From aa9c19e33592c0390c061d0258c5979f22235169 Mon Sep 17 00:00:00 2001 From: StepSecurity Bot Date: Fri, 24 Jan 2025 19:23:31 +0000 Subject: [PATCH] [StepSecurity] ci: Harden GitHub Actions Signed-off-by: StepSecurity Bot --- .github/workflows/build.yml | 8 ++++++++ .github/workflows/release.yml | 10 ++++++++++ 2 files changed, 18 insertions(+) diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 460ed1c8..bf6c4256 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -5,10 +5,18 @@ on: - main pull_request: +permissions: + contents: read + jobs: CI: runs-on: ubuntu-latest steps: + - name: Harden Runner + uses: step-security/harden-runner@v2 + with: + egress-policy: audit + - uses: actions/checkout@v4 - uses: actions/setup-node@v4 with: diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index dfd2b128..d4220379 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -21,6 +21,11 @@ jobs: runs-on: ubuntu-latest environment: CD steps: + - name: Harden Runner + uses: step-security/harden-runner@v2 + with: + egress-policy: audit + - uses: actions/checkout@v4 with: fetch-depth: 0 @@ -62,6 +67,11 @@ jobs: runs-on: ubuntu-latest needs: build steps: + - name: Harden Runner + uses: step-security/harden-runner@v2 + with: + egress-policy: audit + - name: Deploy to GitHub Pages id: deployment uses: actions/deploy-pages@v4