Apply best security practices for OpenSSF (#3069)

* [StepSecurity] Apply security best practices * Keep needed check in precommit --------- Signed-off-by: StepSecurity Bot <bot@stepsecurity.io> Signed-off-by: Sanket Sudake <sanketsudake@gmail.com> Co-authored-by: StepSecurity Bot <bot@stepsecurity.io>
2024-12-08 11:07:14 +05:30
parent 0aa1a12cdc
commit 11a2fdbdab
16 changed files with 154 additions and 7 deletions
@@ -21,11 +21,22 @@ env:
  GOLANGCI_LINT_VERSION: v1.61.0
  GOLANGCI_LINT_TIMEOUT: 5m

+permissions:
+  contents: read
+
 jobs:
  lint:
+    permissions:
+      contents: read  # for actions/checkout to fetch code
+      pull-requests: read  # for golangci/golangci-lint-action to fetch pull requests
    runs-on: ubuntu-latest
    # if: ${{ !contains(github.event.pull_request.labels.*.name, 'skip-ci') }}
    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@0080882f6c36860b6ba35c610c98ce87d4e2f26f # v2.10.2
+        with:
+          egress-policy: audit
+
      - name: Check out code
        uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0