Apply best security practices for OpenSSF (#3069)

* [StepSecurity] Apply security best practices * Keep needed check in precommit --------- Signed-off-by: StepSecurity Bot <bot@stepsecurity.io> Signed-off-by: Sanket Sudake <sanketsudake@gmail.com> Co-authored-by: StepSecurity Bot <bot@stepsecurity.io>
2024-12-08 11:07:14 +05:30
parent 0aa1a12cdc
commit 11a2fdbdab
16 changed files with 154 additions and 7 deletions
@@ -10,10 +10,20 @@ env:
  KIND_NODE_IMAGE_TAG: v1.25.16
  KIND_CLUSTER_NAME: kind

+permissions:
+  contents: read
+
 jobs:
  create-draft-release:
+    permissions:
+      contents: write  # for goreleaser/goreleaser-action to create a GitHub release
    runs-on: ubuntu-latest
    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@0080882f6c36860b6ba35c610c98ce87d4e2f26f # v2.10.2
+        with:
+          egress-policy: audit
+
      - name: Check out code
        uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
        with: