From a45f9688ddb985cec659ca64cd46e0ada6797edb Mon Sep 17 00:00:00 2001 From: kwburns-kong Date: Tue, 4 Aug 2026 13:18:10 -0400 Subject: [PATCH] Add harden-runner to all CI workflows (#10300) --- .github/workflows/homebrew.yml | 5 +++++ .github/workflows/release-build.yml | 15 +++++++++++++++ .github/workflows/release-publish.yml | 5 +++++ .github/workflows/release-recurring.yml | 5 +++++ .github/workflows/release-start.yml | 5 +++++ .github/workflows/sast.yml | 5 +++++ .github/workflows/test-cli.yml | 5 +++++ .github/workflows/test-e2e.yml | 10 ++++++++++ .github/workflows/test.yml | 5 +++++ .github/workflows/update-changelog.yml | 5 +++++ 10 files changed, 65 insertions(+) diff --git a/.github/workflows/homebrew.yml b/.github/workflows/homebrew.yml index 94592a268f..67ab4a1226 100644 --- a/.github/workflows/homebrew.yml +++ b/.github/workflows/homebrew.yml @@ -17,6 +17,11 @@ jobs: runs-on: macos-latest permissions: {} steps: + - name: Harden Runner + uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 + with: + egress-policy: audit + - name: Set up Homebrew id: set-up-homebrew uses: Homebrew/actions/setup-homebrew@6eaeff80e7e5c43087c0e5eb5aa82120399e9c91 # master diff --git a/.github/workflows/release-build.yml b/.github/workflows/release-build.yml index 75a8bb9124..5f56bb723f 100644 --- a/.github/workflows/release-build.yml +++ b/.github/workflows/release-build.yml @@ -17,6 +17,11 @@ jobs: permissions: contents: read # Required for actions/checkout steps: + - name: Harden Runner + uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 + with: + egress-policy: audit + - name: Checkout repository uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 @@ -60,6 +65,11 @@ jobs: # csc_link_secret: '' # csc_key_password_secret: '' steps: + - name: Harden Runner + uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 + with: + egress-policy: audit + - name: Checkout branch uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 @@ -375,6 +385,11 @@ jobs: contents: read pull-requests: write steps: + - name: Harden Runner + uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 + with: + egress-policy: audit + - name: Checkout branch uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 diff --git a/.github/workflows/release-publish.yml b/.github/workflows/release-publish.yml index 35e3155b97..0a9c32b8ff 100644 --- a/.github/workflows/release-publish.yml +++ b/.github/workflows/release-publish.yml @@ -42,6 +42,11 @@ jobs: contents: write # Required to upload assets. Issue: https://github.com/slsa-framework/slsa-github-generator/tree/main/internal/builders/container#known-issues packages: write steps: + - name: Harden Runner + uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 + with: + egress-policy: audit + - name: Check Release Build Confirmed env: IS_RELEASE_BUILD_TRIGGERED: ${{ github.event.inputs.release_build }} diff --git a/.github/workflows/release-recurring.yml b/.github/workflows/release-recurring.yml index 983a942f18..4ee012c500 100644 --- a/.github/workflows/release-recurring.yml +++ b/.github/workflows/release-recurring.yml @@ -41,6 +41,11 @@ jobs: - os: ubuntu-24.04-arm build-targets: tar.gz steps: + - name: Harden Runner + uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 + with: + egress-policy: audit + - name: Checkout branch uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 diff --git a/.github/workflows/release-start.yml b/.github/workflows/release-start.yml index 6642069df5..666262bc0c 100644 --- a/.github/workflows/release-start.yml +++ b/.github/workflows/release-start.yml @@ -25,6 +25,11 @@ jobs: permissions: contents: write steps: + - name: Harden Runner + uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 + with: + egress-policy: audit + - name: Checkout branch uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: diff --git a/.github/workflows/sast.yml b/.github/workflows/sast.yml index 9a562026c4..762f298d78 100644 --- a/.github/workflows/sast.yml +++ b/.github/workflows/sast.yml @@ -21,5 +21,10 @@ jobs: if: (github.actor != 'dependabot[bot]') steps: + - name: Harden Runner + uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 + with: + egress-policy: audit + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - uses: Kong/public-shared-actions/security-actions/semgrep@a18abf762d6e2444bcbfd20de70451ea1e3bc1b1 # 4.0.1 diff --git a/.github/workflows/test-cli.yml b/.github/workflows/test-cli.yml index 17420043d9..c9c6630711 100644 --- a/.github/workflows/test-cli.yml +++ b/.github/workflows/test-cli.yml @@ -25,6 +25,11 @@ jobs: contents: read packages: read steps: + - name: Harden Runner + uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 + with: + egress-policy: audit + - name: Checkout branch uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 diff --git a/.github/workflows/test-e2e.yml b/.github/workflows/test-e2e.yml index 41abdf7e3a..4174c33782 100644 --- a/.github/workflows/test-e2e.yml +++ b/.github/workflows/test-e2e.yml @@ -25,6 +25,11 @@ jobs: contents: read packages: read steps: + - name: Harden Runner + uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 + with: + egress-policy: audit + - name: Checkout branch uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 @@ -66,6 +71,11 @@ jobs: shardIndex: [1, 2, 3, 4, 5, 6] shardTotal: [6] steps: + - name: Harden Runner + uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 + with: + egress-policy: audit + - name: Checkout branch uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index 0c90c26e47..cd1069a73b 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -26,6 +26,11 @@ jobs: pull-requests: write packages: read steps: + - name: Harden Runner + uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 + with: + egress-policy: audit + - name: Checkout branch uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 diff --git a/.github/workflows/update-changelog.yml b/.github/workflows/update-changelog.yml index 1994847da4..5944c18b3b 100644 --- a/.github/workflows/update-changelog.yml +++ b/.github/workflows/update-changelog.yml @@ -18,6 +18,11 @@ jobs: contents: write steps: + - name: Harden Runner + uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 + with: + egress-policy: audit + - name: Checkout code uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: