[build] harden security of github actions

fab1an · May 6, 2024 · a5ce5a0 · a5ce5a0
1 parent bb13667
commit a5ce5a0
Showing 1 changed file with 10 additions and 5 deletions.
diff --git a/.github/workflows/build-master.yml b/.github/workflows/build-master.yml
@@ -23,9 +23,14 @@ jobs:
       url: ${{ steps.deployment.outputs.page_url }}
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - name: Harden Runner
+        uses: step-security/harden-runner@a4aa98b93cab29d9b1101a6143fb8bce00e2eac4 # v2.7.1
+        with:
+          egress-policy: audit
+
+      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
 
-      - uses: actions/setup-java@v3
+      - uses: actions/setup-java@0ab4596768b603586c0de567f2430c30f5b0d2b0 # v3.13.0
         with:
           distribution: 'temurin'
           java-version: '17'
@@ -44,12 +49,12 @@ jobs:
             exit 1
           fi
 
-      - uses: actions/configure-pages@v3
+      - uses: actions/configure-pages@b8130d9ab958b325bbde9786d62f2c97a9885a0e # v3.0.7
 
-      - uses: actions/upload-pages-artifact@v1
+      - uses: actions/upload-pages-artifact@84bb4cd4b733d5c320c9c9cfbc354937524f4d64 # v1.0.10
         with:
           path: 'build/dokka/html'
 
       - name: Deploy to Documentation GitHub Pages
         id: deployment
-        uses: actions/deploy-pages@v1
+        uses: actions/deploy-pages@f27bcc15848fdcdcc02f01754eb838e44bcf389b # v1.2.9