From ac5f99827445e6095d22ea06b12988e8a84b85ba Mon Sep 17 00:00:00 2001 From: "Dylan M. Taylor" Date: Wed, 11 Nov 2026 12:10:08 -0500 Subject: [PATCH] ci: run Harden-Runner on every job (#811) Adds step-security/harden-runner (audit, pinned to v2.22.4 like craft-common-actions) as the first step of each job that did not have it, so every workflow in the org's public repos reports its egress to StepSecurity. Audit, not block: block-mode allow lists come from each job's observed traffic. --- .github/workflows/ai-core.yml | 4 ++++ .github/workflows/atomic.yml | 4 ++++ .github/workflows/audio.yml | 16 ++++++++++++++++ .github/workflows/crw.yml | 12 ++++++++++++ .github/workflows/dialogs.yml | 4 ++++ .github/workflows/doc.yml | 4 ++++ .github/workflows/docpath.yml | 4 ++++ .github/workflows/ecproj-format.yml | 4 ++++ .github/workflows/font-store.yml | 4 ++++ .github/workflows/i18n.yml | 4 ++++ .github/workflows/jpeg.yml | 4 ++++ .github/workflows/keymap.yml | 12 ++++++++++++ .github/workflows/media.yml | 8 ++++++++ .github/workflows/pcraft-format.yml | 4 ++++ .github/workflows/pdf.yml | 16 ++++++++++++++++ .github/workflows/print.yml | 4 ++++ .github/workflows/proof.yml | 4 ++++ .github/workflows/ui.yml | 8 ++++++++ .github/workflows/update.yml | 4 ++++ .github/workflows/vectorcraft-format.yml | 4 ++++ .github/workflows/video.yml | 8 ++++++++ .github/workflows/web-api.yml | 4 ++++ .github/workflows/web-host.yml | 4 ++++ .github/workflows/window.yml | 4 ++++ 24 files changed, 148 insertions(+) diff --git a/.github/workflows/ai-core.yml b/.github/workflows/ai-core.yml index d5515307..dbd2a8fe 100644 --- a/.github/workflows/ai-core.yml +++ b/.github/workflows/ai-core.yml @@ -27,6 +27,10 @@ jobs: os: ${{ github.event_name == 'workflow_dispatch' && fromJSON('["ubuntu-latest","windows-latest","macos-latest"]') || fromJSON('["ubuntu-latest","windows-latest"]') }} runs-on: ${{ matrix.os }} steps: + - name: Harden runner + uses: step-security/harden-runner@1d88384fd173af6ecb012dfd0264a306b711241a # v2.22.4 + with: + egress-policy: audit - uses: actions/checkout@v7 - uses: dtolnay/rust-toolchain@b725eda525362e7cf34af9a7243cac1e3f01a7ec # stable with: diff --git a/.github/workflows/atomic.yml b/.github/workflows/atomic.yml index 537d387a..d6e1d8ec 100644 --- a/.github/workflows/atomic.yml +++ b/.github/workflows/atomic.yml @@ -27,6 +27,10 @@ jobs: os: ${{ github.event_name == 'workflow_dispatch' && fromJSON('["ubuntu-latest","windows-latest","macos-latest"]') || fromJSON('["ubuntu-latest","windows-latest"]') }} runs-on: ${{ matrix.os }} steps: + - name: Harden runner + uses: step-security/harden-runner@1d88384fd173af6ecb012dfd0264a306b711241a # v2.22.4 + with: + egress-policy: audit - uses: actions/checkout@v7 - uses: dtolnay/rust-toolchain@b725eda525362e7cf34af9a7243cac1e3f01a7ec # stable with: diff --git a/.github/workflows/audio.yml b/.github/workflows/audio.yml index c6c3215e..c7854eb2 100644 --- a/.github/workflows/audio.yml +++ b/.github/workflows/audio.yml @@ -24,6 +24,10 @@ jobs: name: Audio lint, feature sets, docs, WASM runs-on: ubuntu-latest steps: + - name: Harden runner + uses: step-security/harden-runner@1d88384fd173af6ecb012dfd0264a306b711241a # v2.22.4 + with: + egress-policy: audit - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false @@ -63,6 +67,10 @@ jobs: name: Audio on the minimum Rust version runs-on: ubuntu-latest steps: + - name: Harden runner + uses: step-security/harden-runner@1d88384fd173af6ecb012dfd0264a306b711241a # v2.22.4 + with: + egress-policy: audit - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false @@ -78,6 +86,10 @@ jobs: name: Audio tests without symphonia and lossless-encode only runs-on: ubuntu-latest steps: + - name: Harden runner + uses: step-security/harden-runner@1d88384fd173af6ecb012dfd0264a306b711241a # v2.22.4 + with: + egress-policy: audit - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false @@ -97,6 +109,10 @@ jobs: # with the runner image. runs-on: ubuntu-26.04 steps: + - name: Harden runner + uses: step-security/harden-runner@1d88384fd173af6ecb012dfd0264a306b711241a # v2.22.4 + with: + egress-policy: audit - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false diff --git a/.github/workflows/crw.yml b/.github/workflows/crw.yml index f3a7dc94..06addc2f 100644 --- a/.github/workflows/crw.yml +++ b/.github/workflows/crw.yml @@ -28,6 +28,10 @@ jobs: os: [ubuntu-latest, windows-latest] runs-on: ${{ matrix.os }} steps: + - name: Harden runner + uses: step-security/harden-runner@1d88384fd173af6ecb012dfd0264a306b711241a # v2.22.4 + with: + egress-policy: audit - uses: actions/checkout@v7 with: persist-credentials: false @@ -47,6 +51,10 @@ jobs: name: CRW WASM runs-on: ubuntu-latest steps: + - name: Harden runner + uses: step-security/harden-runner@1d88384fd173af6ecb012dfd0264a306b711241a # v2.22.4 + with: + egress-policy: audit - uses: actions/checkout@v7 with: persist-credentials: false @@ -64,6 +72,10 @@ jobs: name: CRW sample files decode exactly runs-on: ubuntu-latest steps: + - name: Harden runner + uses: step-security/harden-runner@1d88384fd173af6ecb012dfd0264a306b711241a # v2.22.4 + with: + egress-policy: audit - uses: actions/checkout@v7 with: persist-credentials: false diff --git a/.github/workflows/dialogs.yml b/.github/workflows/dialogs.yml index 0ef1d359..f435b87c 100644 --- a/.github/workflows/dialogs.yml +++ b/.github/workflows/dialogs.yml @@ -22,6 +22,10 @@ jobs: timeout-minutes: 15 runs-on: ubuntu-latest steps: + - name: Harden runner + uses: step-security/harden-runner@1d88384fd173af6ecb012dfd0264a306b711241a # v2.22.4 + with: + egress-policy: audit - uses: actions/checkout@v7 with: # The token isn't needed after checkout; cargo runs build scripts and proc macros from diff --git a/.github/workflows/doc.yml b/.github/workflows/doc.yml index d43bfc73..6ebbeb1d 100644 --- a/.github/workflows/doc.yml +++ b/.github/workflows/doc.yml @@ -27,6 +27,10 @@ jobs: os: ${{ github.event_name == 'workflow_dispatch' && fromJSON('["ubuntu-latest","windows-latest","macos-latest"]') || fromJSON('["ubuntu-latest","windows-latest"]') }} runs-on: ${{ matrix.os }} steps: + - name: Harden runner + uses: step-security/harden-runner@1d88384fd173af6ecb012dfd0264a306b711241a # v2.22.4 + with: + egress-policy: audit - uses: actions/checkout@v7 with: persist-credentials: false diff --git a/.github/workflows/docpath.yml b/.github/workflows/docpath.yml index c959904f..46797411 100644 --- a/.github/workflows/docpath.yml +++ b/.github/workflows/docpath.yml @@ -27,6 +27,10 @@ jobs: os: ${{ github.event_name == 'workflow_dispatch' && fromJSON('["ubuntu-latest","windows-latest","macos-latest"]') || fromJSON('["ubuntu-latest","windows-latest"]') }} runs-on: ${{ matrix.os }} steps: + - name: Harden runner + uses: step-security/harden-runner@1d88384fd173af6ecb012dfd0264a306b711241a # v2.22.4 + with: + egress-policy: audit - uses: actions/checkout@v7 - uses: dtolnay/rust-toolchain@b725eda525362e7cf34af9a7243cac1e3f01a7ec # stable with: diff --git a/.github/workflows/ecproj-format.yml b/.github/workflows/ecproj-format.yml index f135a775..c2c8799a 100644 --- a/.github/workflows/ecproj-format.yml +++ b/.github/workflows/ecproj-format.yml @@ -27,6 +27,10 @@ jobs: os: ${{ github.event_name == 'workflow_dispatch' && fromJSON('["ubuntu-latest","windows-latest","macos-latest"]') || fromJSON('["ubuntu-latest","windows-latest"]') }} runs-on: ${{ matrix.os }} steps: + - name: Harden runner + uses: step-security/harden-runner@1d88384fd173af6ecb012dfd0264a306b711241a # v2.22.4 + with: + egress-policy: audit - uses: actions/checkout@v7 with: persist-credentials: false diff --git a/.github/workflows/font-store.yml b/.github/workflows/font-store.yml index 6f24b733..24b7d464 100644 --- a/.github/workflows/font-store.yml +++ b/.github/workflows/font-store.yml @@ -27,6 +27,10 @@ jobs: os: ${{ github.event_name == 'workflow_dispatch' && fromJSON('["ubuntu-latest","windows-latest","macos-latest"]') || fromJSON('["ubuntu-latest","windows-latest"]') }} runs-on: ${{ matrix.os }} steps: + - name: Harden runner + uses: step-security/harden-runner@1d88384fd173af6ecb012dfd0264a306b711241a # v2.22.4 + with: + egress-policy: audit - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - uses: dtolnay/rust-toolchain@b725eda525362e7cf34af9a7243cac1e3f01a7ec # stable with: diff --git a/.github/workflows/i18n.yml b/.github/workflows/i18n.yml index 1748e324..96196a37 100644 --- a/.github/workflows/i18n.yml +++ b/.github/workflows/i18n.yml @@ -27,6 +27,10 @@ jobs: os: ${{ github.event_name == 'workflow_dispatch' && fromJSON('["ubuntu-latest","windows-latest","macos-latest"]') || fromJSON('["ubuntu-latest","windows-latest"]') }} runs-on: ${{ matrix.os }} steps: + - name: Harden runner + uses: step-security/harden-runner@1d88384fd173af6ecb012dfd0264a306b711241a # v2.22.4 + with: + egress-policy: audit - uses: actions/checkout@v7 - uses: dtolnay/rust-toolchain@b725eda525362e7cf34af9a7243cac1e3f01a7ec # stable with: diff --git a/.github/workflows/jpeg.yml b/.github/workflows/jpeg.yml index 0ecbb628..2c92f4f1 100644 --- a/.github/workflows/jpeg.yml +++ b/.github/workflows/jpeg.yml @@ -24,6 +24,10 @@ jobs: name: JPEG lint, tests, WASM runs-on: ubuntu-latest steps: + - name: Harden runner + uses: step-security/harden-runner@1d88384fd173af6ecb012dfd0264a306b711241a # v2.22.4 + with: + egress-policy: audit - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false diff --git a/.github/workflows/keymap.yml b/.github/workflows/keymap.yml index 821c3f1f..25a9c992 100644 --- a/.github/workflows/keymap.yml +++ b/.github/workflows/keymap.yml @@ -26,6 +26,10 @@ jobs: env: CRAFT_FONTS_DIR: ${{ github.workspace }}/.test-inputs/craft-fonts steps: + - name: Harden runner + uses: step-security/harden-runner@1d88384fd173af6ecb012dfd0264a306b711241a # v2.22.4 + with: + egress-policy: audit - uses: actions/checkout@v7 with: persist-credentials: false @@ -65,6 +69,10 @@ jobs: env: CRAFT_FONTS_DIR: ${{ github.workspace }}/.test-inputs/craft-fonts steps: + - name: Harden runner + uses: step-security/harden-runner@1d88384fd173af6ecb012dfd0264a306b711241a # v2.22.4 + with: + egress-policy: audit - uses: actions/checkout@v7 with: persist-credentials: false @@ -86,6 +94,10 @@ jobs: name: Keymap WASM runs-on: ubuntu-latest steps: + - name: Harden runner + uses: step-security/harden-runner@1d88384fd173af6ecb012dfd0264a306b711241a # v2.22.4 + with: + egress-policy: audit - uses: actions/checkout@v7 with: persist-credentials: false diff --git a/.github/workflows/media.yml b/.github/workflows/media.yml index 6cb6f0b0..0b98372d 100644 --- a/.github/workflows/media.yml +++ b/.github/workflows/media.yml @@ -24,6 +24,10 @@ jobs: name: Media lint, feature sets, WASM runs-on: ubuntu-latest steps: + - name: Harden runner + uses: step-security/harden-runner@1d88384fd173af6ecb012dfd0264a306b711241a # v2.22.4 + with: + egress-policy: audit - uses: actions/checkout@v7 with: persist-credentials: false @@ -50,6 +54,10 @@ jobs: name: Media tests with ffmpeg oracles runs-on: ubuntu-latest steps: + - name: Harden runner + uses: step-security/harden-runner@1d88384fd173af6ecb012dfd0264a306b711241a # v2.22.4 + with: + egress-policy: audit - uses: actions/checkout@v7 with: persist-credentials: false diff --git a/.github/workflows/pcraft-format.yml b/.github/workflows/pcraft-format.yml index 5c69e2dd..1f2ae92e 100644 --- a/.github/workflows/pcraft-format.yml +++ b/.github/workflows/pcraft-format.yml @@ -27,6 +27,10 @@ jobs: os: ${{ github.event_name == 'workflow_dispatch' && fromJSON('["ubuntu-latest","windows-latest","macos-latest"]') || fromJSON('["ubuntu-latest","windows-latest"]') }} runs-on: ${{ matrix.os }} steps: + - name: Harden runner + uses: step-security/harden-runner@1d88384fd173af6ecb012dfd0264a306b711241a # v2.22.4 + with: + egress-policy: audit - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false diff --git a/.github/workflows/pdf.yml b/.github/workflows/pdf.yml index 004a86a5..c5932181 100644 --- a/.github/workflows/pdf.yml +++ b/.github/workflows/pdf.yml @@ -30,6 +30,10 @@ jobs: env: RUSTFLAGS: --cfg craft_pdf_unicode_fixtures steps: + - name: Harden runner + uses: step-security/harden-runner@1d88384fd173af6ecb012dfd0264a306b711241a # v2.22.4 + with: + egress-policy: audit - uses: actions/checkout@v7 - uses: dtolnay/rust-toolchain@b725eda525362e7cf34af9a7243cac1e3f01a7ec # stable with: @@ -55,6 +59,10 @@ jobs: name: PDF vendored contracts runs-on: ubuntu-latest steps: + - name: Harden runner + uses: step-security/harden-runner@1d88384fd173af6ecb012dfd0264a306b711241a # v2.22.4 + with: + egress-policy: audit - uses: actions/checkout@v7 - uses: dtolnay/rust-toolchain@b725eda525362e7cf34af9a7243cac1e3f01a7ec # stable - uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2.9.3 @@ -69,6 +77,10 @@ jobs: RUSTFLAGS: --cfg craft_pdf_unicode_fixtures CARGO_TARGET_WASM32_UNKNOWN_UNKNOWN_RUNNER: wasm-bindgen-test-runner steps: + - name: Harden runner + uses: step-security/harden-runner@1d88384fd173af6ecb012dfd0264a306b711241a # v2.22.4 + with: + egress-policy: audit - uses: actions/checkout@v7 - uses: dtolnay/rust-toolchain@b725eda525362e7cf34af9a7243cac1e3f01a7ec # stable with: @@ -105,6 +117,10 @@ jobs: name: Plate tests and craft-prepress runs-on: ubuntu-latest steps: + - name: Harden runner + uses: step-security/harden-runner@1d88384fd173af6ecb012dfd0264a306b711241a # v2.22.4 + with: + egress-policy: audit - uses: actions/checkout@v7 - uses: dtolnay/rust-toolchain@b725eda525362e7cf34af9a7243cac1e3f01a7ec # stable with: diff --git a/.github/workflows/print.yml b/.github/workflows/print.yml index 4c8fa040..80f0415d 100644 --- a/.github/workflows/print.yml +++ b/.github/workflows/print.yml @@ -23,6 +23,10 @@ jobs: os: ${{ github.event_name == 'workflow_dispatch' && fromJSON('["ubuntu-latest","windows-latest","macos-latest"]') || fromJSON('["ubuntu-latest","windows-latest"]') }} runs-on: ${{ matrix.os }} steps: + - name: Harden runner + uses: step-security/harden-runner@1d88384fd173af6ecb012dfd0264a306b711241a # v2.22.4 + with: + egress-policy: audit - uses: actions/checkout@v7 - uses: dtolnay/rust-toolchain@b725eda525362e7cf34af9a7243cac1e3f01a7ec # stable with: diff --git a/.github/workflows/proof.yml b/.github/workflows/proof.yml index 96b9a109..86a229f3 100644 --- a/.github/workflows/proof.yml +++ b/.github/workflows/proof.yml @@ -24,6 +24,10 @@ jobs: name: Proofing lint, tests with and without Language data, WASM runs-on: ubuntu-latest steps: + - name: Harden runner + uses: step-security/harden-runner@1d88384fd173af6ecb012dfd0264a306b711241a # v2.22.4 + with: + egress-policy: audit - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false diff --git a/.github/workflows/ui.yml b/.github/workflows/ui.yml index e498d0b4..0d9bccea 100644 --- a/.github/workflows/ui.yml +++ b/.github/workflows/ui.yml @@ -29,6 +29,10 @@ jobs: os: ${{ github.event_name == 'workflow_dispatch' && fromJSON('["ubuntu-latest","windows-latest","macos-latest"]') || fromJSON('["ubuntu-latest","windows-latest"]') }} runs-on: ${{ matrix.os }} steps: + - name: Harden runner + uses: step-security/harden-runner@1d88384fd173af6ecb012dfd0264a306b711241a # v2.22.4 + with: + egress-policy: audit - uses: actions/checkout@v7 - name: Install software Vulkan renderer if: runner.os == 'Linux' @@ -53,6 +57,10 @@ jobs: name: UI WASM runs-on: ubuntu-latest steps: + - name: Harden runner + uses: step-security/harden-runner@1d88384fd173af6ecb012dfd0264a306b711241a # v2.22.4 + with: + egress-policy: audit - uses: actions/checkout@v7 - uses: dtolnay/rust-toolchain@b725eda525362e7cf34af9a7243cac1e3f01a7ec # stable with: diff --git a/.github/workflows/update.yml b/.github/workflows/update.yml index 02d18f30..69ff8283 100644 --- a/.github/workflows/update.yml +++ b/.github/workflows/update.yml @@ -27,6 +27,10 @@ jobs: os: ${{ github.event_name == 'workflow_dispatch' && fromJSON('["ubuntu-latest","windows-latest","macos-latest"]') || fromJSON('["ubuntu-latest","windows-latest"]') }} runs-on: ${{ matrix.os }} steps: + - name: Harden runner + uses: step-security/harden-runner@1d88384fd173af6ecb012dfd0264a306b711241a # v2.22.4 + with: + egress-policy: audit - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: # The token isn't needed after checkout; cargo runs build scripts and proc macros from diff --git a/.github/workflows/vectorcraft-format.yml b/.github/workflows/vectorcraft-format.yml index 04c90e58..7c2f618a 100644 --- a/.github/workflows/vectorcraft-format.yml +++ b/.github/workflows/vectorcraft-format.yml @@ -27,6 +27,10 @@ jobs: os: ${{ github.event_name == 'workflow_dispatch' && fromJSON('["ubuntu-latest","windows-latest","macos-latest"]') || fromJSON('["ubuntu-latest","windows-latest"]') }} runs-on: ${{ matrix.os }} steps: + - name: Harden runner + uses: step-security/harden-runner@1d88384fd173af6ecb012dfd0264a306b711241a # v2.22.4 + with: + egress-policy: audit - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false diff --git a/.github/workflows/video.yml b/.github/workflows/video.yml index c8d05aa5..d091aca4 100644 --- a/.github/workflows/video.yml +++ b/.github/workflows/video.yml @@ -21,6 +21,10 @@ jobs: name: Video lint, feature sets, docs, WASM runs-on: ubuntu-latest steps: + - name: Harden runner + uses: step-security/harden-runner@1d88384fd173af6ecb012dfd0264a306b711241a # v2.22.4 + with: + egress-policy: audit - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false @@ -55,6 +59,10 @@ jobs: runs-on: ${{ matrix.os }} name: Video tests (${{ matrix.os }}) steps: + - name: Harden runner + uses: step-security/harden-runner@1d88384fd173af6ecb012dfd0264a306b711241a # v2.22.4 + with: + egress-policy: audit - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false diff --git a/.github/workflows/web-api.yml b/.github/workflows/web-api.yml index 7916651f..966f7845 100644 --- a/.github/workflows/web-api.yml +++ b/.github/workflows/web-api.yml @@ -25,6 +25,10 @@ jobs: env: CARGO_TARGET_WASM32_UNKNOWN_UNKNOWN_RUNNER: wasm-bindgen-test-runner steps: + - name: Harden runner + uses: step-security/harden-runner@1d88384fd173af6ecb012dfd0264a306b711241a # v2.22.4 + with: + egress-policy: audit - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false diff --git a/.github/workflows/web-host.yml b/.github/workflows/web-host.yml index 8a905e94..c9a1c58e 100644 --- a/.github/workflows/web-host.yml +++ b/.github/workflows/web-host.yml @@ -26,6 +26,10 @@ jobs: env: CARGO_TARGET_WASM32_UNKNOWN_UNKNOWN_RUNNER: wasm-bindgen-test-runner steps: + - name: Harden runner + uses: step-security/harden-runner@1d88384fd173af6ecb012dfd0264a306b711241a # v2.22.4 + with: + egress-policy: audit - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false diff --git a/.github/workflows/window.yml b/.github/workflows/window.yml index ce3d7120..2fd5a797 100644 --- a/.github/workflows/window.yml +++ b/.github/workflows/window.yml @@ -27,6 +27,10 @@ jobs: os: ${{ github.event_name == 'workflow_dispatch' && fromJSON('["ubuntu-latest","windows-latest","macos-latest"]') || fromJSON('["ubuntu-latest","windows-latest"]') }} runs-on: ${{ matrix.os }} steps: + - name: Harden runner + uses: step-security/harden-runner@1d88384fd173af6ecb012dfd0264a306b711241a # v2.22.4 + with: + egress-policy: audit - uses: actions/checkout@v7 with: # The token isn't needed after checkout; cargo runs build scripts and proc macros from