Step security changes

move-coop · Sep 5, 2024 · bee9490 · bee9490
1 parent 73754f1
commit bee9490
Show file tree

Hide file tree

Showing 2 changed files with 20 additions and 5 deletions.
diff --git a/.github/workflows/pip-install.yml b/.github/workflows/pip-install.yml
@@ -16,6 +16,9 @@ on:
 env:
   TESTING: 1
 
+permissions:  # added using https://github.com/step-security/secure-repo
+  contents: read
+
 jobs:
   pip-install:
     strategy:
@@ -46,9 +49,14 @@ jobs:
     runs-on: ${{ matrix.os }}
 
     steps:
-      - uses: actions/checkout@v4
+      - name: Harden Runner
+        uses: step-security/harden-runner@5c7944e73c4c2a096b17a9cb74d65b6c2bbafbde # v2.9.1
+        with:
+          egress-policy: audit
+
+      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
       - name: Set up Python ${{ matrix.python-version }}
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@f677139bbe7f9c59b41e40162b753c062f5d49a3 # v5.2.0
         with:
           python-version: ${{ matrix.python-version }}
           cache: pip

diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
@@ -16,6 +16,9 @@ on:
 env:
   TESTING: 1
 
+permissions:  # added using https://github.com/step-security/secure-repo
+  contents: read
+
 jobs:
   test_and_lint:
     strategy:
@@ -46,9 +49,14 @@ jobs:
     runs-on: ${{ matrix.os }}
 
     steps:
-      - uses: actions/checkout@v4
+      - name: Harden Runner
+        uses: step-security/harden-runner@5c7944e73c4c2a096b17a9cb74d65b6c2bbafbde # v2.9.1
+        with:
+          egress-policy: audit
+
+      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
       - name: Set up Python ${{ matrix.python-version }}
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@f677139bbe7f9c59b41e40162b753c062f5d49a3 # v5.2.0
         with:
           python-version: ${{ matrix.python-version }}
           cache: pip
@@ -69,4 +77,3 @@ jobs:
       - name: Format
         run: |
           ruff format --check --diff parsons/ test/ useful_resources/
-