[StepSecurity] Apply security best practices

.github/workflows/Build Module.yml

@@ -19,17 +19,27 @@ on:
 
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   test:
+    permissions:
+      contents: write  # for stefanzweifel/git-auto-commit-action to push code in repo
     name: 🧪 Run Tests
     runs-on: ubuntu-latest
     strategy:
       fail-fast: false
 
     steps:
 
+    - name: Harden the runner (Audit all outbound calls)
+      uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
+      with:
+        egress-policy: audit
+
     - name: ✅ Checkout Repository
-      uses: actions/checkout@v4
+      uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
 
     # Uncomment below to explore what modules/variables/env variables are available in the build image
     - name: 📦 Modules and Variables Display
@@ -45,21 +55,21 @@ jobs:
       run: Invoke-Build -File .\src\TheCleaners.build.ps1
 
     - name: 🧪 Upload Pester Results
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
       with:
         name: pester-results
         path: .\src\Artifacts\testOutput
         if-no-files-found: warn
 
     - name: 📦 Upload Build
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
       with:
         name: zip-archive
         path: .\src\Archive
         if-no-files-found: warn
         # git-auto-commit-action only runs on Linux-based platforms.
 
     - name: 💾 Commit Changes
-      uses: stefanzweifel/git-auto-commit-action@v5
+      uses: stefanzweifel/git-auto-commit-action@b863ae1933cb653a53c021fe36dbb774e1fb9403 # v5.2.0
       with:
         commit_message: 'Commit Build'

.github/workflows/Deploy MkDocs.yml

@@ -14,6 +14,9 @@ on:
   # Allow manual triggering of the workflow.
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
 
   build:
@@ -27,11 +30,16 @@ jobs:
       cancel-in-progress: true
 
     steps:
+      - name: Harden the runner (Audit all outbound calls)
+        uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
+        with:
+          egress-policy: audit
+
       - name: ✅ Checkout Repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
 
       - name: 🐍 Setup Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
         with:
           python-version: '3.x'  # specify the Python version
 

.github/workflows/Publish.yml

@@ -1,12 +1,20 @@
 name: Publish to PowerShell Gallery
 on:
   workflow_dispatch:
+permissions:
+  contents: read
+
 jobs:
   publish:
     runs-on: ubuntu-latest
     steps:
+    - name: Harden the runner (Audit all outbound calls)
+      uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
+      with:
+        egress-policy: audit
+
     - name: Clone Project Files
-      uses: actions/checkout@v4
+      uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
     - name: Publish PowerShell Module
       shell: pwsh
       run: |

.pre-commit-config.yaml

@@ -0,0 +1,6 @@
+repos:
+- repo: https://github.com/pre-commit/pre-commit-hooks
+  rev: v4.4.0
+  hooks:
+  - id: end-of-file-fixer
+  - id: trailing-whitespace