From afaa1013d7d40c7eb1afaa0d1f8f807759afcbce Mon Sep 17 00:00:00 2001 From: "stepsecurity-app[bot]" <188008098+stepsecurity-app[bot]@users.noreply.github.com> Date: Thu, 5 Mar 2026 16:17:59 +0000 Subject: [PATCH] [StepSecurity] Apply security best practices Signed-off-by: StepSecurity Bot --- .github/workflows/build.yml | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 3a5fe65..504f693 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -8,6 +8,9 @@ on: - main - stable/** +permissions: + contents: read + jobs: image: runs-on: ubuntu-latest @@ -17,7 +20,12 @@ jobs: packages: write pull-requests: write steps: - - uses: vexxhost/docker-atmosphere/.github/actions/build-image@main + - name: Harden the runner (Audit all outbound calls) + uses: step-security/harden-runner@a90bcbc6539c36a85cdfeb73f7e2f433735f215b # v2.15.0 + with: + egress-policy: audit + + - uses: vexxhost/docker-atmosphere/.github/actions/build-image@672cf56c8b828e444b6e7906d0ee355c7ec1dea9 # main with: image-name: python-openstackclient push: ${{ github.event_name != 'pull_request' }}