configure block

Author: btschwertfeger

.github/workflows/cicd.yaml

@@ -107,7 +107,17 @@ jobs:
         uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
         with:
           disable-sudo: true
-          egress-policy: audit
+          egress-policy: block
+          allowed-endpoints: >
+            api.github.com:443
+            fulcio.sigstore.dev
+            ghcr.io
+            github.com:443
+            pkg-containers.githubusercontent.com:443
+            rekor.sigstore.dev
+            test.pypi.org
+            tuf-repo-cdn.sigstore.dev
+            uploads.github.com:443
 
       - name: Download all the distributions
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
@@ -148,7 +158,18 @@ jobs:
         uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
         with:
           disable-sudo: true
-          egress-policy: audit
+          egress-policy: block
+          allowed-endpoints: >
+            api.github.com:443
+            fulcio.sigstore.dev
+            ghcr.io
+            github.com:443
+            pkg-containers.githubusercontent.com:443
+            pypi.org
+            rekor.sigstore.dev
+            tuf-repo-cdn.sigstore.dev
+            upload.pypi.org
+            uploads.github.com:443
 
       - name: Download all the distributions
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1