chore(stepsecurity): apply security best practices (#20)

## Summary

This pull request has been generated by
[StepSecurity](https://app.stepsecurity.io/github/circlefin/actions/dashboard)
as part of your enterprise subscription to ensure compliance with
recommended security best practices. Please review and merge the pull
request to apply these security enhancements.

## Security Fixes

### Harden Runner

Harden-Runner is an open-source security agent for the GitHub-hosted
runner to prevent software supply chain attacks. It prevents
exfiltration of credentials, detects tampering of source code during
build, and enables running jobs without sudo access.

- [GitHub Security
Guide](https://docs.github.com/en/actions/security-for-github-actions/security-guides/security-hardening-for-github-actions)
- [The Open Source Security Foundation (OpenSSF) Security
Guide](https://github.com/ossf/scorecard/blob/main/docs/checks.md#dangerous-workflow)
### Least Privileged GitHub Actions Token Permissions

The GITHUB_TOKEN is an automatically generated secret to make
authenticated calls to the GitHub API. GitHub recommends setting minimum
token permissions for the GITHUB_TOKEN.

- [GitHub Security
Guide](https://docs.github.com/en/actions/security-guides/automatic-token-authentication#using-the-github_token-in-a-workflow)
- [The Open Source Security Foundation (OpenSSF) Security
Guide](https://github.com/ossf/scorecard/blob/main/docs/checks.md#token-permissions)

### Pinned Dependencies

Pinning GitHub Actions to specific versions or commit SHAs ensures that
your workflows remain consistent and secure.
Unpinned actions can lead to unexpected changes or vulnerabilities
caused by upstream updates.

- [GitHub Security
Guide](https://docs.github.com/en/actions/security-for-github-actions/security-guides/security-hardening-for-github-actions#using-third-party-actions)
- [The Open Source Security Foundation (OpenSSF) Security
Guide](https://github.com/ossf/scorecard/blob/main/docs/checks.md#pinned-dependencies)


## Feedback
For bug reports, feature requests, and general feedback; please create
an issue in
[step-security/secure-repo](https://github.com/step-security/secure-repo)
or contact us via [our website](https://www.stepsecurity.io/).

---------

Signed-off-by: StepSecurity Bot <bot@stepsecurity.io>
Co-authored-by: stepsecurity-app[bot] <188008098+stepsecurity-app[bot]@users.noreply.github.com>
Co-authored-by: ali-kafel <ali.kafel@circle.com>

Author: stepsecurity-app[bot]

.github/workflows/release-test.yml

@@ -2,15 +2,20 @@ name: Test
 
 on:
   workflow_call:
-
 jobs:
   test:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-latest      
     steps: 
-      - uses: actions/checkout@v4
+      - name: Harden the runner
+        uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
+        with:
+          egress-policy: block
+          policy: global-allowed-endpoints-policy
+
+      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
 
       - name: Set up Python 3.10
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
         with:
           python-version: '3.10'
 

.github/workflows/release.yml

@@ -11,6 +11,7 @@ permissions:
   pull-requests: write
   actions: write
   issues: write
+  id-token: write
 
 jobs:
   test:
@@ -36,10 +37,16 @@ jobs:
     needs: release-please
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - name: Harden the runner
+        uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
+        with:
+          egress-policy: block
+          policy: global-allowed-endpoints-policy
+
+      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
 
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
         with:
           python-version: '3.10'
 
@@ -61,7 +68,7 @@ jobs:
         run: twine upload dist/*
 
       - name: Upload build artifacts for release
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: python-package-distributions
           path: dist/