GHA: Use step-security/harden-runner

Author: dalcinl

.github/workflows/cd-wheel.yml

@@ -72,6 +72,7 @@ jobs:
     outputs:
       matrix: ${{ steps.setup.outputs.matrix }}
     steps:
+    - uses: step-security/harden-runner@v2
     - id: setup
       shell: python
       name: 'setup build matrix'
@@ -107,6 +108,10 @@ jobs:
 
     steps:
 
+    - uses: step-security/harden-runner@v2
+      with:
+        egress-policy: audit
+
     - id: checkout
       uses: actions/checkout@v4
 

.github/workflows/cd.yml

@@ -77,6 +77,10 @@ jobs:
 
     steps:
 
+    - uses: step-security/harden-runner@v2
+      with:
+        egress-policy: audit
+
     - name: Download wheel artifacts
       uses: actions/download-artifact@v4
       with:
@@ -113,6 +117,10 @@ jobs:
 
     steps:
 
+    - uses: step-security/harden-runner@v2
+      with:
+        egress-policy: audit
+
     - name: Download wheel artifacts
       uses: actions/download-artifact@v4
       with:
@@ -143,6 +151,10 @@ jobs:
 
     steps:
 
+    - uses: step-security/harden-runner@v2
+      with:
+        egress-policy: audit
+
     - name: Download wheel artifacts
       uses: actions/download-artifact@v4
       with:

.github/workflows/ci.yml

@@ -103,6 +103,9 @@ jobs:
       - openmpi-50
       - openmpi-41
     steps:
+    - uses: step-security/harden-runner@v2
+      with:
+        egress-policy: audit
     - uses: actions/download-artifact@v4
       with:
         path: wheelhouse