From 36bc0ff488861b25247d2f433a546001258a3962 Mon Sep 17 00:00:00 2001 From: "stepsecurity-app[bot]" <188008098+stepsecurity-app[bot]@users.noreply.github.com> Date: Fri, 13 Nov 2026 03:23:34 +0000 Subject: [PATCH] [StepSecurity] Apply security best practices Signed-off-by: StepSecurity Bot --- .github/workflows/asf-allowlist-check.yml | 5 +++++ .github/workflows/build.yml | 5 +++++ .github/workflows/ci.yml | 10 ++++++++++ .github/workflows/codeql-analysis.yml | 5 +++++ .github/workflows/copilot-token-health.yml | 10 ++++++++++ .github/workflows/main-sonar-check.yml | 5 +++++ .github/workflows/merge-conflict-checker.yml | 5 +++++ .github/workflows/pre-commit.yml | 5 +++++ .github/workflows/rat.yml | 5 +++++ .github/workflows/sonar-check.yml | 5 +++++ .github/workflows/stale.yml | 5 +++++ .github/workflows/ui.yml | 5 +++++ 12 files changed, 70 insertions(+) diff --git a/.github/workflows/asf-allowlist-check.yml b/.github/workflows/asf-allowlist-check.yml index 8ee0b7b5b39c..135202c4f7a3 100644 --- a/.github/workflows/asf-allowlist-check.yml +++ b/.github/workflows/asf-allowlist-check.yml @@ -28,6 +28,11 @@ jobs: asf-allowlist-check: runs-on: ubuntu-latest steps: + - name: Harden the runner (Audit all outbound calls) + uses: step-security/harden-runner@v2 + with: + egress-policy: audit + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 742faf57e4bb..f459b751ea08 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -32,6 +32,11 @@ jobs: build: runs-on: ubuntu-24.04 steps: + - name: Harden the runner (Audit all outbound calls) + uses: step-security/harden-runner@v2 + with: + egress-policy: audit + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 with: persist-credentials: false diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index d46df2f395f5..a7cf3412e1a8 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -33,6 +33,11 @@ jobs: if: github.repository == 'apache/cloudstack' runs-on: ubuntu-24.04 steps: + - name: Harden the runner (Audit all outbound calls) + uses: step-security/harden-runner@v2 + with: + egress-policy: audit + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 with: fetch-depth: 0 @@ -257,6 +262,11 @@ jobs: smoke/test_list_storage_pools smoke/test_list_volumes"] steps: + - name: Harden the runner (Audit all outbound calls) + uses: step-security/harden-runner@v2 + with: + egress-policy: audit + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 with: fetch-depth: 0 diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml index f6bc65ad4b5b..d5894b90d65d 100644 --- a/.github/workflows/codeql-analysis.yml +++ b/.github/workflows/codeql-analysis.yml @@ -34,6 +34,11 @@ jobs: matrix: language: ["actions"] steps: + - name: Harden the runner (Audit all outbound calls) + uses: step-security/harden-runner@v2 + with: + egress-policy: audit + - name: Checkout repository uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 with: diff --git a/.github/workflows/copilot-token-health.yml b/.github/workflows/copilot-token-health.yml index f421dfbc8375..6136f1172e07 100644 --- a/.github/workflows/copilot-token-health.yml +++ b/.github/workflows/copilot-token-health.yml @@ -32,6 +32,11 @@ jobs: outputs: names: ${{ steps.list.outputs.names }} steps: + - name: Harden the runner (Audit all outbound calls) + uses: step-security/harden-runner@v2 + with: + egress-policy: audit + - id: list env: NAMES: ${{ vars.GH_AW_COPILOT_TOKEN_NAMES || '[]' }} @@ -46,6 +51,11 @@ jobs: matrix: name: ${{ fromJson(needs.resolve.outputs.names) }} steps: + - name: Harden the runner (Audit all outbound calls) + uses: step-security/harden-runner@v2 + with: + egress-policy: audit + - name: Check token liveness env: TOKEN: ${{ secrets[format('COPILOT_GITHUB_TOKEN_{0}', matrix.name)] }} diff --git a/.github/workflows/main-sonar-check.yml b/.github/workflows/main-sonar-check.yml index 1c9f1273b976..54cf438cab02 100644 --- a/.github/workflows/main-sonar-check.yml +++ b/.github/workflows/main-sonar-check.yml @@ -31,6 +31,11 @@ jobs: name: Sonar JaCoCo Coverage runs-on: ubuntu-24.04 steps: + - name: Harden the runner (Audit all outbound calls) + uses: step-security/harden-runner@v2 + with: + egress-policy: audit + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 with: fetch-depth: 0 diff --git a/.github/workflows/merge-conflict-checker.yml b/.github/workflows/merge-conflict-checker.yml index badf8c4b4c5b..4b1b7df58370 100644 --- a/.github/workflows/merge-conflict-checker.yml +++ b/.github/workflows/merge-conflict-checker.yml @@ -32,6 +32,11 @@ jobs: pull-requests: write # for eps1lon/actions-label-merge-conflict to label PRs runs-on: ubuntu-24.04 steps: + - name: Harden the runner (Audit all outbound calls) + uses: step-security/harden-runner@v2 + with: + egress-policy: audit + - name: Conflict Check uses: eps1lon/actions-label-merge-conflict@0273be72a0bbd58fcd71d0d6c02c209b50d1e5e1 # v3.1.0 with: diff --git a/.github/workflows/pre-commit.yml b/.github/workflows/pre-commit.yml index 4de995479c59..32ef10c426f3 100644 --- a/.github/workflows/pre-commit.yml +++ b/.github/workflows/pre-commit.yml @@ -31,6 +31,11 @@ jobs: name: Run pre-commit runs-on: ubuntu-24.04 steps: + - name: Harden the runner (Audit all outbound calls) + uses: step-security/harden-runner@v2 + with: + egress-policy: audit + - name: Check Out uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 with: diff --git a/.github/workflows/rat.yml b/.github/workflows/rat.yml index f4659885fbb3..444f774397b1 100644 --- a/.github/workflows/rat.yml +++ b/.github/workflows/rat.yml @@ -32,6 +32,11 @@ jobs: build: runs-on: ubuntu-24.04 steps: + - name: Harden the runner (Audit all outbound calls) + uses: step-security/harden-runner@v2 + with: + egress-policy: audit + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 with: persist-credentials: false diff --git a/.github/workflows/sonar-check.yml b/.github/workflows/sonar-check.yml index dac2a84d05e2..056f61a81c10 100644 --- a/.github/workflows/sonar-check.yml +++ b/.github/workflows/sonar-check.yml @@ -29,6 +29,11 @@ jobs: name: Sonar JaCoCo Coverage runs-on: ubuntu-24.04 steps: + - name: Harden the runner (Audit all outbound calls) + uses: step-security/harden-runner@v2 + with: + egress-policy: audit + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 with: fetch-depth: 0 diff --git a/.github/workflows/stale.yml b/.github/workflows/stale.yml index c0da5f98cc8e..d0c454338d0d 100644 --- a/.github/workflows/stale.yml +++ b/.github/workflows/stale.yml @@ -28,6 +28,11 @@ jobs: issues: write pull-requests: write steps: + - name: Harden the runner (Audit all outbound calls) + uses: step-security/harden-runner@v2 + with: + egress-policy: audit + - uses: actions/stale@eb5cf3af3ac0a1aa4c9c45633dd1ae542a27a899 # v10.3.0 with: stale-issue-message: 'This issue is stale because it has been open for 120 days with no activity. It may be removed by administrators of this project at any time. Remove the stale label or comment to request for removal of it to prevent this.' diff --git a/.github/workflows/ui.yml b/.github/workflows/ui.yml index 7f23add660f0..db908cac0504 100644 --- a/.github/workflows/ui.yml +++ b/.github/workflows/ui.yml @@ -37,6 +37,11 @@ jobs: runs-on: ubuntu-24.04 steps: + - name: Harden the runner (Audit all outbound calls) + uses: step-security/harden-runner@v2 + with: + egress-policy: audit + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 with: persist-credentials: false