Merge pull request #7 from chainguard-dev/chore/GHA-140720-stepsecurity-remediation

[StepSecurity] Apply security best practices

Author: johnfosborneiii

.github/workflows/release.yaml

@@ -14,6 +14,8 @@ env:
   JAVA_RUNTIME_IMAGE: "registry.access.redhat.com/ubi9/openjdk-17-runtime"
   VERTX_IMAGE_NAME: "cgr-demo-vertx-redis-client:latest"
 
+permissions: {}
+
 jobs:
   build:
     runs-on: ubuntu-latest
@@ -23,6 +25,11 @@ jobs:
       id-token: write
     steps:
 
+    - name: Harden the runner (Audit all outbound calls)
+      uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
+      with:
+        egress-policy: audit
+
     - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       with:
           fetch-depth: 1

.github/workflows/updates.yaml

@@ -14,6 +14,8 @@ on:
 env:
   REDIS_IMAGE: "cgr.dev/cgr-demo.com/redis-server-bitnami"
 
+permissions: {}
+
 jobs:
   check-for-fixes:
     runs-on: ubuntu-latest
@@ -22,6 +24,11 @@ jobs:
       packages: write
       id-token: write
     steps:
+      - name: Harden the runner (Audit all outbound calls)
+        uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
+        with:
+          egress-policy: audit
+
       - name: Checkout repository
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with: