[StepSecurity] ci: Harden GitHub Actions (#17780)

2024-03-22 15:32:23 -05:00
parent b6ab842db2
commit 6ebc308eb4
41 changed files with 305 additions and 0 deletions
@@ -45,6 +45,11 @@ jobs:
        # https://docs.github.com/en/free-pro-team@latest/github/finding-security-vulnerabilities-and-errors-in-your-code/configuring-code-scanning#changing-the-languages-that-are-analyzed

    steps:
+    - name: Harden Runner
+      uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0
+      with:
+        egress-policy: audit
+
    - name: Checkout repository
      uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3