Skip to content

Commit d03f0be

Browse files
Sudo-IvanSudo-Ivan
committed
Harden repository against GitHub Actions supply-chain attacks.
1 parent 80f0ffd commit d03f0be

7 files changed

Lines changed: 48 additions & 0 deletions

File tree

‎.github/workflows/badges.yml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -34,6 +34,10 @@ jobs:
3434
permissions:
3535
contents: write
3636
steps:
37+
- name: Harden runner
38+
uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
39+
with:
40+
egress-policy: audit
3741
- name: Checkout
3842
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
3943
with:

‎.github/workflows/ci.yml‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -39,6 +39,10 @@ jobs:
3939
matrix:
4040
os: [ubuntu-latest, macos-latest, windows-latest]
4141
steps:
42+
- name: Harden runner
43+
uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
44+
with:
45+
egress-policy: audit
4246
- name: Checkout
4347
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
4448
with:
@@ -119,6 +123,10 @@ jobs:
119123
runs-on: ubuntu-latest
120124
timeout-minutes: 15
121125
steps:
126+
- name: Harden runner
127+
uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
128+
with:
129+
egress-policy: audit
122130
- name: Checkout
123131
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
124132
with:
@@ -141,6 +149,10 @@ jobs:
141149
runs-on: ubuntu-latest
142150
timeout-minutes: 15
143151
steps:
152+
- name: Harden runner
153+
uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
154+
with:
155+
egress-policy: audit
144156
- name: Checkout
145157
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
146158
with:
@@ -164,6 +176,10 @@ jobs:
164176
if: github.event_name == 'schedule' || (github.event_name == 'push' && github.ref == 'refs/heads/master')
165177
timeout-minutes: 20
166178
steps:
179+
- name: Harden runner
180+
uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
181+
with:
182+
egress-policy: audit
167183
- name: Checkout
168184
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
169185
with:

‎.github/workflows/lighthouse.yml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,10 @@ jobs:
3030
runs-on: ubuntu-latest
3131
timeout-minutes: 20
3232
steps:
33+
- name: Harden runner
34+
uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
35+
with:
36+
egress-policy: audit
3337
- name: Checkout
3438
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
3539
with:

‎.github/workflows/pages.yml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,10 @@ jobs:
3131
contents: read
3232
pages: write
3333
steps:
34+
- name: Harden runner
35+
uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
36+
with:
37+
egress-policy: audit
3438
- name: Checkout
3539
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
3640
with:
@@ -81,6 +85,10 @@ jobs:
8185
name: github-pages
8286
url: ${{ steps.deployment.outputs.page_url }}
8387
steps:
88+
- name: Harden runner
89+
uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
90+
with:
91+
egress-policy: audit
8492
- name: Deploy to GitHub Pages
8593
id: deployment
8694
uses: actions/deploy-pages@368f82528645a54fb793d4d04e342629a3f51346 # v5.0.1

‎.github/workflows/release.yml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -41,6 +41,10 @@ jobs:
4141
permissions:
4242
contents: write
4343
steps:
44+
- name: Harden runner
45+
uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
46+
with:
47+
egress-policy: audit
4448
- name: Checkout
4549
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
4650
with:
@@ -73,6 +77,10 @@ jobs:
7377
id-token: write
7478
attestations: write
7579
steps:
80+
- name: Harden runner
81+
uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
82+
with:
83+
egress-policy: audit
7684
- name: Checkout
7785
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
7886
with:

‎.github/workflows/scorecard.yml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -34,6 +34,10 @@ jobs:
3434
actions: read
3535

3636
steps:
37+
- name: Harden runner
38+
uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
39+
with:
40+
egress-policy: audit
3741
- name: Checkout
3842
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
3943
with:

‎.github/workflows/screenshots.yml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -32,6 +32,10 @@ jobs:
3232
runs-on: ubuntu-latest
3333
timeout-minutes: 20
3434
steps:
35+
- name: Harden runner
36+
uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
37+
with:
38+
egress-policy: audit
3539
- name: Checkout
3640
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
3741
with:

0 commit comments

Comments
 (0)