From 1ed256ce2b3a98a8001fdb0289f264ad649fbea2 Mon Sep 17 00:00:00 2001 From: StepSecurity Bot Date: Wed, 14 Jan 2026 10:42:09 -0800 Subject: [PATCH] [StepSecurity] Apply security best practices (#89) Signed-off-by: StepSecurity Bot --- .github/dependabot.yml | 6 ++++++ .github/workflows/publish.yml | 7 ++++++- 2 files changed, 12 insertions(+), 1 deletion(-) create mode 100644 .github/dependabot.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 0000000..253bcb7 --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,6 @@ +version: 2 +updates: + - package-ecosystem: github-actions + directory: / + schedule: + interval: daily diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index 2df602d..ba1b939 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -16,7 +16,12 @@ jobs: publish: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - name: Harden the runner (Audit all outbound calls) + uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0 + with: + egress-policy: audit + + - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 with: ref: main fetch-depth: 0