Hardened security?

.github/workflows/approve-dependabot.yml

@@ -28,6 +28,11 @@ jobs:
     # Specifically check that dependabot (or another trusted party) created this pull-request, and that it has been labelled correctly.
 
     steps:
+
+    - name: "Initialise Workspace"
+      shell: bash
+      run: sudo chown -R "$USER:$USER" "$GITHUB_WORKSPACE"
+
     - name: "Harden Security"
       uses: step-security/[email protected]
       with:
@@ -45,11 +50,7 @@ jobs:
           tuf-repo-cdn.sigstore.dev:443
           www.bestpractices.dev:443
 
-      #egress-policy: audit
-
-    - name: "Initialise Workspace"
-      shell: bash
-      run: sudo chown -R "$USER:$USER" "$GITHUB_WORKSPACE"
+          #egress-policy: audit
 
     - name: "Check Repo Owner"
       uses: actions/[email protected]
@@ -80,6 +81,25 @@ jobs:
         shell: bash
         run: sudo chown -R "$USER:$USER" "$GITHUB_WORKSPACE"
 
+      - name: "Harden Security"
+        uses: step-security/[email protected]
+        with:
+          egress-policy: audit
+          disable-sudo: true
+          allowed-endpoints: >
+            api.github.com:443
+            api.osv.dev:443
+            api.securityscorecards.dev:443
+            codeload.github.com:443
+            fulcio.sigstore.dev:443
+            github.com:443
+            oss-fuzz-build-logs.storage.googleapis.com:443
+            rekor.sigstore.dev:443
+            tuf-repo-cdn.sigstore.dev:443
+            www.bestpractices.dev:443
+
+            #egress-policy: audit
+
       - name: "Check Repo Owner"
         uses: actions/[email protected]
         with:
@@ -107,6 +127,26 @@ jobs:
       shell: bash
       run: sudo chown -R "$USER:$USER" "$GITHUB_WORKSPACE"
 
+    - name: "Harden Security"
+      uses: step-security/[email protected]
+      with:
+        egress-policy: audit
+        disable-sudo: true
+        allowed-endpoints: >
+          api.github.com:443
+          api.osv.dev:443
+          api.securityscorecards.dev:443
+          codeload.github.com:443
+          fulcio.sigstore.dev:443
+          github.com:443
+          oss-fuzz-build-logs.storage.googleapis.com:443
+          rekor.sigstore.dev:443
+          tuf-repo-cdn.sigstore.dev:443
+          www.bestpractices.dev:443
+
+          #egress-policy: audit
+
+
     - name: "Check Repo Owner"
       uses: actions/[email protected]
       with:
@@ -133,6 +173,26 @@ jobs:
         shell: bash
         run: sudo chown -R "$USER:$USER" "$GITHUB_WORKSPACE"
 
+      - name: "Harden Security"
+        uses: step-security/[email protected]
+        with:
+          egress-policy: audit
+          disable-sudo: true
+          allowed-endpoints: >
+            api.github.com:443
+            api.osv.dev:443
+            api.securityscorecards.dev:443
+            codeload.github.com:443
+            fulcio.sigstore.dev:443
+            github.com:443
+            oss-fuzz-build-logs.storage.googleapis.com:443
+            rekor.sigstore.dev:443
+            tuf-repo-cdn.sigstore.dev:443
+            www.bestpractices.dev:443
+
+            #egress-policy: audit
+
+
       - name: "Check Repo Owner"
         uses: actions/[email protected]
         with:

.github/workflows/merge-dependabot.yml

@@ -39,11 +39,6 @@ jobs:
       - name: "Initialise Workspace"
         shell: bash
         run: sudo chown -R "$USER:$USER" "$GITHUB_WORKSPACE"
-      - name: "Check Owner"
-        uses: actions/[email protected]
-        with:
-          script: |
-            core.info('Owner: ${{github.repository_owner}}');
 
       - name: "Harden Security"
         uses: step-security/[email protected]
@@ -62,6 +57,12 @@ jobs:
             tuf-repo-cdn.sigstore.dev:443
             www.bestpractices.dev:443
 
+      - name: "Check Owner"
+        uses: actions/[email protected]
+        with:
+          script: |
+            core.info('Owner: ${{github.repository_owner}}');
+
       - name: "Auto-Merge"
         if: github.repository_owner == 'funfair-tech'
         uses: pascalgn/[email protected]

.github/workflows/on-pr-closed.yml

@@ -9,6 +9,10 @@ jobs:
   cleanup-cache:
     runs-on: [self-hosted, linux]
     steps:
+      - name: "Initialise Workspace"
+        shell: bash
+        run: sudo chown -R "$USER:$USER" "$GITHUB_WORKSPACE"
+
       - name: "Harden Security"
         uses: step-security/[email protected]
         with: