ci: harden CI

Signed-off-by: Richard Zak <[email protected]>
malwaredb · Dec 24, 2023 · f7ea0b7 · f7ea0b7
1 parent 37c5561
commit f7ea0b7
Show file tree

Hide file tree

Showing 2 changed files with 16 additions and 2 deletions.
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
@@ -10,7 +10,14 @@ jobs:
     - name: Harden Runner
       uses: step-security/harden-runner@eb238b55efaa70779f274895e782ed17c84f2895 # v2.6.1
       with:
-        egress-policy: audit
+        disable-sudo: true
+        egress-policy: block
+        allowed-endpoints: >
+          crates.io:443
+          github.com:443
+          index.crates.io:443
+          static.crates.io:443
+          static.rust-lang.org:443
 
     - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
     - name: Setup Rust toolchain

diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
@@ -10,7 +10,14 @@ jobs:
     - name: Harden Runner
       uses: step-security/harden-runner@eb238b55efaa70779f274895e782ed17c84f2895 # v2.6.1
       with:
-        egress-policy: audit
+        disable-sudo: true
+        egress-policy: block
+        allowed-endpoints: >
+          crates.io:443
+          github.com:443
+          index.crates.io:443
+          static.crates.io:443
+          static.rust-lang.org:443
 
     - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
     - name: Setup Rust toolchain