ci: add Socket Firewall to Emulate workflows

[peakematt]

Emulate installs public npm packages in host and Docker build jobs. This change routes those registry downloads through the pinned WorkOS Socket Firewall action. Ordinary public pull request jobs retain the action-validated external-fork fallback with read-only permissions and non-persisted checkout credentials; release jobs remain fail-closed.

Docker installs receive temporary Bun configuration through BuildKit secrets, with direct public-registry access blocked inside the build. Authenticated candidate images are scanned before publication, including every image layer and its metadata. Cleanup and same-pin teardown precede the config-free publication step, which fails on a dependency-install cache miss rather than downloading without protection. Existing platforms, tags, inherited secrets, Homebrew handling and npm provenance are preserved.

To verify, inspect the Scan authenticated image steps in both Docker checks: setup must be active, scans clean and cleanup successful. The scanner self-tests cover real synthetic credential/endpoint matches, secrets deleted from earlier layers, unknown image formats and harmless registry-related text. At 0631dd6, authenticated amd64 and arm64 image scans passed, along with the application and compatibility checks. No real release was dispatched as a test.

Before merge, resolve the existing tree-sitter-kotlin GitHub-archive dependency route. That route is not claimed protected by the npm registry proxy, and no coverage exception or dependency change is approved here. Current human owner approval and the normal merge checks also remain required.

[devin-ai-integration]

Devin Review found 2 potential issues.

[greptile-apps]

Confidence Score: 5/5

The reviewed head appears safe to merge under the documented one-time image-review policy and explicit direct-download exception.

Summary

• Public pull-request workflows use read-only permissions, non-persisted checkout credentials, and the external-fork fallback.
• Container publication requires an active firewall setup, while local Docker builds retain public-registry behavior.
• Release binary construction now uses workflow-trusted tooling and environment-provided release inputs.
• There have been no source changes since the previous review.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart LR
  Source[Checked-out release source] --> Firewall[Socket Firewall setup]
  Firewall --> Install[Bun dependency installation]
  Firewall --> Compiler[Target-specific Bun compiler package]
  Install --> Binary[Standalone release binary]
  Compiler --> Binary
  Firewall --> DockerConfig[Temporary Bun BuildKit secret]
  DockerConfig --> Image[Multi-platform container build]
  Binary --> Artifacts[Release artifacts and checksums]
  Image --> Registry[Container registry]
  Firewall --> Teardown[Same-pin teardown and config cleanup]

Loading

_{Reviews (4) · Last reviewed commit: "pi: address PR review feedback (#103)"}

[peakematt]

[from Pi]: @greptileai Please review the current head bfaab7489e7b1ac06b4ebe9ca30ade75634a2107 with the following clarified requirements and corrected description. The fixed release-tooling finding and the two accepted-boundary threads now have published replies and are resolved. The approved policy uses a one-time image review, not a recurring scanner or scan-gated publication requirement. Historical image evidence is limited to the inspected image/head and does not prove future images identical or universally credential-free. The pinned tree-sitter-kotlin GitHub archive is an explicit direct-download exception, not Socket-inspected. No source change was made for these clarifications. Please assess all remaining concerns honestly and identify the commit reviewed in the completed review.