From 98629dd36c5aaedc746a35237f7b755d820e9d23 Mon Sep 17 00:00:00 2001 From: Matt Peake Date: Mon, 14 Sep 2026 14:43:01 -0400 Subject: [PATCH 1/2] chore(ci): repair Socket Firewall URLs in bun.lock Use the verified signed action release in a dedicated PR job. Include one controlled tarball URL to prove the action repairs the PR branch itself; the bot should restore the original lockfile exactly. --- .../scrub-socket-firewall-lockfile.yml | 19 +++++++++++++++++++ bun.lock | 2 +- 2 files changed, 20 insertions(+), 1 deletion(-) create mode 100644 .github/workflows/scrub-socket-firewall-lockfile.yml diff --git a/.github/workflows/scrub-socket-firewall-lockfile.yml b/.github/workflows/scrub-socket-firewall-lockfile.yml new file mode 100644 index 0000000..ca22f50 --- /dev/null +++ b/.github/workflows/scrub-socket-firewall-lockfile.yml @@ -0,0 +1,19 @@ +name: Repair lockfile registry URLs + +on: + pull_request: + paths: [bun.lock] + +permissions: {} + +jobs: + repair: + name: Repair bun.lock + runs-on: ubuntu-latest + timeout-minutes: 5 + permissions: + contents: write + steps: + # Reads the PR head through GitHub's API; no checkout or install is needed. + - name: Repair Socket Firewall URLs + uses: workos/setup-socket-firewall/lockfile-scrub@195977cfa38ab4d70363af5403a106dbc54a61eb # v1 diff --git a/bun.lock b/bun.lock index c5696e9..7092073 100644 --- a/bun.lock +++ b/bun.lock @@ -296,7 +296,7 @@ "bun-types": ["bun-types@1.3.14", "", { "dependencies": { "@types/node": "*" } }, "sha512-4N0ig0fEomHt5R0KCFWjovxow98rIoRwKolrYdCcknNwMekCXRnWEUvgu5soYV8QXtVsrUD8B95MBOZGPvr6KQ=="], - "chalk": ["chalk@5.6.2", "", {}, "sha512-7NzBL0rN6fMUW+f7A6Io4h40qQlG+xGmtMxfbnH/K7TAtt8JQWVQK+6g0UXKMeVJoyV5EkkNsErQ8pVD3bLHbA=="], + "chalk": ["chalk@5.6.2", "https://socket-firewall.workos.dev/chalk/-/chalk-5.6.2.tgz", {}, "sha512-7NzBL0rN6fMUW+f7A6Io4h40qQlG+xGmtMxfbnH/K7TAtt8JQWVQK+6g0UXKMeVJoyV5EkkNsErQ8pVD3bLHbA=="], "cli-highlight": ["cli-highlight@2.1.11", "", { "dependencies": { "chalk": "^4.0.0", "highlight.js": "^10.7.1", "mz": "^2.4.0", "parse5": "^5.1.1", "parse5-htmlparser2-tree-adapter": "^6.0.0", "yargs": "^16.0.0" }, "bin": { "highlight": "bin/highlight" } }, "sha512-9KDcoEVwyUXrjcJNvHD0NFc/hiwe/WPVYIleQh2O1N2Zro5gWJZ/K+3DGn8w8P/F6FxOgzyC5bxDyHIgCSPhGg=="], From cb605c1cedd439b2718e5dcb1760bda3eb2a5978 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Mon, 14 Sep 2026 18:43:19 +0000 Subject: [PATCH 2/2] chore: normalize lockfile registry URLs --- bun.lock | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/bun.lock b/bun.lock index 7092073..c5696e9 100644 --- a/bun.lock +++ b/bun.lock @@ -296,7 +296,7 @@ "bun-types": ["bun-types@1.3.14", "", { "dependencies": { "@types/node": "*" } }, "sha512-4N0ig0fEomHt5R0KCFWjovxow98rIoRwKolrYdCcknNwMekCXRnWEUvgu5soYV8QXtVsrUD8B95MBOZGPvr6KQ=="], - "chalk": ["chalk@5.6.2", "https://socket-firewall.workos.dev/chalk/-/chalk-5.6.2.tgz", {}, "sha512-7NzBL0rN6fMUW+f7A6Io4h40qQlG+xGmtMxfbnH/K7TAtt8JQWVQK+6g0UXKMeVJoyV5EkkNsErQ8pVD3bLHbA=="], + "chalk": ["chalk@5.6.2", "", {}, "sha512-7NzBL0rN6fMUW+f7A6Io4h40qQlG+xGmtMxfbnH/K7TAtt8JQWVQK+6g0UXKMeVJoyV5EkkNsErQ8pVD3bLHbA=="], "cli-highlight": ["cli-highlight@2.1.11", "", { "dependencies": { "chalk": "^4.0.0", "highlight.js": "^10.7.1", "mz": "^2.4.0", "parse5": "^5.1.1", "parse5-htmlparser2-tree-adapter": "^6.0.0", "yargs": "^16.0.0" }, "bin": { "highlight": "bin/highlight" } }, "sha512-9KDcoEVwyUXrjcJNvHD0NFc/hiwe/WPVYIleQh2O1N2Zro5gWJZ/K+3DGn8w8P/F6FxOgzyC5bxDyHIgCSPhGg=="],