ci: Update per Q3 audit findings (#811)

Signed-off-by: Mihail Mihov <[email protected]>
hiero-ledger · Oct 29, 2024 · b3ce8c6 · b3ce8c6
1 parent 6cf8ec3
commit b3ce8c6
Show file tree

Hide file tree

Showing 5 changed files with 41 additions and 1 deletion.
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
@@ -29,3 +29,9 @@ updates:
     directory: /test/smoke
     schedule:
       interval: daily
+
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "daily"
+    open-pull-requests-limit: 10
diff --git a/.github/workflows/flow-pr-title-check.yaml b/.github/workflows/flow-pr-title-check.yaml
@@ -42,6 +42,11 @@ jobs:
     name: Title Check
     runs-on: local-node-linux-medium
     steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@91182cccc01eb5e619899d80e4e971d6181294a7 # v2.10.1
+        with:
+          egress-policy: audit
+
       - name: Check PR Title
         uses: step-security/conventional-pr-title-action@0eae74515f5a79f8773fa04142dd746df76666ac # v1.0.0
         env:

diff --git a/.github/workflows/flow-pull-request-checks.yaml b/.github/workflows/flow-pull-request-checks.yaml
@@ -48,6 +48,11 @@ jobs:
         node-version: [18.x]
 
     steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@91182cccc01eb5e619899d80e4e971d6181294a7 # v2.10.1
+        with:
+          egress-policy: audit
+
       - name: Checkout repository
         uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
 
@@ -86,6 +91,11 @@ jobs:
         node-version: [18.x]
 
     steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@91182cccc01eb5e619899d80e4e971d6181294a7 # v2.10.1
+        with:
+          egress-policy: audit
+
       - name: Checkout repository
         uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
 
@@ -126,6 +136,11 @@ jobs:
         node-version: [18.x]
 
     steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@91182cccc01eb5e619899d80e4e971d6181294a7 # v2.10.1
+        with:
+          egress-policy: audit
+
       - name: Checkout repository
         uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
 

diff --git a/.github/workflows/flow-semantic-release.yml b/.github/workflows/flow-semantic-release.yml
@@ -11,16 +11,25 @@ jobs:
       pull-requests: write
     runs-on: local-node-linux-medium
     steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@91182cccc01eb5e619899d80e4e971d6181294a7 # v2.10.1
+        with:
+          egress-policy: audit
+
       - name: Checkout Code
         uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
+
       - name: Configure Node JS
         uses: actions/setup-node@60edb5dd545a775178f52524783378180af0d1f8 # v4.0.2
         with:
           node-version: 20
+
       - name: Clean Install
         run: npm ci
+
       - name: Build Source
         run: npm run build
+
       - name: Run semantic-release
         run: npx semantic-release
         env:

diff --git a/.github/workflows/publish-npm-package.yaml b/.github/workflows/publish-npm-package.yaml
@@ -14,11 +14,16 @@ jobs:
   publish-npm-package:
     runs-on: local-node-linux-medium
     steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@91182cccc01eb5e619899d80e4e971d6181294a7 # v2.10.1
+        with:
+          egress-policy: audit
+
       - name: Checkout repository
         uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
 
       - name: Use Node.js 20.x
-        uses: actions/setup-node@60edb5dd545a775178f52524783378180af0d1f8
+        uses: actions/setup-node@60edb5dd545a775178f52524783378180af0d1f8 # v4.0.2
         with:
           node-version: '20.x'
           registry-url: 'https://registry.npmjs.org'