feat: auto-fix Bun and npm lockfiles on PR branches

[peakematt]

Socket Firewall URLs saved in lockfiles can bind later installs to an endpoint that contributors or external CI cannot access. Bun can record those URLs directly; npm has a preventive omit-lockfile-registry-resolved setting, but also benefits from a cleanup backstop. Detecting or editing runner files alone does not repair the pull request branch.

This action fixes the branch itself. One invocation of workos/setup-socket-firewall/lockfile-scrub reads the selected committed lockfile from the PR head, normalizes it, and creates a commit on that same PR branch using GITHUB_TOKEN. It defaults to mode: fix and lockfile: bun.lock. The caller grants contents: write; no checkout, dependency installation, or separate commit/push step is required.

Bun URLs become the native empty resolved-URL field. npm package-lock.json and npm-shrinkwrap.json versions 1–3 retain their tarball paths with registry.npmjs.org replacing the Socket Firewall origin in resolved values. Nested repository-relative paths are supported. A clean file creates no commit; explicit mode: check reports whether repair is needed without writing. Outputs include changed and the repair commit-sha.

The action—not caller shell code—enforces branch safety. It accepts ordinary pull_request events, rejects default-branch writes, fails dirty forks with repair guidance, and refuses stale PR heads. GitHub's atomic createCommitOnBranch operation checks the expected head SHA and changes only the selected file, so a concurrent contributor push is not overwritten. It neither force-pushes nor retries denied or ambiguous writes. The Node 24 action runs only its own normalizer in an isolated directory; it does not execute target-repository code or pass the token to that subprocess.

A live test on this draft PR proved the complete path: the action created a verified github-actions[bot] commit, replacing the test Bun URL with an empty field while changing only that lockfile. The temporary trial workflow and fixture were removed afterward.

• Repair commit: c66640c
• Successful live run: https://github.com/workos/setup-socket-firewall/actions/runs/34844728085

From the repository root, with Bash and Node.js 24+, these offline checks exercise branch-write guards, transformations, and the packaged release runtime without dependencies or live credentials:

node --test scripts/fix-lockfile.test.mjs scripts/scrub-npm-lockfile.test.mjs
bash scripts/scrub-lockfile.test.sh
bash scripts/build-release.test.sh

All 49 Node tests and the existing shell/release suites passed locally, along with ShellCheck, shfmt, and workflow linting. The six npm install smoke combinations and protected-registry smoke remain in CI.

Do not rely on GITHUB_TOKEN commits to run follow-up CI automatically. In the live trial, GitHub created action_required follow-up runs with no jobs executed; a repaired lockfile is not proof of fresh-head application CI. This PR supplies the complete self-fixing action, but does not yet install it in the four target repositories. Those workflows must use the signed action-only release SHA after source merge. Yarn and pnpm scrubbing remain out of scope.

Tracking: https://linear.app/workos/issue/HELP-723

[peakematt]

@greptile

[greptile-apps]

Confidence Score: 5/5

The current head appears safe to merge with no remaining actionable findings.

Summary

• Normalizes supported lockfiles without executing target-repository code.
• Uses GitHub’s atomic branch-commit API with stale-head, fork, and default-branch protections.
• Adds unit, release-tree, npm compatibility, and protected-registry smoke coverage.
• Documents permissions, supported formats, operational constraints, and follow-up CI limitations.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart TD
  A[pull_request event] --> B[Validate event, repository, mode, and lockfile path]
  B --> C[Fetch current PR metadata]
  C --> D{Open and event head still current?}
  D -- No --> X[Fail without writing]
  D -- Yes --> E[Read lockfile blob from PR head]
  E --> F[Normalize in isolated temporary directory]
  F --> G{Repair needed?}
  G -- No --> H[Return changed=false]
  G -- Yes --> I{Mode is check?}
  I -- Yes --> J[Return changed=true without commit]
  I -- No --> K{Same-repository, non-default branch?}
  K -- No --> X
  K -- Yes --> L[Create atomic single-file commit using expected head SHA]
  L --> M[Return changed=true and commit SHA]

Loading

_{Reviews (3) · Last reviewed commit: "docs: reflect observed bot-commit CI app..."}

[devin-ai-integration]

Devin Review found 1 potential issue.

[peakematt]

[from Pi]: @greptile please re-review the current head, dfe43cb, and report any remaining actionable findings and the updated confidence score. The Devin permission finding has been investigated: GitHub documents that GET /repos/{owner}/{repo}/pulls/{pull_number} accepts either Contents: read or Pull requests: read, so the existing contents: write permission suffices. Evidence is recorded in the resolved thread. No code or permission changes were made.