Merge pull request #81 from step-security-bot/chore/GHA-272248-stepsecurity-remediation

[StepSecurity] ci: Harden GitHub Actions

Author: rajbos

.github/workflows/check-models.yml

@@ -12,6 +12,9 @@ on:
   schedule:
     - cron: '11 17 * * 1' # Run every Monday at 5:11 PM UTC
 
+permissions:
+  contents: read
+
 jobs:
   check-models:
     runs-on: ubuntu-latest
@@ -21,8 +24,13 @@ jobs:
       id-token: write
 
     steps:
+      - name: Harden the runner (Audit all outbound calls)
+        uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
+        with:
+          egress-policy: audit
+
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
 
       - name: Fetch documentation page
         id: fetch_docs
@@ -32,7 +40,7 @@ jobs:
           .github/scripts/scrape-models.sh
 
       - name: Upload scraped data as artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: scraped-data
           path: |
@@ -149,7 +157,7 @@ jobs:
 
       - name: Create GitHub Issue if models are missing
         if: steps.check_missing.outputs.needs_update == 'true'
-        uses: actions/github-script@v7
+        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0
         env:
           ISSUE_BODY: ${{ steps.check_missing.outputs.issue_body }}
         with:

.github/workflows/tag-on-issue.yml

@@ -13,6 +13,11 @@ jobs:
     permissions:
       issues: write
     steps:
+      - name: Harden the runner (Audit all outbound calls)
+        uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
+        with:
+          egress-policy: audit
+
       - name: Tag user on new issue
         uses: devops-actions/issue-comment-tag@ec5e2b8d5f031330ff19bf4ee5b5252b1176995a # v0.1.8
         with: