ci: harden runner

see: loopbackio/security#26
Signed-off-by: Rifa Achrinza <25147899+achrinza@users.noreply.github.com>

Author: achrinza

.github/workflows/pr-build.yml

@@ -13,6 +13,17 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
+      - uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        with:
+          disable-sudo-and-containers: true
+          egress-policy: block
+          allowed-endpoints: >
+            github.com:443
+            index.rubygems.org:443
+            raw.githubusercontent.com:443
+            registry.npmjs.org:443
+            rubygems.org:443
+
       - name: Checkout
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:

.github/workflows/site-build.yml

@@ -25,6 +25,18 @@ jobs:
       contents: write
 
     steps:
+      - uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        with:
+          disable-sudo-and-containers: true
+          egress-policy: block
+          allowed-endpoints: >
+            api.github.com:443
+            github.com:443
+            index.rubygems.org:443
+            raw.githubusercontent.com:443
+            registry.npmjs.org:443
+            rubygems.org:443
+
       - name: Checkout
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
@@ -82,9 +94,12 @@ jobs:
     needs: [build]
 
     steps:
-      - uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 #
+      - uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
         with:
           egress-policy: audit
+          allowed-endpoints: >
+            api.github.com:443
+            github.com:443
 
       # Convenience wrapper around `actions/download-artifact` and
       # `actions/upload-pages-artifact`.