release: prepare stable Codex Security npm publishing (#12)

* release: publish stable Codex Security versions

* release: validate stable npm tags against package metadata

* release: harden public npm publishing and contributor guidance

* fix: complete the stable Codex Security npm package

Add the three exact plugin projection-contract files from the merged monorepo and remove issue, Dependabot, and pull request templates unrelated to publishing.

* fix: keep internal OWNERS out of the public npm package

The current package inspector intentionally excludes internal ownership metadata and requires only the public plugin manifest plus shipped skill files. Retain the two policy skill files and remove the non-public OWNERS file.

* fix: harden stable npm release safeguards

* fix: retain bundled plugin in stable release

* fix: remove internal links from release workflow

* fix(release): keep socket firewall public-compatible

* fix(release): validate firewall cutoff dates

* fix: restore public SDK cross-platform CI

* fix(release): make stable trusted publishing runnable

* fix(release): always enforce Socket Firewall

* fix(release): validate firewall-backed trusted publishing

* fix: harden trusted npm publishing

* fix: bootstrap protected first npm publication

Author: mldangelo-oai

.github/workflows/node-release.yml

@@ -10,14 +10,19 @@ concurrency:
   cancel-in-progress: false
 
 jobs:
-  publish:
+  verify:
     if: github.repository == 'openai/codex-security'
-    name: publish
+    name: verify
     runs-on: ubuntu-latest
-    environment: npm
     permissions:
       contents: read
-      id-token: write
+    env:
+      NPM_CONFIG_REGISTRY: https://openai.firewall.socket.dev/npm/
+      PNPM_CONFIG_REGISTRY: https://openai.firewall.socket.dev/npm/
+      COREPACK_NPM_REGISTRY: https://openai.firewall.socket.dev/npm/
+      BUN_CONFIG_REGISTRY: https://openai.firewall.socket.dev/npm/
+    outputs:
+      artifact-id: ${{ steps.upload.outputs.artifact-id }}
 
     steps:
       - name: Checkout repository
@@ -26,21 +31,37 @@ jobs:
           fetch-depth: 0
           persist-credentials: false
 
+      - name: Set up Socket Firewall
+        uses: SocketDev/action@937f824ec476dfd164d4a4d9995751427b0be143 # v1
+        with:
+          mode: firewall-free
+          firewall-version: "1.15.0"
+
       - name: Set up Node.js
         uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6
         with:
           node-version: "22"
-          registry-url: "https://registry.npmjs.org"
+          package-manager-cache: false
 
-      # Socket Firewall installed by security
-      # https://app.notion.com/p/openai/Socket-Firewall-33c8e50b62b0802a82cee42fd51e2c01?source=copy_link#3768e50b62b0806097edebce817e14a5
-      # Slack: #socket-firewall
       - name: Activate Socket Firewall
-        uses: openai/socket-firewall@40af4b6b4b00fb88c59af22858dc9f15e077617d # v0.1.0
-        with:
-          disabled-until: ${{ vars.SOCKET_FIREWALL_DISABLED_UNTIL }}
-      - name: Set up npm trusted publishing
-        run: npm install --global npm@11.15.0
+        shell: bash
+        run: |
+          set -euo pipefail
+
+          npm_registry="https://openai.firewall.socket.dev/npm/"
+          pypi_registry="https://openai.firewall.socket.dev/pypi/simple/"
+          {
+            printf 'NPM_CONFIG_REGISTRY=%s\n' "$npm_registry"
+            printf 'npm_config_registry=%s\n' "$npm_registry"
+            printf 'PNPM_CONFIG_REGISTRY=%s\n' "$npm_registry"
+            printf 'pnpm_config_registry=%s\n' "$npm_registry"
+            printf 'COREPACK_NPM_REGISTRY=%s\n' "$npm_registry"
+            printf 'YARN_NPM_REGISTRY_SERVER=%s\n' "$npm_registry"
+            printf 'BUN_CONFIG_REGISTRY=%s\n' "$npm_registry"
+            printf 'UV_DEFAULT_INDEX=%s\n' "$pypi_registry"
+            printf 'UV_INDEX_URL=%s\n' "$pypi_registry"
+            printf 'PIP_INDEX_URL=%s\n' "$pypi_registry"
+          } >> "$GITHUB_ENV"
 
       - name: Set up Bun
         uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
@@ -56,9 +77,14 @@ jobs:
         shell: bash
         run: |
           set -euo pipefail
+          if [[ ! "$GITHUB_REF_NAME" =~ ^npm-v(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)$ ]]; then
+            echo "npm release tags must identify a stable release, such as npm-v0.1.0." >&2
+            exit 1
+          fi
           version="${GITHUB_REF_NAME#npm-v}"
-          if [[ ! "$version" =~ ^[0-9]+\.[0-9]+\.[0-9]+-beta\.[0-9]+$ ]]; then
-            echo "npm release tags must identify a beta release, such as npm-v0.1.0-beta.4." >&2
+          package_version="$(node -p 'require("./sdk/typescript/package.json").version')"
+          if [[ "$version" != "$package_version" ]]; then
+            echo "npm release tag $version must match package version $package_version." >&2
             exit 1
           fi
           git fetch origin main
@@ -69,12 +95,7 @@ jobs:
           echo "version=$version" >> "$GITHUB_OUTPUT"
 
       - name: Install dependencies
-        run: pnpm --dir sdk/typescript install --frozen-lockfile
-
-      - name: Set package version
-        env:
-          SDK_VERSION: ${{ steps.release.outputs.version }}
-        run: pnpm --dir sdk/typescript version "$SDK_VERSION" --no-git-tag-version
+        run: sfw pnpm --dir sdk/typescript install --frozen-lockfile
 
       - name: Verify
         run: |
@@ -99,10 +120,82 @@ jobs:
           consumer="$(mktemp -d)"
           trap 'rm -rf "$consumer"' EXIT
           printf '%s\n' '{"name":"codex-security-smoke","private":true,"type":"module"}' > "$consumer/package.json"
-          npm install --prefix "$consumer" --include=optional --no-audit --no-fund ./dist/*.tgz
+          sfw npm install --ignore-scripts --prefix "$consumer" --include=optional --no-audit --no-fund ./dist/*.tgz
           (cd "$consumer" && node --input-type=module --eval 'const sdk = await import("@openai/codex-security"); if (typeof sdk.CodexSecurity !== "function") process.exit(1);')
           "$consumer/node_modules/.bin/codex-security" --version
           "$consumer/node_modules/.bin/codex-security" --help
 
-      - name: Publish to npm
-        run: npm publish dist/*.tgz --provenance --access public --tag beta
+      - name: Upload verified package
+        id: upload
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: npm-release-tarball
+          path: dist/*.tgz
+          if-no-files-found: error
+          retention-days: 30
+          compression-level: 0
+
+  publish:
+    if: github.repository == 'openai/codex-security'
+    name: publish
+    needs: verify
+    runs-on: ubuntu-latest
+    environment: npm
+    permissions:
+      contents: read
+      id-token: write
+
+    steps:
+      - name: Set up Node.js
+        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6
+        with:
+          node-version: "24"
+          registry-url: "https://registry.npmjs.org"
+          package-manager-cache: false
+
+      - name: Verify bundled trusted-publishing npm
+        shell: bash
+        run: |
+          set -euo pipefail
+          node --eval '
+            const version = process.argv[1];
+            const match = /^(\d+)\.(\d+)\.(\d+)$/.exec(version);
+            const [major, minor, patch] = match?.slice(1).map(Number) ?? [];
+            if (
+              !match ||
+              major < 11 ||
+              (major === 11 && (minor < 5 || (minor === 5 && patch < 1)))
+            ) {
+              console.error(
+                "npm 11.5.1 or newer is required for trusted publishing; found " +
+                  version +
+                  ".",
+              );
+              process.exit(1);
+            }
+          ' "$(npm --version)"
+
+      - name: Download verified package
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          artifact-ids: ${{ needs.verify.outputs.artifact-id }}
+          path: dist
+          merge-multiple: true
+          digest-mismatch: error
+
+      - name: Publish initial npm release
+        if: github.ref_name == 'npm-v0.1.0'
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_FIRST_PUBLISH_TOKEN }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          if [[ -z "${NODE_AUTH_TOKEN:-}" ]]; then
+            echo "Security Products must configure NPM_FIRST_PUBLISH_TOKEN in the protected npm environment before the initial release." >&2
+            exit 1
+          fi
+          npm publish ./dist/*.tgz --provenance --access public --tag latest
+
+      - name: Publish to npm using trusted publishing
+        if: github.ref_name != 'npm-v0.1.0'
+        run: npm publish ./dist/*.tgz --provenance --access public --tag latest