To mitigate security concerns, we have made changes to the workflows to use specific action versions and added harden-runner steps to improve security.

• Pinning GitHub Actions to full commit shas

Following best practices outlined in the official GitHub documentation on Security Hardening for GitHub Actions all GitHub Action steps have been updated to use full-length commit SHAs instead of mutable tags using Harden-Runner.

(for example; - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 instead of - uses: actions/checkout@v4)

This ensures that the exact, immutable version of an action is used, preventing unexpected or malicious code changes from being introduced via tag updates by action maintainers.

• Introducing harden-runner

We have integrated Harden-Runner into our workflows as recommended by the Security Hardening for GitHub Actions guide.

Harden-Runner enhances the security posture of our pipelines by restricting the permissions of the runner, reducing the attack surface, and providing additional safeguards against supply chain attacks. This helps to control the environment in which the code runs, further limiting the potential for malicious execution.

Harden-Runner also monitoring and disallowing unauthorized outbound web requests and REST API calls.

GitHub issue number

Fixes #122

Associated Risks

None

✅ PR Checklist

• I have read the contribution guidelines
• I have read the code of conduct guidelines
• Title of the pull request is clear and informative.
• 👌 Code hygiene
• 🔭 Telemetry added, updated, or N/A
• 📄 Documentation added, updated, or N/A
• 🛡️ Automated tests added, or N/A

🧪 How did you test it?

N/A