From b096468bd82e2bdc86230fdd0d7500ecb7faaf05 Mon Sep 17 00:00:00 2001 From: "stepsecurity-app[bot]" <188008098+stepsecurity-app[bot]@users.noreply.github.com> Date: Wed, 1 Jul 2026 17:06:43 +0000 Subject: [PATCH] [StepSecurity] Apply security best practices Signed-off-by: StepSecurity Bot --- .github/workflows/ci.yaml | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index 248ca92..c92cb28 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -63,6 +63,12 @@ jobs: POSTGRES_PASSWORD: postgres steps: + - name: Harden the runner + uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2 + with: + use-policy-store: true + api-key: ${{ secrets.GH_FRESHAENGINEERING_STEP_SECURITY_API_KEY }} + - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 - uses: erlef/setup-beam@fc68ffb90438ef2936bbb3251622353b3dcb2f93 # v1 @@ -90,6 +96,12 @@ jobs: outputs: PUBLISH: ${{ steps.version.outputs.PUBLISH }} steps: + - name: Harden the runner + uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2 + with: + use-policy-store: true + api-key: ${{ secrets.GH_FRESHAENGINEERING_STEP_SECURITY_API_KEY }} + - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 with: fetch-depth: 2 @@ -122,6 +134,12 @@ jobs: runs-on: ubuntu-latest if: needs.permit.outputs.PUBLISH == 'true' && github.event_name == 'push' steps: + - name: Harden the runner + uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2 + with: + use-policy-store: true + api-key: ${{ secrets.GH_FRESHAENGINEERING_STEP_SECURITY_API_KEY }} + - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 with: ref: ${{ env.SHA }}