[StepSecurity] Apply security best practices

.github/workflows/codeql.yml

@@ -19,6 +19,9 @@ on:
   schedule:
     - cron: '23 19 * * 4'
 
+permissions:
+  contents: read
+
 jobs:
   analyze:
     name: Analyze (${{ matrix.language }})
@@ -52,6 +55,11 @@ jobs:
         # If you are analyzing a compiled language, you can modify the 'build-mode' for that language to customize how
         # your codebase is analyzed, see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages
     steps:
+    - name: Harden the runner (Audit all outbound calls)
+      uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
+      with:
+        egress-policy: audit
+
     - name: Checkout repository
       uses: actions/checkout@v4
 

.github/workflows/deploy.yaml

@@ -2,13 +2,21 @@ name: Deploy to AWS
 on: 
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   publish:
     name: Deploy to AWS
     runs-on: ubuntu-latest
     permissions:
       contents: read      
     steps:  
+        - name: Harden the runner (Audit all outbound calls)
+          uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
+          with:
+            egress-policy: audit
+
         - name: Checkout
           uses: actions/checkout@v2    
         - name: Retry Logic

.github/workflows/dispatch.yml

@@ -14,6 +14,11 @@ jobs:
   dispatch-job:
     runs-on: ubuntu-latest
     steps:
+      - name: Harden the runner (Audit all outbound calls)
+        uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
+        with:
+          egress-policy: audit
+
       - name: "Dispatch job"
         uses: actions/github-script@v7
         with:

.github/workflows/issue-assignment.yaml

@@ -4,12 +4,20 @@ on:
     issues:
         types: [opened]
 
+permissions:
+  contents: read
+
 jobs:
     auto-assign:
         runs-on: ubuntu-latest
         permissions:
             issues: write
         steps:
+            - name: Harden the runner (Audit all outbound calls)
+              uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
+              with:
+                egress-policy: audit
+
             - name: 'Auto-assign issue'
               uses: pozil/auto-assign-issue@v1
               with:

.github/workflows/pwn_request.yml

@@ -2,11 +2,19 @@ name: Pwn Request
 on:
   pull_request_target:
 
+permissions:
+  contents: read
+
 jobs:
   build:
     name: Build and test
     runs-on: ubuntu-latest
     steps:
+    - name: Harden the runner (Audit all outbound calls)
+      uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
+      with:
+        egress-policy: audit
+
     - uses: actions/checkout@v2
       with:
         ref: ${{ github.event.pull_request.head.sha }}

.github/workflows/reusable-wf.yml

@@ -35,13 +35,23 @@ jobs:
   test-injection-2:
     runs-on: ubuntu-latest
     steps:
+      - name: Harden the runner (Audit all outbound calls)
+        uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
+        with:
+          egress-policy: audit
+
       - run: echo "${{ inputs.args }}"
 
   validate-pr-title:
     if: ${{ github.repository_owner == 'nrwl' }}
     name: Validate PR Title
     runs-on: ubuntu-latest
     steps:
+      - name: Harden the runner (Audit all outbound calls)
+        uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
+        with:
+          egress-policy: audit
+
       - name: Checkout code
         uses: actions/checkout@v4
         with:

.github/workflows/super-linter.yml

@@ -11,10 +11,22 @@ on:
     branches: [ "main" ]
   pull_request:
     branches: [ "main" ]
+permissions:
+  contents: read
+
 jobs:
   run-lint:
+    permissions:
+      contents: read  # for dorny/paths-filter to fetch a list of changed files
+      pull-requests: read  # for dorny/paths-filter to read pull requests
+      statuses: write  # for github/super-linter to mark status of each linter run
     runs-on: ubuntu-latest
     steps:
+      - name: Harden the runner (Audit all outbound calls)
+        uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
+        with:
+          egress-policy: audit
+
       - name: Checkout code
         uses: actions/checkout@v3
         with: