 1 commit into
Draft
Conversation
peakematt
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
authkit-reactdownloads public npm packages in normal continuous integration, its reusable release workflow, and its scheduled Socket analysis workflow. Those downloads currently bypass the WorkOS Socket Firewall, while the release job must still publish directly to npm after installation.This change protects each download with action-only release
ca93dd8aa351f54f4729fe3377a9be23c631c25d. The selected-repositoryPUBLIC_SOCKET_FIREWALL_TOKENsecret is passed only to the setup action. Public fork pull requests can use the action's validated public-registry fallback, while same-repository and default-branch jobs remain fail-closed. Checkout credentials are no longer persisted and fork-reachable permissions are read-only.The reusable release workflow receives only the named firewall secret. It configures Socket Firewall after
setup-node, installs dependencies, and invokes teardown at the same release SHA before building or publishing. This preserves npm trusted publishing and prevents the firewall credential or registry from reaching publication. The scheduled Socket CLI install uses the same setup/install/teardown boundary. Thepull_request_targettitle-lint workflow does not check out or execute contributor-controlled code and is unchanged.Verify the workflow structure with:
go run github.com/rhysd/actionlint/cmd/actionlint@v1.7.10 .github/workflows/*.ymlThe rollout classifier reports all three npm download jobs as protected with no ordering, release-reference, token, publication, or trust violations. Two independent reviews found no public-trust or publication-boundary blockers. The same-repository token-backed install passed, and temporary external-fork run
33780874100confirmed that GitHub withheld the token while the validated public-registry fallback completed successfully. An isolated0.0.0-help724publish dry run explicitly targetedhttps://registry.npmjs.org/and did not publish.Before merge,
PUBLIC_SOCKET_FIREWALL_TOKENmust also be available from the separate Dependabot secret store so dependency-update pull requests remain fail-closed and green. No real package publication is performed as part of this change.