chore(ci): repair Socket Firewall URLs in bun.lock

[peakematt]

Bun can save Socket Firewall tarball URLs in bun.lock, making later installs depend on an endpoint that contributors or external CI may not be able to access. This adds a dedicated pull-request workflow that repairs those URLs on the PR branch instead of asking contributors to clean them up manually.

The workflow runs only for changes to the root bun.lock and invokes the lockfile repair action at the full, verified GitHub-signed release SHA 195977cfa38ab4d70363af5403a106dbc54a61eb. The action reads the committed PR head, restores Bun's native empty resolved-URL fields, and creates a single-file repair commit using GITHUB_TOKEN. Clean locks produce no commit. Dirty forks fail with repair guidance and are never written to; default-branch writes and stale-head overwrites are refused inside the action.

Only the dedicated repair job receives contents: write. It checks out no project code, installs no dependencies, and receives no Socket Firewall secret. Existing Test, Lint, release, and Socket Tier 1 workflows—including their current firewall setup pins—are unchanged.

Verified end-to-end on this draft: a controlled URL for the existing chalk@5.6.2 lock entry triggered the pinned action. It created a verified github-actions[bot] commit changing only bun.lock, preserving the version/integrity and restoring the original file byte-for-byte. The final PR diff contains only the new workflow.

Successful repair run:
https://github.com/workos/cli/actions/runs/34882496936

Repair commit:
9e42a5f

From the repository root, with Git and actionlint installed:

actionlint .github/workflows/scrub-socket-firewall-lockfile.yml
git diff --check origin/main...HEAD
git diff --exit-code origin/main...HEAD -- bun.lock

These checks passed. Local tests using the actual released normalizer also verified exact restoration and clean-file idempotence; the released controller suite covers fork and stale/default-branch guards. No external-fork PR was created for this rollout test. Application build/test/typecheck commands were not run locally for this workflow-only change; those remain covered by the existing hosted workflows.

Token-created commits may leave follow-up CI suppressed or awaiting approval. In this trial, GitHub held the follow-up Test and Lint workflows for approval; the successful repair is not proof that application tests ran on the bot commit.

Tracking:
https://linear.app/workos/issue/HELP-723

[linear-code]

HELP-723

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.

[greptile-apps]

Confidence Score: 4/5

The PR should not merge until repaired head commits are reliably validated by the existing Test and Lint workflows.

Findings

1.  Repair Commit Skips Validation ▶

Fix with agent prompt

### Issue 1
.github/workflows/scrub-socket-firewall-lockfile.yml:19
When the action creates a new PR-head commit with `GITHUB_TOKEN`, this workflow ends without dispatching or running follow-up validation. The existing Test and Lint workflows may therefore remain suppressed or await approval, leaving their earlier results tied to the pre-repair SHA. A dirty lockfile can be repaired into a head commit that is blocked waiting for checks or merged without Test and Lint validating the repaired dependency state. Please ensure those workflows reliably validate the resulting SHA.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

Summary

• Avoids checking out project code or installing dependencies.
• Limits the workflow trigger to root bun.lock changes.
• The resulting repair commit is not reliably followed by Test and Lint validation.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart TD
  A[Pull request changes bun.lock] --> B[Repair workflow starts]
  B --> C[Pinned lockfile-scrub action]
  C --> D{Lockfile needs repair?}
  D -->|No| E[Finish without commit]
  D -->|Yes, writable branch| F[Create repaired PR-head commit]
  D -->|Yes, fork or rejected head| G[Fail with repair guidance]
  F --> H[Test and Lint follow-up not reliably triggered]

Loading

_{Reviews (1) · Last reviewed commit: "chore: normalize lockfile registry URLs"}