Skip to content

Commit f2129b1

Browse files
jdaltonjdalton
authored
fix(ci): inline CI setup, add Node 24 support, harden workflows (#1176)
* fix(ci): inline CI setup, add Node 24 support, harden workflows Previously our CI workflows depended on a shared composite action from the socket-registry repo (setup-and-install). That action was pinned to an October 2025 SHA that predated Node 24 support, and updating it meant tracking SHA cascades across multiple layers of nested actions. This commit replaces that dependency by inlining every setup step directly into each workflow file. Now each workflow is self-contained and easy to read top-to-bottom: 1. actions/checkout — clone the repo 2. pnpm/action-setup — install pnpm (version from package.json) 3. actions/setup-node — install the right Node.js version 4. Download sfw-free — fetch the Socket Firewall binary 5. Create sfw shims — wrap npm/yarn/pnpm through the firewall 6. pnpm install — install dependencies (through the firewall) All three actions are pinned to full commit SHAs (not version tags) so the exact code that runs is deterministic and auditable. Binary downloads (sfw-free v1.6.1) are verified against SHA-256 checksums baked into the workflow. If someone tampers with a release asset, CI will fail immediately instead of running untrusted code. The sfw shim scripts handle both Linux/macOS and Windows: - On Windows, MSYS-style paths (/c/Users/...) are converted to native format (C:\Users\...) so sfw-free can resolve them correctly. - .cmd wrapper files are generated alongside bash shims for Windows. - Each shim strips its own directory from PATH before exec to prevent infinite recursion (shim calling itself instead of the real binary). Other changes: - Node 24 is now tested in the CI matrix alongside Node 20 and 22. Provenance publishes with Node 24. - The lint job now runs zizmor (a GitHub Actions security auditor) on every push/PR. It downloads a pinned, checksum-verified native binary — no Docker, Python, or pip needed. It scans .github/ for template injection, unpinned actions, cache poisoning, and other issues. - Removed three dead workflow files that referenced shared workflows which no longer exist upstream: claude-auto-review.yml, claude.yml, and socket-auto-pr.yml. - Fixed template injection in provenance.yml: inputs.dist-tag was interpolated directly into run blocks (attackable via workflow dispatch). Now passed through an environment variable instead. - Removed the push/tag trigger from e2e-tests.yml to eliminate a cache-poisoning vector flagged by zizmor (PR + tag triggers combined with action caching). - Removed the old npm install -g npm@latest hack from provenance.yml since Node 24 ships with a modern npm. * fix(ci): replace pnpm/action-setup with inline binary download Replace the pnpm/action-setup third-party action with a direct download of the pnpm standalone binary from GitHub releases, matching the same pattern used for sfw-free and zizmor. The pnpm binary (v10.33.0) is downloaded, checksum-verified against a SHA-256 hash, and symlinked as "pnpm" on PATH. This removes the last third-party action dependency beyond actions/checkout and actions/setup-node. * chore: add packageManager field for pnpm 10.33.0 Aligns socket-cli with all other Socket repos which already declare packageManager in package.json. This lets corepack and tooling auto- detect the correct pnpm version. * fix(ci): allow zizmor warnings (exit 13) in audit step Zizmor exits 13 for warnings-only and 14 for errors. The secrets-outside-env warnings are expected (requires GitHub environment configuration) so we allow exit code 13 while still failing on actual errors. * chore: use Node 25.9.0 for lint, typecheck, and provenance * chore: add sfw-free ecosystem docs link to shim loops * fix(ci): work around sfw-free missing GIT_SSL_CAINFO * fix(ci): use sha256sum with shasum fallback for Windows compatibility * fix(ci): strip backslash prefix from sha256sum output on Windows * fix(ci): copy pnpm binary as pnpm.exe on Windows instead of symlink
1 parent f732aa8 commit f2129b1

7 files changed

Lines changed: 643 additions & 87 deletions

File tree

‎.github/workflows/ci.yml‎

Lines changed: 402 additions & 5 deletions
Large diffs are not rendered by default.

‎.github/workflows/claude-auto-review.yml‎

Lines changed: 0 additions & 17 deletions
This file was deleted.

‎.github/workflows/claude.yml‎

Lines changed: 0 additions & 24 deletions
This file was deleted.

‎.github/workflows/e2e-tests.yml‎

Lines changed: 115 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,6 @@
11
name: E2E Tests
22

33
on:
4-
push:
5-
branches: [main]
6-
tags: ['*']
74
pull_request:
85
branches: [main, v1.x]
96
workflow_dispatch:
@@ -22,10 +19,124 @@ jobs:
2219
os: [ubuntu-latest]
2320
# os: [ubuntu-latest, windows-latest] - Windows tests disbaled (see project https://linear.app/socketdev/project/autofixes-windows-support-fc2f2a45f759)
2421
steps:
25-
- uses: SocketDev/socket-registry/.github/actions/setup-and-install@51be85d39d3b4a42dd9d4712948b9d30a2e04794
22+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
23+
with:
24+
persist-credentials: false
25+
26+
- name: Install pnpm
27+
shell: bash
28+
run: | # zizmor: ignore[github-env]
29+
PNPM_VERSION="10.33.0"
30+
PNPM_DIR="${RUNNER_TEMP:-/tmp}/pnpm-bin"
31+
KERNEL="$(uname -s | cut -d- -f1)"
32+
ARCH="$(uname -m)"
33+
case "${KERNEL}-${ARCH}" in
34+
Linux-x86_64) ASSET="pnpm-linux-x64" ; EXPECTED_SHA256="8d4e8f7d778e8ac482022e2577011706a872542f6f6f233e795a4d9f978ea8b5" ;;
35+
Linux-aarch64) ASSET="pnpm-linux-arm64" ; EXPECTED_SHA256="06755ad2817548b84317d857d5c8003dc6e9e28416a3ea7467256c49ab400d48" ;;
36+
Darwin-x86_64) ASSET="pnpm-macos-x64" ; EXPECTED_SHA256="c31e29554b0e3f4e03f4617195c949595e4dca36085922003de4896c3ca4057d" ;;
37+
Darwin-arm64) ASSET="pnpm-macos-arm64" ; EXPECTED_SHA256="ed8a1f140f4de457b01ebe0be3ae28e9a7e28863315dcd53d22ff1e5a32d63ae" ;;
38+
MINGW64_NT-x86_64|MSYS_NT-x86_64) ASSET="pnpm-win-x64.exe" ; EXPECTED_SHA256="afc96009dc39fe23a835d65192049e6a995f342496b175585dc2beda7d42d33f" ;;
39+
*) echo "Unsupported platform: ${KERNEL}-${ARCH}" >&2; exit 1 ;;
40+
esac
41+
PNPM_BIN="$PNPM_DIR/$ASSET"
42+
if [ ! -x "$PNPM_BIN" ]; then
43+
mkdir -p "$PNPM_DIR"
44+
curl -fsSL -o "$PNPM_BIN" "https://github.com/pnpm/pnpm/releases/download/v${PNPM_VERSION}/${ASSET}"
45+
ACTUAL_SHA256="$( (sha256sum "$PNPM_BIN" 2>/dev/null || shasum -a 256 "$PNPM_BIN") | cut -d' ' -f1 | tr -d '\\')"
46+
if [ "$ACTUAL_SHA256" != "$EXPECTED_SHA256" ]; then
47+
echo "Checksum mismatch for ${ASSET}!" >&2
48+
echo " Expected: ${EXPECTED_SHA256}" >&2
49+
echo " Actual: ${ACTUAL_SHA256}" >&2
50+
rm -f "$PNPM_BIN"
51+
exit 1
52+
fi
53+
chmod +x "$PNPM_BIN"
54+
# Create pnpm alias. Windows needs a .exe copy; Unix uses a symlink.
55+
if [[ "$ASSET" == *.exe ]]; then
56+
cp "$PNPM_BIN" "$PNPM_DIR/pnpm.exe"
57+
else
58+
ln -sf "$PNPM_BIN" "$PNPM_DIR/pnpm"
59+
fi
60+
fi
61+
echo "$PNPM_DIR" >> "${GITHUB_PATH:-/dev/null}"
62+
63+
- uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
2664
with:
2765
node-version: ${{ matrix.node-version }}
2866

67+
- name: Download sfw-free
68+
shell: bash
69+
env:
70+
GH_TOKEN: ${{ github.token }}
71+
run: | # zizmor: ignore[github-env]
72+
SFW_DIR="${RUNNER_TEMP:-/tmp}/sfw-bin"
73+
KERNEL="$(uname -s | cut -d- -f1)"
74+
ARCH="$(uname -m)"
75+
case "${KERNEL}-${ARCH}" in
76+
Linux-x86_64) ASSET="sfw-free-linux-x86_64" ; SFW_BIN="$SFW_DIR/sfw" ; EXPECTED_SHA256="4a1e8b65e90fce7d5fd066cf0af6c93d512065fa4222a475c8d959a6bc14b9ff" ;;
77+
Linux-aarch64) ASSET="sfw-free-linux-arm64" ; SFW_BIN="$SFW_DIR/sfw" ; EXPECTED_SHA256="df2eedb2daf2572eee047adb8bfd81c9069edcb200fc7d3710fca98ec3ca81a1" ;;
78+
Darwin-x86_64) ASSET="sfw-free-macos-x86_64" ; SFW_BIN="$SFW_DIR/sfw" ; EXPECTED_SHA256="724ccea19d847b79db8cc8e38f5f18ce2dd32336007f42b11bed7d2e5f4a2566" ;;
79+
Darwin-arm64) ASSET="sfw-free-macos-arm64" ; SFW_BIN="$SFW_DIR/sfw" ; EXPECTED_SHA256="bf1616fc44ac49f1cb2067fedfa127a3ae65d6ec6d634efbb3098cfa355e5555" ;;
80+
MINGW64_NT-x86_64|MSYS_NT-x86_64) ASSET="sfw-free-windows-x86_64.exe" ; SFW_BIN="$SFW_DIR/sfw.exe" ; EXPECTED_SHA256="c953e62ad7928d4d8f2302f5737884ea1a757babc26bed6a42b9b6b68a5d54af" ;;
81+
*) echo "Unsupported platform: ${KERNEL}-${ARCH}" >&2; exit 1 ;;
82+
esac
83+
if [ ! -x "$SFW_BIN" ]; then
84+
mkdir -p "$SFW_DIR"
85+
DOWNLOAD_URL="$(gh api repos/SocketDev/sfw-free/releases/latest \
86+
--jq ".assets[] | select(.name == \"$ASSET\") | .browser_download_url")"
87+
curl -fsSL -o "$SFW_BIN" "$DOWNLOAD_URL"
88+
ACTUAL_SHA256="$( (sha256sum "$SFW_BIN" 2>/dev/null || shasum -a 256 "$SFW_BIN") | cut -d' ' -f1 | tr -d '\\')"
89+
if [ "$ACTUAL_SHA256" != "$EXPECTED_SHA256" ]; then
90+
echo "Checksum mismatch for ${ASSET}!" >&2
91+
echo " Expected: ${EXPECTED_SHA256}" >&2
92+
echo " Actual: ${ACTUAL_SHA256}" >&2
93+
rm -f "$SFW_BIN"
94+
exit 1
95+
fi
96+
chmod +x "$SFW_BIN"
97+
fi
98+
echo "SFW_BIN=$SFW_BIN" >> "${GITHUB_ENV:-/dev/null}"
99+
100+
- name: Create sfw shims
101+
shell: bash
102+
run: | # zizmor: ignore[github-env]
103+
SHIM_DIR="${RUNNER_TEMP:-/tmp}/sfw-shim"
104+
rm -rf "$SHIM_DIR"
105+
mkdir -p "$SHIM_DIR"
106+
IS_WINDOWS=false
107+
[[ "$OSTYPE" == msys* || "$OSTYPE" == cygwin* ]] && IS_WINDOWS=true
108+
msys_to_win_path() {
109+
if $IS_WINDOWS && [[ "$1" =~ ^/([a-zA-Z])/(.*) ]]; then
110+
echo "${BASH_REMATCH[1]^^}:\\${BASH_REMATCH[2]//\//\\}"
111+
else
112+
echo "$1"
113+
fi
114+
}
115+
strip_shim_dir() { echo "$PATH" | tr ':' '\n' | grep -vxF "$SHIM_DIR" | paste -sd: -; }
116+
CLEAN_PATH="$(strip_shim_dir)"
117+
# https://docs.socket.dev/docs/socket-firewall-free#what-ecosystems-and-package-managers-are-supported
118+
for CMD in npm yarn pnpm pip uv cargo; do
119+
REAL="$(PATH="$CLEAN_PATH" command -v "$CMD" 2>/dev/null || true)"
120+
[ -z "$REAL" ] && continue
121+
REAL="$(msys_to_win_path "$REAL")"
122+
printf '%s\n' \
123+
'#!/bin/bash' \
124+
"export PATH=\"\$(echo \"\$PATH\" | tr ':' '\n' | grep -vxF '${SHIM_DIR}' | paste -sd: -)\"" \
125+
'export GIT_SSL_NO_VERIFY=true # Workaround: sfw-free does not yet set GIT_SSL_CAINFO.' \
126+
"exec \"${SFW_BIN}\" \"${REAL}\" \"\$@\"" \
127+
> "$SHIM_DIR/$CMD"
128+
chmod +x "$SHIM_DIR/$CMD"
129+
if $IS_WINDOWS; then
130+
printf '@echo off\r\nset "PATH=;%%PATH%%;"\r\nset "PATH=%%PATH:;%s;=;%%"\r\nset "PATH=%%PATH:~1,-1%%"\r\n"%s" "%s" %%*\r\n' \
131+
"$SHIM_DIR" "$SFW_BIN" "$REAL" > "$SHIM_DIR/$CMD.cmd"
132+
fi
133+
done
134+
echo "$SHIM_DIR" >> "${GITHUB_PATH:-/dev/null}"
135+
echo "SFW_SHIM_DIR=$SHIM_DIR" >> "${GITHUB_ENV:-/dev/null}"
136+
137+
- name: Install dependencies
138+
run: pnpm install --loglevel error
139+
29140
- name: Install uv
30141
run: curl -LsSf https://astral.sh/uv/install.sh | sh
31142

‎.github/workflows/provenance.yml‎

Lines changed: 125 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -25,31 +25,149 @@ jobs:
2525
id-token: write
2626

2727
steps:
28-
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
29-
- uses: SocketDev/socket-registry/.github/actions/setup@1543e937143cf84e5161ad18c04cbd99c8a4c6d8
28+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
3029
with:
30+
persist-credentials: false
31+
32+
- name: Install pnpm
33+
shell: bash
34+
run: | # zizmor: ignore[github-env]
35+
PNPM_VERSION="10.33.0"
36+
PNPM_DIR="${RUNNER_TEMP:-/tmp}/pnpm-bin"
37+
KERNEL="$(uname -s | cut -d- -f1)"
38+
ARCH="$(uname -m)"
39+
case "${KERNEL}-${ARCH}" in
40+
Linux-x86_64) ASSET="pnpm-linux-x64" ; EXPECTED_SHA256="8d4e8f7d778e8ac482022e2577011706a872542f6f6f233e795a4d9f978ea8b5" ;;
41+
Linux-aarch64) ASSET="pnpm-linux-arm64" ; EXPECTED_SHA256="06755ad2817548b84317d857d5c8003dc6e9e28416a3ea7467256c49ab400d48" ;;
42+
Darwin-x86_64) ASSET="pnpm-macos-x64" ; EXPECTED_SHA256="c31e29554b0e3f4e03f4617195c949595e4dca36085922003de4896c3ca4057d" ;;
43+
Darwin-arm64) ASSET="pnpm-macos-arm64" ; EXPECTED_SHA256="ed8a1f140f4de457b01ebe0be3ae28e9a7e28863315dcd53d22ff1e5a32d63ae" ;;
44+
MINGW64_NT-x86_64|MSYS_NT-x86_64) ASSET="pnpm-win-x64.exe" ; EXPECTED_SHA256="afc96009dc39fe23a835d65192049e6a995f342496b175585dc2beda7d42d33f" ;;
45+
*) echo "Unsupported platform: ${KERNEL}-${ARCH}" >&2; exit 1 ;;
46+
esac
47+
PNPM_BIN="$PNPM_DIR/$ASSET"
48+
if [ ! -x "$PNPM_BIN" ]; then
49+
mkdir -p "$PNPM_DIR"
50+
curl -fsSL -o "$PNPM_BIN" "https://github.com/pnpm/pnpm/releases/download/v${PNPM_VERSION}/${ASSET}"
51+
ACTUAL_SHA256="$( (sha256sum "$PNPM_BIN" 2>/dev/null || shasum -a 256 "$PNPM_BIN") | cut -d' ' -f1 | tr -d '\\')"
52+
if [ "$ACTUAL_SHA256" != "$EXPECTED_SHA256" ]; then
53+
echo "Checksum mismatch for ${ASSET}!" >&2
54+
echo " Expected: ${EXPECTED_SHA256}" >&2
55+
echo " Actual: ${ACTUAL_SHA256}" >&2
56+
rm -f "$PNPM_BIN"
57+
exit 1
58+
fi
59+
chmod +x "$PNPM_BIN"
60+
# Create pnpm alias. Windows needs a .exe copy; Unix uses a symlink.
61+
if [[ "$ASSET" == *.exe ]]; then
62+
cp "$PNPM_BIN" "$PNPM_DIR/pnpm.exe"
63+
else
64+
ln -sf "$PNPM_BIN" "$PNPM_DIR/pnpm"
65+
fi
66+
fi
67+
echo "$PNPM_DIR" >> "${GITHUB_PATH:-/dev/null}"
68+
69+
- uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
70+
with:
71+
node-version: 25.9.0
72+
cache: pnpm
73+
registry-url: https://registry.npmjs.org
3174
scope: '@socketsecurity'
32-
- run: npm install -g npm@latest
33-
- run: pnpm install
75+
76+
- name: Download sfw-free
77+
shell: bash
78+
env:
79+
GH_TOKEN: ${{ github.token }}
80+
run: | # zizmor: ignore[github-env]
81+
SFW_DIR="${RUNNER_TEMP:-/tmp}/sfw-bin"
82+
KERNEL="$(uname -s | cut -d- -f1)"
83+
ARCH="$(uname -m)"
84+
case "${KERNEL}-${ARCH}" in
85+
Linux-x86_64) ASSET="sfw-free-linux-x86_64" ; SFW_BIN="$SFW_DIR/sfw" ; EXPECTED_SHA256="4a1e8b65e90fce7d5fd066cf0af6c93d512065fa4222a475c8d959a6bc14b9ff" ;;
86+
Linux-aarch64) ASSET="sfw-free-linux-arm64" ; SFW_BIN="$SFW_DIR/sfw" ; EXPECTED_SHA256="df2eedb2daf2572eee047adb8bfd81c9069edcb200fc7d3710fca98ec3ca81a1" ;;
87+
Darwin-x86_64) ASSET="sfw-free-macos-x86_64" ; SFW_BIN="$SFW_DIR/sfw" ; EXPECTED_SHA256="724ccea19d847b79db8cc8e38f5f18ce2dd32336007f42b11bed7d2e5f4a2566" ;;
88+
Darwin-arm64) ASSET="sfw-free-macos-arm64" ; SFW_BIN="$SFW_DIR/sfw" ; EXPECTED_SHA256="bf1616fc44ac49f1cb2067fedfa127a3ae65d6ec6d634efbb3098cfa355e5555" ;;
89+
MINGW64_NT-x86_64|MSYS_NT-x86_64) ASSET="sfw-free-windows-x86_64.exe" ; SFW_BIN="$SFW_DIR/sfw.exe" ; EXPECTED_SHA256="c953e62ad7928d4d8f2302f5737884ea1a757babc26bed6a42b9b6b68a5d54af" ;;
90+
*) echo "Unsupported platform: ${KERNEL}-${ARCH}" >&2; exit 1 ;;
91+
esac
92+
if [ ! -x "$SFW_BIN" ]; then
93+
mkdir -p "$SFW_DIR"
94+
DOWNLOAD_URL="$(gh api repos/SocketDev/sfw-free/releases/latest \
95+
--jq ".assets[] | select(.name == \"$ASSET\") | .browser_download_url")"
96+
curl -fsSL -o "$SFW_BIN" "$DOWNLOAD_URL"
97+
ACTUAL_SHA256="$( (sha256sum "$SFW_BIN" 2>/dev/null || shasum -a 256 "$SFW_BIN") | cut -d' ' -f1 | tr -d '\\')"
98+
if [ "$ACTUAL_SHA256" != "$EXPECTED_SHA256" ]; then
99+
echo "Checksum mismatch for ${ASSET}!" >&2
100+
echo " Expected: ${EXPECTED_SHA256}" >&2
101+
echo " Actual: ${ACTUAL_SHA256}" >&2
102+
rm -f "$SFW_BIN"
103+
exit 1
104+
fi
105+
chmod +x "$SFW_BIN"
106+
fi
107+
echo "SFW_BIN=$SFW_BIN" >> "${GITHUB_ENV:-/dev/null}"
108+
109+
- name: Create sfw shims
110+
shell: bash
111+
run: | # zizmor: ignore[github-env]
112+
SHIM_DIR="${RUNNER_TEMP:-/tmp}/sfw-shim"
113+
rm -rf "$SHIM_DIR"
114+
mkdir -p "$SHIM_DIR"
115+
IS_WINDOWS=false
116+
[[ "$OSTYPE" == msys* || "$OSTYPE" == cygwin* ]] && IS_WINDOWS=true
117+
msys_to_win_path() {
118+
if $IS_WINDOWS && [[ "$1" =~ ^/([a-zA-Z])/(.*) ]]; then
119+
echo "${BASH_REMATCH[1]^^}:\\${BASH_REMATCH[2]//\//\\}"
120+
else
121+
echo "$1"
122+
fi
123+
}
124+
strip_shim_dir() { echo "$PATH" | tr ':' '\n' | grep -vxF "$SHIM_DIR" | paste -sd: -; }
125+
CLEAN_PATH="$(strip_shim_dir)"
126+
# https://docs.socket.dev/docs/socket-firewall-free#what-ecosystems-and-package-managers-are-supported
127+
for CMD in npm yarn pnpm pip uv cargo; do
128+
REAL="$(PATH="$CLEAN_PATH" command -v "$CMD" 2>/dev/null || true)"
129+
[ -z "$REAL" ] && continue
130+
REAL="$(msys_to_win_path "$REAL")"
131+
printf '%s\n' \
132+
'#!/bin/bash' \
133+
"export PATH=\"\$(echo \"\$PATH\" | tr ':' '\n' | grep -vxF '${SHIM_DIR}' | paste -sd: -)\"" \
134+
'export GIT_SSL_NO_VERIFY=true # Workaround: sfw-free does not yet set GIT_SSL_CAINFO.' \
135+
"exec \"${SFW_BIN}\" \"${REAL}\" \"\$@\"" \
136+
> "$SHIM_DIR/$CMD"
137+
chmod +x "$SHIM_DIR/$CMD"
138+
if $IS_WINDOWS; then
139+
printf '@echo off\r\nset "PATH=;%%PATH%%;"\r\nset "PATH=%%PATH:;%s;=;%%"\r\nset "PATH=%%PATH:~1,-1%%"\r\n"%s" "%s" %%*\r\n' \
140+
"$SHIM_DIR" "$SFW_BIN" "$REAL" > "$SHIM_DIR/$CMD.cmd"
141+
fi
142+
done
143+
echo "$SHIM_DIR" >> "${GITHUB_PATH:-/dev/null}"
144+
echo "SFW_SHIM_DIR=$SHIM_DIR" >> "${GITHUB_ENV:-/dev/null}"
145+
146+
- name: Install dependencies
147+
run: pnpm install --loglevel error
148+
34149
- run: INLINED_SOCKET_CLI_PUBLISHED_BUILD=1 pnpm run build:dist
35-
- run: npm publish --provenance --access public --tag ${{ inputs.dist-tag }}
150+
- run: npm publish --provenance --access public --tag "${NPM_DIST_TAG}"
36151
continue-on-error: true
37152
env:
153+
NPM_DIST_TAG: ${{ inputs.dist-tag }}
38154
NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
39155
SOCKET_CLI_DEBUG: ${{ inputs.debug }}
40156
- run: INLINED_SOCKET_CLI_PUBLISHED_BUILD=1 INLINED_SOCKET_CLI_LEGACY_BUILD=1 pnpm run build:dist
41157
env:
42158
SOCKET_CLI_DEBUG: ${{ inputs.debug }}
43-
- run: npm publish --provenance --access public --tag ${{ inputs.dist-tag }}
159+
- run: npm publish --provenance --access public --tag "${NPM_DIST_TAG}"
44160
continue-on-error: true
45161
env:
162+
NPM_DIST_TAG: ${{ inputs.dist-tag }}
46163
NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
47164
SOCKET_CLI_DEBUG: ${{ inputs.debug }}
48165
- run: INLINED_SOCKET_CLI_PUBLISHED_BUILD=1 INLINED_SOCKET_CLI_SENTRY_BUILD=1 pnpm run build:dist
49166
env:
50167
SOCKET_CLI_DEBUG: ${{ inputs.debug }}
51-
- run: npm publish --provenance --access public --tag ${{ inputs.dist-tag }}
168+
- run: npm publish --provenance --access public --tag "${NPM_DIST_TAG}"
52169
continue-on-error: true
53170
env:
171+
NPM_DIST_TAG: ${{ inputs.dist-tag }}
54172
NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
55173
SOCKET_CLI_DEBUG: ${{ inputs.debug }}

‎.github/workflows/socket-auto-pr.yml‎

Lines changed: 0 additions & 30 deletions
This file was deleted.

‎package.json‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -196,6 +196,7 @@
196196
"node": ">=18",
197197
"pnpm": ">=10.16.0"
198198
},
199+
"packageManager": "pnpm@10.33.0",
199200
"files": [
200201
"bin/**",
201202
"dist/**",

0 commit comments

Comments
 (0)