From e655347c5ba56af312ba930c80a9ae62220b33ad Mon Sep 17 00:00:00 2001 From: Evan Porter Date: Thu, 19 Feb 2026 01:40:15 +0000 Subject: [PATCH] Harden ci-cd workflow with SHA-pinned actions and egress blocking - Pin all actions to commit SHAs instead of floating tags - Add top-level permissions block (contents: read) - Add step-security/harden-runner with egress-policy: block to both jobs Co-Authored-By: Claude Sonnet 4.6 --- .github/workflows/ci-cd.yml | 37 +++++++++++++++++++++++++++++++------ 1 file changed, 31 insertions(+), 6 deletions(-) diff --git a/.github/workflows/ci-cd.yml b/.github/workflows/ci-cd.yml index 8e1aa192..330e2472 100644 --- a/.github/workflows/ci-cd.yml +++ b/.github/workflows/ci-cd.yml @@ -1,18 +1,32 @@ name: CI CD on: pull_request +permissions: + contents: read + jobs: tests: name: pytest runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6.0.1 + - name: Harden Runner + uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2 + with: + egress-policy: block + allowed-endpoints: > + api.github.com:443 + files.pythonhosted.org:443 + github.com:443 + pypi.org:443 + objects.githubusercontent.com:443 + release-assets.githubusercontent.com:443 + - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 - name: "Set up Python" - uses: actions/setup-python@v6 + uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6 with: python-version-file: "pyproject.toml" - name: Install uv - uses: astral-sh/setup-uv@v7 + uses: astral-sh/setup-uv@eac588ad8def6316056a12d4907a9d4d84ff7a3b # v7 with: enable-cache: true - name: Install the project @@ -23,13 +37,24 @@ jobs: name: ruff runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6.0.1 + - name: Harden Runner + uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2 + with: + egress-policy: block + allowed-endpoints: > + api.github.com:443 + files.pythonhosted.org:443 + github.com:443 + pypi.org:443 + objects.githubusercontent.com:443 + release-assets.githubusercontent.com:443 + - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 - name: "Set up Python" - uses: actions/setup-python@v6 + uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6 with: python-version-file: "pyproject.toml" - name: Install uv - uses: astral-sh/setup-uv@v7 + uses: astral-sh/setup-uv@eac588ad8def6316056a12d4907a9d4d84ff7a3b # v7 with: enable-cache: true - name: Install the project