From adb7c3ef3c69535344e7ad2923459bb675452722 Mon Sep 17 00:00:00 2001 From: "stepsecurity-app[bot]" <188008098+stepsecurity-app[bot]@users.noreply.github.com> Date: Wed, 1 Jul 2026 17:30:46 +0000 Subject: [PATCH] [StepSecurity] Apply security best practices Signed-off-by: StepSecurity Bot --- .github/workflows/docker-build.yml | 6 ++++++ .github/workflows/python-package.yml | 6 ++++++ 2 files changed, 12 insertions(+) diff --git a/.github/workflows/docker-build.yml b/.github/workflows/docker-build.yml index 2f5004516..2d332f34f 100644 --- a/.github/workflows/docker-build.yml +++ b/.github/workflows/docker-build.yml @@ -14,6 +14,12 @@ jobs: runs-on: ubuntu-latest steps: + - name: Harden the runner + uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2 + with: + use-policy-store: true + api-key: ${{ secrets.GH_FRESHAENGINEERING_STEP_SECURITY_API_KEY }} + - name: checkout uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2 diff --git a/.github/workflows/python-package.yml b/.github/workflows/python-package.yml index 0dfb6514b..887c9d6ff 100644 --- a/.github/workflows/python-package.yml +++ b/.github/workflows/python-package.yml @@ -22,6 +22,12 @@ jobs: python-version: [3.7, 3.8, 3.9, "3.10"] steps: + - name: Harden the runner + uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2 + with: + use-policy-store: true + api-key: ${{ secrets.GH_FRESHAENGINEERING_STEP_SECURITY_API_KEY }} + - uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2 - name: Set up Python ${{ matrix.python-version }} uses: actions/setup-python@d09bd5e6005b175076f227b13d9730d56e9dcfcb # v4.0.0