[StepSecurity] ci: Harden GitHub Actions

.github/workflows/_build-pkg.yml

@@ -9,10 +9,18 @@ on:
         required: false
         default: "package"
 
+permissions:
+  contents: read
+
 jobs:
   build-pkg:
     runs-on: ubuntu-latest
     steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@v2
+        with:
+          egress-policy: audit
+
       - uses: actions/checkout@v3
       - name: Set up Python
         uses: actions/setup-python@v4

.github/workflows/ci.yml

@@ -28,6 +28,11 @@ jobs:
           - {python-version: "3.8", os: "windows-latest", os-label: "Windows"}
           - {python-version: "3.8", os: "macos-latest", os-label: "macOS"}
     steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@v2
+        with:
+          egress-policy: audit
+
       - uses: actions/checkout@v3
       - name: Set up Python
         uses: actions/setup-python@v4
@@ -49,6 +54,11 @@ jobs:
     runs-on: ubuntu-latest
     needs: [test]
     steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@v2
+        with:
+          egress-policy: audit
+
       - name: "Noop"
         run: true
         shell: bash
@@ -58,6 +68,11 @@ jobs:
     needs: test_success
     if: github.ref == 'refs/heads/main'
     steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@v2
+        with:
+          egress-policy: audit
+
       - uses: release-drafter/release-drafter@v5
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/lint.yml

@@ -11,6 +11,11 @@ jobs:
   mypy:
     runs-on: ubuntu-latest
     steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@v2
+        with:
+          egress-policy: audit
+
       - uses: actions/checkout@v3
       - name: Set up Python
         uses: actions/setup-python@v4
@@ -29,6 +34,11 @@ jobs:
   pre-commit:
     runs-on: ubuntu-latest
     steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@v2
+        with:
+          egress-policy: audit
+
       - uses: actions/checkout@v3
       - uses: actions/setup-python@v4
         with:
@@ -38,6 +48,11 @@ jobs:
   docs:
     runs-on: ubuntu-latest
     steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@v2
+        with:
+          egress-policy: audit
+
       - uses: actions/checkout@v3
       - uses: actions/setup-python@v4
         with:

.github/workflows/pypi-release.yml

@@ -14,6 +14,11 @@ jobs:
     needs: [build]
     runs-on: ubuntu-latest
     steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@v2
+        with:
+          egress-policy: audit
+
       - uses: actions/download-artifact@v3
         with:
           name: package