[peakematt]

Bun can save Socket Firewall tarball URLs in bun.lock, making later installs depend on an endpoint that contributors or external CI may not be able to access. This adds a pull-request workflow that repairs those URLs on the PR branch instead of asking contributors to clean them up manually.

This is the repository's first GitHub Actions workflow. It runs only for changes to the root bun.lock; pnpm-lock.yaml remains unchanged and outside its scope. It invokes the lockfile repair action at the full, verified GitHub-signed release SHA 195977cfa38ab4d70363af5403a106dbc54a61eb.

The action reads the committed PR head, restores Bun's native empty resolved-URL fields, and creates a single-file repair commit using GITHUB_TOKEN. Clean locks produce no commit. Dirty forks fail with repair guidance and are never written to; default-branch writes and stale-head overwrites are refused inside the action. Only the dedicated job receives contents: write. It checks out no project code, installs no dependencies, and receives no Socket Firewall secret.

Verified end-to-end on this draft: a controlled URL for the existing chalk@5.6.2 lock entry triggered the pinned action. It created a verified github-actions[bot] commit changing only bun.lock, preserving the version/integrity and restoring the original file byte-for-byte. The final PR diff contains only the new workflow.

Successful repair run:
https://github.com/workos/case/actions/runs/34882514144

Repair commit:
cb605c1

From the repository root, with Git and actionlint installed:

actionlint .github/workflows/scrub-socket-firewall-lockfile.yml
git diff --check origin/main...HEAD
git diff --exit-code origin/main...HEAD -- bun.lock pnpm-lock.yaml

These checks passed. Local tests using the actual released normalizer also verified exact restoration and clean-file idempotence; the released controller suite covers fork and stale/default-branch guards. No external-fork PR was created for this rollout test. The ca CLI was not installed locally, so its session/bootstrap/convention checks were not run. No application source changed.

Token-created commits may leave follow-up CI suppressed or awaiting approval. This workflow validates and repairs the lockfile; it is not a general application test pipeline.

Tracking:
https://linear.app/workos/issue/HELP-723

[linear-code]

HELP-723

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.

[greptile-apps]

Confidence Score: 5/5

The PR appears safe to merge with no actionable correctness, security, or repository-rule issues identified.

Summary

• Runs only when a pull request changes bun.lock.
• Grants contents: write only to the repair job.
• Invokes the repair action at a full commit SHA without checking out or executing project code.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart TD
  A[Pull request changes bun.lock] --> B[Repair bun.lock job]
  B --> C[Pinned lockfile-scrub action]
  C --> D{Socket Firewall URLs present?}
  D -->|No| E[Complete without a commit]
  D -->|Yes, writable PR head| F[Commit repaired bun.lock]
  D -->|Fork or unsafe target| G[Refuse write and provide guidance]

Loading

_{Reviews (1) · Last reviewed commit: "chore: normalize lockfile registry URLs"}