diff options
| author | StepSecurity Bot <bot@stepsecurity.io> | 2025-09-19 08:30:10 -0700 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2025-09-19 17:30:10 +0200 |
| commit | 7f3d8a34e2d850b51782f0900151413b435296d4 (patch) | |
| tree | 60b8020323f03653c225fdbc69011eb3afb3d4e8 /.github/workflows/project.yml | |
| parent | c87eb79140ac359cf4f71604ddbf7209e1282939 (diff) | |
| download | zsh-7f3d8a34e2d850b51782f0900151413b435296d4.tar.gz zsh-7f3d8a34e2d850b51782f0900151413b435296d4.tar.bz2 zsh-7f3d8a34e2d850b51782f0900151413b435296d4.zip | |
ci: Harden GitHub Actions [StepSecurity] (#13318)
Diffstat (limited to '.github/workflows/project.yml')
| -rw-r--r-- | .github/workflows/project.yml | 7 |
1 files changed, 6 insertions, 1 deletions
diff --git a/.github/workflows/project.yml b/.github/workflows/project.yml index 8fd4e15d4..ba971db15 100644 --- a/.github/workflows/project.yml +++ b/.github/workflows/project.yml @@ -16,9 +16,14 @@ jobs: runs-on: ubuntu-latest if: github.repository == 'ohmyzsh/ohmyzsh' steps: + - name: Harden the runner (Audit all outbound calls) + uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1 + with: + egress-policy: audit + - name: Authenticate as @ohmyzsh id: generate-token - uses: actions/create-github-app-token@v2 + uses: actions/create-github-app-token@67018539274d69449ef7c02e8e71183d1719ab42 # v2.1.4 with: app-id: ${{ secrets.OHMYZSH_APP_ID }} private-key: ${{ secrets.OHMYZSH_APP_PRIVATE_KEY }} |