chore: Add harden runner (#41)

Author: mvicknr

.github/workflows/test_action.yml

@@ -42,6 +42,12 @@ jobs:
     name: Test Agent Repository Flow (Basic)
     runs-on: ubuntu-latest
     steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
+        with:
+          disable-sudo: true
+          egress-policy: audit
+
       - name: Checkout action repository
         uses: actions/checkout@v4
         with:
@@ -67,9 +73,11 @@ jobs:
 
       - name: Setup mock newrelic-auth-cli
         run: |
-          # Make our mock CLI executable and install to standard location
+          # Make our mock CLI executable and install to user-writable location
           chmod +x .github/mock-newrelic-auth-cli
-          sudo cp .github/mock-newrelic-auth-cli /usr/local/bin/newrelic-auth-cli
+          mkdir -p "$HOME/.local/bin"
+          cp .github/mock-newrelic-auth-cli "$HOME/.local/bin/newrelic-auth-cli"
+          echo "$HOME/.local/bin" >> $GITHUB_PATH
 
           # Verify it's accessible
           which newrelic-auth-cli
@@ -111,6 +119,12 @@ jobs:
         ports:
           - 5000:5000
     steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
+        with:
+          disable-sudo: true
+          egress-policy: audit
+
       - name: Checkout action repository
         uses: actions/checkout@v4
         with:
@@ -136,9 +150,11 @@ jobs:
 
       - name: Setup mock newrelic-auth-cli
         run: |
-          # Make our mock CLI executable and install to standard location
+          # Make our mock CLI executable and install to user-writable location
           chmod +x .github/mock-newrelic-auth-cli
-          sudo cp .github/mock-newrelic-auth-cli /usr/local/bin/newrelic-auth-cli
+          mkdir -p "$HOME/.local/bin"
+          cp .github/mock-newrelic-auth-cli "$HOME/.local/bin/newrelic-auth-cli"
+          echo "$HOME/.local/bin" >> $GITHUB_PATH
 
           # Verify it's accessible
           which newrelic-auth-cli
@@ -227,6 +243,12 @@ jobs:
     name: Test Documentation Flow (MDX Parsing)
     runs-on: ubuntu-latest
     steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
+        with:
+          disable-sudo: true
+          egress-policy: audit
+
       - name: Checkout action repository
         uses: actions/checkout@v4
         with:
@@ -252,9 +274,11 @@ jobs:
 
       - name: Setup mock newrelic-auth-cli
         run: |
-          # Make our mock CLI executable and install to standard location
+          # Make our mock CLI executable and install to user-writable location
           chmod +x .github/mock-newrelic-auth-cli
-          sudo cp .github/mock-newrelic-auth-cli /usr/local/bin/newrelic-auth-cli
+          mkdir -p "$HOME/.local/bin"
+          cp .github/mock-newrelic-auth-cli "$HOME/.local/bin/newrelic-auth-cli"
+          echo "$HOME/.local/bin" >> $GITHUB_PATH
 
           # Verify it's accessible
           which newrelic-auth-cli

action.yml

@@ -53,12 +53,12 @@ runs:
         echo "ref=${{ inputs.version }}" >> $GITHUB_OUTPUT
 
     - name: Checkout repository
-      uses: actions/checkout@v4
+      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       with:
         ref: ${{ steps.version.outputs.ref }} # When ref is empty (as in docs scenario), this will default to checking out the commit that triggered the action
         fetch-depth: ${{ inputs.fetch-depth }}
     - name: Setup Go
-      uses: actions/setup-go@v4
+      uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6.2.0
       with:
         go-version-file: '${{ github.action_path }}/go.mod'
         cache: ${{ inputs.cache }}
@@ -80,12 +80,14 @@ runs:
         fi
 
         echo "::group::Installing newrelic-auth-cli"
-        LATEST_RELEASE=$(curl -s https://api.github.com/repos/newrelic/newrelic-auth-rs/releases/latest | grep '"tag_name"' | sed -E 's/.*"([^"]+)".*/\1/')
-        echo "Downloading newrelic-auth-cli version $LATEST_RELEASE"
-        curl -L "https://github.com/newrelic/newrelic-auth-rs/releases/download/${LATEST_RELEASE}/newrelic-auth-cli_amd64.tar.gz" -o newrelic-auth-cli.tar.gz
-        tar -xzf newrelic-auth-cli.tar.gz
-        chmod +x newrelic-auth-cli
-        sudo mv newrelic-auth-cli /usr/local/bin/
+        CLI_COMMIT="a6591c5a691d2c6f913d36b509baf4dcdba0868e" # v0.1.3
+        echo "Downloading newrelic-auth-cli at commit ${CLI_COMMIT}"
+        curl -L "https://github.com/newrelic/newrelic-auth-rs/archive/${CLI_COMMIT}.tar.gz" -o newrelic-auth-cli.tar.gz
+        tar -xzf newrelic-auth-cli.tar.gz --strip-components=1
+        chmod +x newrelic-auth-cli_amd64.tar.gz
+        mkdir -p "$HOME/.local/bin"
+        mv newrelic-auth-cli "$HOME/.local/bin/"
+        echo "$HOME/.local/bin" >> $GITHUB_PATH
         echo "::endgroup::"
 
     - name: Authenticate with NewRelic