chore: ci hardening

Signed-off-by: Sam Gammon <[email protected]>
elide-dev · Mar 15, 2024 · bccf48e · bccf48e
1 parent f8c5229
commit bccf48e
Show file tree

Hide file tree

Showing 2 changed files with 13 additions and 1 deletion.
diff --git a/.github/workflows/ci.dependency-graph.yml b/.github/workflows/ci.dependency-graph.yml
@@ -17,7 +17,15 @@ jobs:
       - name: Harden Runner
         uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0
         with:
-          egress-policy: audit
+          disable-sudo: true
+          egress-policy: block
+          allowed-endpoints: >
+            api.azul.com:443
+            api.github.com:443
+            cdn.azul.com:443
+            github.com:443
+            jpms.pkg.st:443
+            repo.maven.apache.org:443
       - name: "Setup: Checkout"
         uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633 # v4.1.2
         with:

diff --git a/.github/workflows/deploy.site.yml b/.github/workflows/deploy.site.yml
@@ -18,6 +18,10 @@ jobs:
     name: "Build Site"
     runs-on: ubuntu-latest
     steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0
+        with:
+          egress-policy: audit
       - name: "Setup: Checkout"
         uses: actions/checkout@v4
         with: