Skip to content

Commit 4f0c82b

Browse files
authored
chore: add harden runner in audit mode to critical workflows (#285)
Similar to NativeScript/android#1842
1 parent 0d042b4 commit 4f0c82b

File tree

1 file changed

+16
-0
lines changed

1 file changed

+16
-0
lines changed

.github/workflows/npm_release.yml

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,10 @@ jobs:
1717
npm_version: ${{ steps.npm_version_output.outputs.NPM_VERSION }}
1818
npm_tag: ${{ steps.npm_version_output.outputs.NPM_TAG }}
1919
steps:
20+
- name: Harden the runner (Audit all outbound calls)
21+
uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
22+
with:
23+
egress-policy: audit
2024
- uses: maxim-lobanov/setup-xcode@60606e260d2fc5762a71e64e74b2174e8ea3c8bd # v1.6.0
2125
with:
2226
xcode-version: ${{env.XCODE_VERSION}}
@@ -82,6 +86,10 @@ jobs:
8286
runs-on: macos-14
8387
needs: build
8488
steps:
89+
- name: Harden the runner (Audit all outbound calls)
90+
uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
91+
with:
92+
egress-policy: audit
8593
- uses: maxim-lobanov/setup-xcode@60606e260d2fc5762a71e64e74b2174e8ea3c8bd # v1.6.0
8694
with:
8795
xcode-version: ${{env.XCODE_VERSION}}
@@ -152,6 +160,10 @@ jobs:
152160
NPM_VERSION: ${{needs.build.outputs.npm_version}}
153161
NPM_TAG: ${{needs.build.outputs.npm_tag}}
154162
steps:
163+
- name: Harden the runner (Audit all outbound calls)
164+
uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
165+
with:
166+
egress-policy: audit
155167
- uses: actions/setup-node@3235b876344d2a9aa001b8d1453c930bba69e610 # v3.9.1
156168
with:
157169
node-version: 20
@@ -178,6 +190,10 @@ jobs:
178190
env:
179191
NPM_VERSION: ${{needs.build.outputs.npm_version}}
180192
steps:
193+
- name: Harden the runner (Audit all outbound calls)
194+
uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
195+
with:
196+
egress-policy: audit
181197
- uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
182198
with:
183199
fetch-depth: 0

0 commit comments

Comments
 (0)