From d1a9eead1c44563c43e794d785bc2fb4b6d5d2b3 Mon Sep 17 00:00:00 2001 From: "stepsecurity-app[bot]" <188008098+stepsecurity-app[bot]@users.noreply.github.com> Date: Tue, 28 Oct 2025 16:22:16 +0000 Subject: [PATCH] [StepSecurity] Apply security best practices Signed-off-by: StepSecurity Bot --- .github/workflows/build.yaml | 8 ++++++++ .github/workflows/dependabot-auto-approve.yaml | 5 +++++ .github/workflows/dependabot-auto-merge.yaml | 5 +++++ 3 files changed, 18 insertions(+) diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml index fea9822..2118170 100644 --- a/.github/workflows/build.yaml +++ b/.github/workflows/build.yaml @@ -14,11 +14,19 @@ env: REGISTRY: quay.io IMAGE_NAME: ${{ github.repository }} +permissions: + contents: read + jobs: docker: runs-on: ubuntu-latest if: github.actor != 'dependabot[bot]' steps: + - name: Harden the runner (Audit all outbound calls) + uses: step-security/harden-runner@v2 + with: + egress-policy: audit + - name: Checkout uses: actions/checkout@v5 - name: Set up QEMU diff --git a/.github/workflows/dependabot-auto-approve.yaml b/.github/workflows/dependabot-auto-approve.yaml index c577936..93c19f9 100644 --- a/.github/workflows/dependabot-auto-approve.yaml +++ b/.github/workflows/dependabot-auto-approve.yaml @@ -10,6 +10,11 @@ jobs: runs-on: ubuntu-latest if: ${{ github.actor == 'dependabot[bot]' }} steps: + - name: Harden the runner (Audit all outbound calls) + uses: step-security/harden-runner@v2 + with: + egress-policy: audit + - name: Dependabot metadata id: metadata uses: dependabot/fetch-metadata@v2.4.0 diff --git a/.github/workflows/dependabot-auto-merge.yaml b/.github/workflows/dependabot-auto-merge.yaml index 590596e..1c9f4fd 100644 --- a/.github/workflows/dependabot-auto-merge.yaml +++ b/.github/workflows/dependabot-auto-merge.yaml @@ -11,6 +11,11 @@ jobs: runs-on: ubuntu-latest if: ${{ github.actor == 'dependabot[bot]' }} steps: + - name: Harden the runner (Audit all outbound calls) + uses: step-security/harden-runner@v2 + with: + egress-policy: audit + - name: Dependabot metadata id: metadata uses: dependabot/fetch-metadata@v2.4.0