more CI hardening

canonical · May 22, 2024 · 5656ae9 · 5656ae9
1 parent 52c2dbb
commit 5656ae9
Show file tree

Hide file tree

Showing 3 changed files with 30 additions and 0 deletions.
diff --git a/.github/workflows/strict-integration.yaml b/.github/workflows/strict-integration.yaml
@@ -6,13 +6,21 @@ on:
       - main
       - 'release-[0-9]+.[0-9]+'
       - 'autoupdate/sync/**'
+      - KU-629/harden-CI-follow-up  #TODO: rm after testing
   pull_request:
 
+permissions:
+  contents: read
+
 jobs:
   build:
     name: Build
     runs-on: ubuntu-20.04
     steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@v2
+        with:
+          egress-policy: audit
       - name: Checking out repo
         uses: actions/checkout@v4
       - name: Install lxd

diff --git a/.github/workflows/strict.yaml b/.github/workflows/strict.yaml
@@ -5,6 +5,7 @@ on:
     branches:
       - main
       - 'release-[0-9]+.[0-9]+'
+      - KU-629/harden-CI-follow-up #TODO: rm after testing
 
 permissions:
   contents: read
@@ -16,6 +17,10 @@ jobs:
     outputs:
       strict: ${{ steps.determine.outputs.strict }}
     steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@v2
+        with:
+          egress-policy: audit
       - name: Determine Strict branch
         id: determine
         env:
@@ -37,6 +42,10 @@ jobs:
     needs: [ prepare ]
     if: ${{ needs.prepare.outputs.strict }}
     steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@v2
+        with:
+          egress-policy: audit
       - name: Sync ${{ github.ref }} to ${{ needs.prepare.outputs.strict }}
         uses: actions/checkout@v4
         with:

diff --git a/.github/workflows/update-components.yaml b/.github/workflows/update-components.yaml
@@ -4,9 +4,18 @@ on:
   workflow_dispatch:
   schedule:
     - cron: "0 10 * * *"
+  push: #TODO: rm after testing
+    branches:
+      - KU-629/harden-CI-follow-up
+
+permissions:
+  contents: read
 
 jobs:
   update:
+    permissions:
+      contents: write # for peter-evans/create-pull-request to create branch
+      pull-requests: write # for peter-evans/create-pull-request to create a PR
     runs-on: ubuntu-latest
     strategy:
       fail-fast: false
@@ -18,6 +27,10 @@ jobs:
           - release-1.30
 
     steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@v2
+        with:
+          egress-policy: audit
       - name: Checking out repo
         uses: actions/checkout@v4
         with: