From 806d68fb30379bc38d68dbd36b3c963147bd1cc8 Mon Sep 17 00:00:00 2001
From: "stepsecurity-app[bot]"
 <188008098+stepsecurity-app[bot]@users.noreply.github.com>
Date: Wed, 11 Jun 2025 23:42:14 +0000
Subject: [PATCH] [StepSecurity] Apply security best practices

Signed-off-by: StepSecurity Bot <bot@stepsecurity.io>
---
 .github/workflows/build.yml        | 19 ++++++++++++++++---
 .github/workflows/issues.yml       |  7 ++++++-
 .github/workflows/notification.yml | 15 ++++++++++++++-
 .github/workflows/pages.yml        | 13 +++++++++----
 4 files changed, 45 insertions(+), 9 deletions(-)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 57e2cae..7fae6a9 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -2,13 +2,21 @@ name: Build and Test
 
 on: [push]
 
+permissions:
+  contents: read
+
 jobs:
   format-code:
     runs-on: ubuntu-latest
 
     steps:
+    - name: Harden the runner (Audit all outbound calls)
+      uses: step-security/harden-runner@002fdce3c6a235733a90a27c80493a3241e56863 # v2.12.1
+      with:
+        egress-policy: audit
+
     - name: Checkout code
-      uses: actions/checkout@v3
+      uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
 
     - name: Install dependencies and format code
       run: |
@@ -28,11 +36,16 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
+    - name: Harden the runner (Audit all outbound calls)
+      uses: step-security/harden-runner@002fdce3c6a235733a90a27c80493a3241e56863 # v2.12.1
+      with:
+        egress-policy: audit
+
     - name: Checkout code
-      uses: actions/checkout@v3
+      uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
 
     - name: Set up Python environment
-      uses: actions/setup-python@v3
+      uses: actions/setup-python@3542bca2639a428e1796aaa6a2ffef0c0f575566 # v3.1.4
       with:
         python-version: 3.9
 
diff --git a/.github/workflows/issues.yml b/.github/workflows/issues.yml
index 8a52732..66e86e5 100644
--- a/.github/workflows/issues.yml
+++ b/.github/workflows/issues.yml
@@ -6,7 +6,12 @@ jobs:
   comment:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/github-script@v7
+      - name: Harden the runner (Audit all outbound calls)
+        uses: step-security/harden-runner@002fdce3c6a235733a90a27c80493a3241e56863 # v2.12.1
+        with:
+          egress-policy: audit
+
+      - uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
         with:
           script: |
             github.rest.issues.createComment({
diff --git a/.github/workflows/notification.yml b/.github/workflows/notification.yml
index f3ac552..d654b02 100644
--- a/.github/workflows/notification.yml
+++ b/.github/workflows/notification.yml
@@ -8,12 +8,20 @@ env:
   CHANNEL_API_FEEDBACK: ${{ vars.CHANNEL_API_FEEDBACK }}
   ON_CALL_API: ${{ vars.ON_CALL_API }}
 
+permissions:
+  contents: read
+
 jobs:
   checks:
     runs-on: ubuntu-latest
     outputs:
       skip: ${{ env.skip }}
     steps:
+    - name: Harden the runner (Audit all outbound calls)
+      uses: step-security/harden-runner@002fdce3c6a235733a90a27c80493a3241e56863 # v2.12.1
+      with:
+        egress-policy: audit
+
     - name: Check spam labels
       if: ${{ contains(github.event.*.labels.*.name, 'spam') }}
       run: |
@@ -25,6 +33,11 @@ jobs:
     needs: checks
     if: ${{ needs.checks.outputs.skip != 'true' }}
     steps:
+    - name: Harden the runner (Audit all outbound calls)
+      uses: step-security/harden-runner@002fdce3c6a235733a90a27c80493a3241e56863 # v2.12.1
+      with:
+        egress-policy: audit
+
     - name: Set channel and mention
       run: |
         echo "channel=${{ env.CHANNEL_API_FEEDBACK }}" >> $GITHUB_ENV
@@ -47,7 +60,7 @@ jobs:
         url: ${{ github.event.issue.html_url }}
 
     - name: Notify Slack
-      uses: slackapi/slack-github-action@v1.24.0
+      uses: slackapi/slack-github-action@e28cf165c92ffef168d23c5c9000cffc8a25e117 # v1.24.0
       with:
         payload: |
           {
diff --git a/.github/workflows/pages.yml b/.github/workflows/pages.yml
index fa3a432..d6bf2fc 100644
--- a/.github/workflows/pages.yml
+++ b/.github/workflows/pages.yml
@@ -28,8 +28,13 @@ jobs:
       url: ${{ steps.deployment.outputs.page_url }}
     runs-on: ubuntu-latest
     steps:
+      - name: Harden the runner (Audit all outbound calls)
+        uses: step-security/harden-runner@002fdce3c6a235733a90a27c80493a3241e56863 # v2.12.1
+        with:
+          egress-policy: audit
+
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
       - name: Install Dependencies
         run: |
           pip3 install -r pinned_requirements.txt
@@ -39,12 +44,12 @@ jobs:
           cd docs
           make html
       - name: Setup Pages
-        uses: actions/configure-pages@v3
+        uses: actions/configure-pages@b8130d9ab958b325bbde9786d62f2c97a9885a0e # v3.0.7
       - name: Upload artifact
-        uses: actions/upload-pages-artifact@v1
+        uses: actions/upload-pages-artifact@84bb4cd4b733d5c320c9c9cfbc354937524f4d64 # v1.0.10
         with:
           # Upload the build output directory
           path: 'docs/_build/html'
       - name: Deploy to GitHub Pages
         id: deployment
-        uses: actions/deploy-pages@v2
+        uses: actions/deploy-pages@de14547edc9944350dc0481aa5b7afb08e75f254 # v2.0.5