From f9e166331e95b6bd37807976cf401b86b1384c34 Mon Sep 17 00:00:00 2001 From: "stepsecurity-app[bot]" <188008098+stepsecurity-app[bot]@users.noreply.github.com> Date: Wed, 18 Jun 2025 17:07:32 +0000 Subject: [PATCH] [StepSecurity] Apply security best practices Signed-off-by: StepSecurity Bot --- .github/workflows/pages.yaml | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/.github/workflows/pages.yaml b/.github/workflows/pages.yaml index 6973b227ce..ed1f2009da 100644 --- a/.github/workflows/pages.yaml +++ b/.github/workflows/pages.yaml @@ -10,13 +10,18 @@ jobs: concurrency: ci-${{ github.ref }} runs-on: ubuntu-latest steps: + - name: Harden the runner (Audit all outbound calls) + uses: step-security/harden-runner@002fdce3c6a235733a90a27c80493a3241e56863 # v2.12.1 + with: + egress-policy: audit + - name: Checkout - uses: actions/checkout@v3 + uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0 with: fetch-depth: 1000 # make sure to fetch the old commit we diff against - name: Build forkdiff - uses: "docker://protolambda/forkdiff:latest" + uses: "docker://protolambda/forkdiff:latest@sha256:4bb900ab4e097780452e4672cf1f55b967d7e5cd0e8b73807339a6868e94bd2a" with: args: -repo=/github/workspace -fork=/github/workspace/fork.yaml -out=/github/workspace/index.html @@ -30,7 +35,7 @@ jobs: fi; - name: Deploy - uses: JamesIves/github-pages-deploy-action@v4 + uses: JamesIves/github-pages-deploy-action@6c2d9db40f9296374acc17b90404b6e8864128c8 # v4.7.3 with: folder: tmp/pages clean: true