Skip to content

Commit ba6bc4c

Browse files
gmpindergmpinder
committed
chore: Add Harden Runner
1 parent bce0e1d commit ba6bc4c

5 files changed

Lines changed: 94 additions & 3 deletions

File tree

‎.github/workflows/build.yml‎

Lines changed: 16 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,11 @@ jobs:
1818
runs-on: ubuntu-24.04-arm
1919

2020
steps:
21+
- name: Harden Runner
22+
uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
23+
with:
24+
egress-policy: audit
25+
2126
- uses: earthly/actions-setup@43211c7a0eae5344d6d79fb4aaf209c8f8866203 # v1.0.13
2227
with:
2328
use-cache: false
@@ -47,6 +52,11 @@ jobs:
4752
runs-on: ubuntu-latest
4853

4954
steps:
55+
- name: Harden Runner
56+
uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
57+
with:
58+
egress-policy: audit
59+
5060
- uses: earthly/actions-setup@43211c7a0eae5344d6d79fb4aaf209c8f8866203 # v1.0.13
5161
with:
5262
use-cache: false
@@ -83,6 +93,11 @@ jobs:
8393
- amd64-prebuild
8494

8595
steps:
96+
- name: Harden Runner
97+
uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
98+
with:
99+
egress-policy: audit
100+
86101
- name: Maximize build space
87102
uses: ublue-os/remove-unwanted-software@cc0becac701cf642c8f0a6613bbdaf5dc36b259e # v9
88103

@@ -95,7 +110,7 @@ jobs:
95110

96111
# Setup repo and add caching
97112
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
98-
with:
113+
with:
99114
persist-credentials: false
100115
fetch-depth: 0
101116
ref: ${{ inputs.ref }}

‎.github/workflows/flakehub-tagged.yml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,10 @@ jobs:
1616
id-token: "write"
1717
contents: "read"
1818
steps:
19+
- name: Harden Runner
20+
uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
21+
with:
22+
egress-policy: audit
1923
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
2024
with:
2125
persist-credentials: false

‎.github/workflows/tag.yml‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,10 @@ jobs:
1414
runs-on: ubuntu-24.04-arm
1515

1616
steps:
17+
- name: Harden Runner
18+
uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
19+
with:
20+
egress-policy: audit
1721
- uses: earthly/actions-setup@43211c7a0eae5344d6d79fb4aaf209c8f8866203 # v1.0.13
1822
with:
1923
use-cache: false
@@ -42,6 +46,10 @@ jobs:
4246
runs-on: ubuntu-latest
4347

4448
steps:
49+
- name: Harden Runner
50+
uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
51+
with:
52+
egress-policy: audit
4553
- uses: earthly/actions-setup@43211c7a0eae5344d6d79fb4aaf209c8f8866203 # v1.0.13
4654
with:
4755
use-cache: false
@@ -75,6 +83,10 @@ jobs:
7583
- amd64-prebuild
7684

7785
steps:
86+
- name: Harden Runner
87+
uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
88+
with:
89+
egress-policy: audit
7890
- name: Maximize build space
7991
uses: ublue-os/remove-unwanted-software@cc0becac701cf642c8f0a6613bbdaf5dc36b259e # v9
8092

‎.github/workflows/test.yml‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,10 @@ jobs:
2222
runs-on: ubuntu-latest
2323

2424
steps:
25+
- name: Harden Runner
26+
uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
27+
with:
28+
egress-policy: audit
2529
- uses: earthly/actions-setup@43211c7a0eae5344d6d79fb4aaf209c8f8866203 # v1.0.13
2630
with:
2731
use-cache: false
@@ -43,6 +47,10 @@ jobs:
4347
runs-on: ubuntu-latest
4448

4549
steps:
50+
- name: Harden Runner
51+
uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
52+
with:
53+
egress-policy: audit
4654
- uses: earthly/actions-setup@43211c7a0eae5344d6d79fb4aaf209c8f8866203 # v1.0.13
4755
with:
4856
use-cache: false
@@ -67,6 +75,10 @@ jobs:
6775
runs-on: ubuntu-latest
6876

6977
steps:
78+
- name: Harden Runner
79+
uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
80+
with:
81+
egress-policy: audit
7082
- name: Maximize build space
7183
uses: ublue-os/remove-unwanted-software@cc0becac701cf642c8f0a6613bbdaf5dc36b259e # v9
7284

@@ -97,6 +109,10 @@ jobs:
97109
id-token: write
98110

99111
steps:
112+
- name: Harden Runner
113+
uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
114+
with:
115+
egress-policy: audit
100116
- name: Maximize build space
101117
uses: ublue-os/remove-unwanted-software@cc0becac701cf642c8f0a6613bbdaf5dc36b259e # v9
102118

@@ -136,6 +152,10 @@ jobs:
136152
id-token: write
137153

138154
steps:
155+
- name: Harden Runner
156+
uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
157+
with:
158+
egress-policy: audit
139159
- name: Maximize build space
140160
uses: ublue-os/remove-unwanted-software@cc0becac701cf642c8f0a6613bbdaf5dc36b259e # v9
141161

@@ -175,6 +195,10 @@ jobs:
175195
id-token: write
176196

177197
steps:
198+
- name: Harden Runner
199+
uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
200+
with:
201+
egress-policy: audit
178202
- name: Maximize build space
179203
uses: ublue-os/remove-unwanted-software@cc0becac701cf642c8f0a6613bbdaf5dc36b259e # v9
180204

@@ -215,6 +239,10 @@ jobs:
215239
id-token: write
216240

217241
steps:
242+
- name: Harden Runner
243+
uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
244+
with:
245+
egress-policy: audit
218246
- name: Maximize build space
219247
uses: ublue-os/remove-unwanted-software@cc0becac701cf642c8f0a6613bbdaf5dc36b259e # v9
220248

@@ -256,6 +284,10 @@ jobs:
256284
id-token: write
257285

258286
steps:
287+
- name: Harden Runner
288+
uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
289+
with:
290+
egress-policy: audit
259291
- name: Maximize build space
260292
uses: ublue-os/remove-unwanted-software@cc0becac701cf642c8f0a6613bbdaf5dc36b259e # v9
261293

@@ -305,6 +337,10 @@ jobs:
305337
id-token: write
306338

307339
steps:
340+
- name: Harden Runner
341+
uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
342+
with:
343+
egress-policy: audit
308344
- name: Maximize build space
309345
uses: ublue-os/remove-unwanted-software@cc0becac701cf642c8f0a6613bbdaf5dc36b259e # v9
310346

@@ -340,6 +376,10 @@ jobs:
340376
id-token: write
341377

342378
steps:
379+
- name: Harden Runner
380+
uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
381+
with:
382+
egress-policy: audit
343383
- name: Maximize build space
344384
uses: ublue-os/remove-unwanted-software@cc0becac701cf642c8f0a6613bbdaf5dc36b259e # v9
345385

@@ -375,6 +415,10 @@ jobs:
375415
id-token: write
376416

377417
steps:
418+
- name: Harden Runner
419+
uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
420+
with:
421+
egress-policy: audit
378422
- name: Maximize build space
379423
uses: ublue-os/remove-unwanted-software@cc0becac701cf642c8f0a6613bbdaf5dc36b259e # v9
380424

@@ -413,6 +457,10 @@ jobs:
413457
id-token: write
414458

415459
steps:
460+
- name: Harden Runner
461+
uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
462+
with:
463+
egress-policy: audit
416464
- name: Maximize build space
417465
uses: ublue-os/remove-unwanted-software@cc0becac701cf642c8f0a6613bbdaf5dc36b259e # v9
418466

@@ -451,6 +499,10 @@ jobs:
451499
id-token: write
452500

453501
steps:
502+
- name: Harden Runner
503+
uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
504+
with:
505+
egress-policy: audit
454506
- name: Maximize build space
455507
uses: ublue-os/remove-unwanted-software@cc0becac701cf642c8f0a6613bbdaf5dc36b259e # v9
456508

@@ -488,6 +540,10 @@ jobs:
488540
id-token: write
489541

490542
steps:
543+
- name: Harden Runner
544+
uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
545+
with:
546+
egress-policy: audit
491547
- name: Maximize build space
492548
uses: ublue-os/remove-unwanted-software@cc0becac701cf642c8f0a6613bbdaf5dc36b259e # v9
493549

‎.github/workflows/zizmor.yml‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,10 @@ jobs:
1616
contents: read
1717
actions: read
1818
steps:
19+
- name: Harden Runner
20+
uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
21+
with:
22+
egress-policy: audit
1923
- name: Checkout repository
2024
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
2125
with:
@@ -25,9 +29,9 @@ jobs:
2529
uses: astral-sh/setup-uv@4959332f0f014c5280e7eac8b70c90cb574c9f9b # v6.6.0
2630

2731
- name: Run zizmor 🌈
28-
run: uvx zizmor --format sarif . > results.sarif
32+
run: uvx zizmor --format sarif . > results.sarif
2933
env:
30-
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
34+
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
3135

3236
- name: Upload SARIF file
3337
uses: github/codeql-action/upload-sarif@3c3833e0f8c1c83d449a7478aa59c036a9165498 # v3.29.11

0 commit comments

Comments
 (0)