feat: Add step-security/harden-runner to GHA

markdown-confluence · Apr 21, 2023 · f49c627 · f49c627
1 parent 979bc93
commit f49c627
Show file tree

Hide file tree

Showing 4 changed files with 21 additions and 0 deletions.
diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml
@@ -23,6 +23,11 @@ jobs:
       pages: write
       id-token: write
     steps:
+    - name: Harden Runner
+      uses: step-security/harden-runner@6b3083af2869dc3314a0257a42f4af696cc79ba3 # v2.3.1
+      with:
+        egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
+
     - uses: actions/checkout@v3
       with:
         fetch-depth: 0

diff --git a/.github/workflows/pr-check.yml b/.github/workflows/pr-check.yml
@@ -22,6 +22,11 @@ jobs:
       build_status: ${{ steps.build.outcome }}
 
     steps:
+    - name: Harden Runner
+      uses: step-security/harden-runner@6b3083af2869dc3314a0257a42f4af696cc79ba3 # v2.3.1
+      with:
+        egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
+
     - name: Check out repository code
       uses: actions/checkout@v3
 

diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml
@@ -14,6 +14,11 @@ jobs:
   release-please:
     runs-on: ubuntu-latest
     steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@6b3083af2869dc3314a0257a42f4af696cc79ba3 # v2.3.1
+        with:
+          egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
+
       - name: Checkout repository
         uses: actions/checkout@v3
 

diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
@@ -31,6 +31,12 @@ jobs:
       # actions: read
 
     steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@6b3083af2869dc3314a0257a42f4af696cc79ba3 # v2.3.1
+        with:
+          egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
+
+
       - name: "Checkout code"
         uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # v3.1.0
         with: