ci: route example dependency installs through Socket Firewall

[peakematt]

The example apps in this repository are built in continuous integration, but their dependencies install straight from the public npm registry, so a compromised or typo-squatted package could execute during pnpm install before anyone reviews it. This change routes those downloads through the WorkOS Socket Firewall, which blocks known-malicious packages at install time.

The build job now runs the firewall setup action immediately after checkout and before pnpm is installed, so every download in the job, pnpm itself and the frozen-lockfile install, passes through the firewall. Because this public repository builds pull requests from forks, the step sets allow-external-fork-fallback: true. The action inspects the event context itself and only relaxes to the public registry for a genuine external-fork pull request, where the firewall token cannot be provided. Pushes to main, manual runs, same-repo pull requests, and Dependabot all keep the firewall active and fail closed when the token is missing rather than silently reaching the public registry. The checkout no longer persists its credentials, so an untrusted dependency cannot reuse them. The job holds no deploy or publish credentials and ships nothing, so no teardown step is needed and the firewall stays active through the build.

To verify, open the workflow run for this branch and confirm the Setup Socket Firewall step reports the firewall active before dependencies install and that the build still succeeds. The action is pinned to the immutable commit ca93dd8aa351f54f4729fe3377a9be23c631c25d.

Protection on same-repo and Dependabot runs depends on the PUBLIC_SOCKET_FIREWALL_TOKEN secret being available to Actions and to Dependabot; without it those trusted runs fail closed by design.

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.

[greptile-apps]

Confidence Score: 5/5

The workflow hardening appears safe to merge, with no concrete regressions identified.

Summary

• Disables persistence of checkout credentials in the build job.
• Configures the Socket Firewall before pnpm and project dependencies are installed.
• Pins the new firewall action to an immutable commit.
• Allows public-registry fallback for external-fork pull requests where repository secrets are unavailable.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart TD
  A[Checkout without persisted credentials] --> B[Setup Socket Firewall]
  B --> C{Firewall token available?}
  C -->|Yes| D[Route downloads through firewall]
  C -->|No, genuine external fork| E[Use public-registry fallback]
  C -->|No, trusted run| F[Fail closed]
  D --> G[Install pnpm]
  E --> G
  G --> H[Install frozen-lockfile dependencies]
  H --> I[Build example]

Loading