Merge pull request #12 from step-security-bot/stepsecurity_remediatio…

…n_1737991165 [StepSecurity] ci: Harden GitHub Actions
coveooss · Jan 30, 2025 · e6adbd6 · e6adbd6
2 parents 70ac761 + d519743
commit e6adbd6
Showing 1 changed file with 8 additions and 0 deletions.
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -4,11 +4,19 @@ on:
       - main
   pull_request:
 name: CI
+permissions:
+  contents: read
+
 jobs:
   test:
     name: Test
     runs-on: ubuntu-latest
     steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@v2
+        with:
+          egress-policy: audit
+
       - name: Checkout code
         uses: actions/checkout@v4
       - name: Init Hermit