ci: block compromised npm packages with Socket Firewall Free

[RedStar071]

Context

Replicates npmx-dev/npmx.dev#2889 on this codebase.

The npm ecosystem has been hit repeatedly by supply-chain attacks. Socket Firewall Free (sfw) blocks known-malicious package versions at download time, failing the install before anything is written or any lifecycle/postinstall script runs. Socket typically flags these packages within ~5 minutes of publish, which covers the ~3-36 hour window before npm unpublishes them. It is free, with no licence, account, or attribution required.

voidzero-dev/setup-vp gained built-in support for this in v1.12.0 (setup-vp#72), so opting in is just sfw: true.

Changes

Bump voidzero-dev/setup-vp from v1.10.0 to v1.12.0 across all workflows and enable sfw: true on every job that installs dependencies.

• ci.yml: add sfw: true to unit, test, browser, benchmark, a11y, perf, and knip; convert the lint job's separate vp install --filter . --ignore-scripts step into setup-vp's run-install config so the install is guarded by sfw.
• autofix.yml: bump + sfw: true.
• chromatic.yml: bump + sfw: true; drop the global vp install -g pnpm step and pass buildCommand: vp run build-storybook / outputDir: storybook-static to chromaui/action directly, so it no longer needs to detect the package manager (storybook-static is already in .gitignore).
• release-tag.yml: install dependencies through setup-vp's run-install with sfw: true instead of a bare vp install.
• release-pr.yml: version bump only (this workflow has no install step).

Notes on differences from the source PR

The npmx PR also touched deploy-canary.yml (adds SocketDev/action) and lunaria.yml, plus a .github/zizmor.yml line-reference tied to lunaria. This repo has neither workflow, and our .github/zizmor.yml has no stale-action-refs entry, so those parts don't apply here.

The pinned v1.12.0 SHA (2dec1e33f4ab2c6d5bce1b0c4607961bb1a3f7a1) was verified against the upstream v1.12.0 tag. All edited workflow files were validated as parseable YAML.

---

^{Need help on this PR? Tag /codesmith with what you need. Autofix is enabled.}

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[Workflow trigger] --> B[actions/checkout]
    B --> C[voidzero-dev/setup-vp v1.12.0]
    C --> D{run-install?}
    D -->|false| E[Toolchain only\nNo packages installed]
    D -->|default / config| F[Activate sfw interceptor]
    F --> G[Run package install\nvp install with args]
    G --> H{Package flagged\nby Socket?}
    H -->|Yes - known malicious| I[❌ Install fails\nWorkflow blocked]
    H -->|No| J[✅ Packages installed\nWorkflow continues]
    E --> K[Downstream steps\ne.g. version/tag in release-tag.yml]
    K --> L[Second setup-vp call\nwith sfw:true]
    L --> F

    style I fill:#ff4444,color:#fff
    style J fill:#44bb44,color:#fff
    style F fill:#ff8800,color:#fff

Loading

%%{init: {'theme': 'base', 'themeVariables': {"darkMode": true, "background": "#0d1117", "primaryColor": "#21262d", "primaryTextColor": "#e6edf3", "primaryBorderColor": "#8b949e", "lineColor": "#8b949e", "textColor": "#e6edf3", "edgeLabelBackground": "#161b22", "actorBkg": "#21262d", "actorBorder": "#8b949e", "actorTextColor": "#e6edf3", "actorLineColor": "#8b949e", "signalColor": "#8b949e", "signalTextColor": "#e6edf3", "noteBkgColor": "#373320", "noteBorderColor": "#d4a72c", "noteTextColor": "#f0e6c0", "labelBoxBkgColor": "#21262d", "labelBoxBorderColor": "#8b949e", "labelTextColor": "#e6edf3", "loopTextColor": "#e6edf3", "activationBkgColor": "#30363d", "activationBorderColor": "#8b949e"}}}%%
flowchart TD
    A[Workflow trigger] --> B[actions/checkout]
    B --> C[voidzero-dev/setup-vp v1.12.0]
    C --> D{run-install?}
    D -->|false| E[Toolchain only\nNo packages installed]
    D -->|default / config| F[Activate sfw interceptor]
    F --> G[Run package install\nvp install with args]
    G --> H{Package flagged\nby Socket?}
    H -->|Yes - known malicious| I[❌ Install fails\nWorkflow blocked]
    H -->|No| J[✅ Packages installed\nWorkflow continues]
    E --> K[Downstream steps\ne.g. version/tag in release-tag.yml]
    K --> L[Second setup-vp call\nwith sfw:true]
    L --> F

    style I fill:#ff4444,color:#fff
    style J fill:#44bb44,color:#fff
    style F fill:#ff8800,color:#fff

Loading

_{Reviews (2): Last reviewed commit: "ci: document two-step setup-vp pattern i..." | Re-trigger Greptile}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 68.54%. Comparing base (bd3107e) to head (f6ac8fb).
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #254   +/-   ##
=======================================
  Coverage   68.54%   68.54%           
=======================================
  Files         122      122           
  Lines        2651     2651           
  Branches      572      572           
=======================================
  Hits         1817     1817           
  Misses        433      433           
  Partials      401      401           

Flag	Coverage Δ
component	57.74% <ø> (ø)
unit	68.66% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[codspeed-hq]

Merging this PR will not alter performance

✅ 44 untouched benchmarks

---

_{Comparing ci/use-socket-firewall-free (f6ac8fb) with main (bd3107e)}

[greptile-apps]

Want your agent to iterate on Greptile's feedback? Try greploops.

[lorypelli]

LGTM!