Use harden-runner Action for all Workflows

Signed-off-by: egibs <20933572+egibs@users.noreply.github.com>
panther-labs · May 29, 2024 · 9117619 · 9117619
1 parent 2a04b80
commit 9117619
Show file tree

Hide file tree

Showing 2 changed files with 9 additions and 1 deletion.
diff --git a/.github/workflows/go.yml b/.github/workflows/go.yml
@@ -5,11 +5,16 @@ on:
     branches:
       - '*'
 
-jobs:
+permissions:
+  contents: read
 
+jobs:
   build_and_test:
     runs-on: ubuntu-latest
     steps:
+    - uses: step-security/harden-runner@f086349bfa2bd1361f7909c78558e816508cdc10 # v2.8.0
+      with:
+        egress-policy: audit
     - uses: actions/checkout@v3
 
     - name: Set up Go

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
@@ -17,6 +17,9 @@ jobs:
   goreleaser:
     runs-on: ubuntu-latest
     steps:
+      - uses: step-security/harden-runner@f086349bfa2bd1361f7909c78558e816508cdc10 # v2.8.0
+        with:
+          egress-policy: audit
       - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
         with:
           # Allow goreleaser to access older tag information.