Rework release Workflow to install Harden Runner

Signed-off-by: egibs <[email protected]>
chainguard-dev · Jul 30, 2024 · b220870 · b220870
1 parent 9974cd4
commit b220870
Showing 1 changed file with 11 additions and 4 deletions.
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
@@ -13,7 +13,14 @@ permissions:
 
 jobs:
   release:
-    uses: bazel-contrib/.github/.github/workflows/release_ruleset.yaml@29e53247c6366e30acbedfc767f58f79fc05836c
-    with:
-      prerelease: false
-      release_files: rules_apko-*.tar.gz
+    runs-on: ubuntu-latest
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@0d381219ddf674d61a7572ddd19d7941e271515c # v2.9.0
+        with:
+          egress-policy: audit
+      - name: Run release_ruleset
+        uses: bazel-contrib/.github/.github/workflows/release_ruleset.yaml@29e53247c6366e30acbedfc767f58f79fc05836c
+        with:
+          prerelease: false
+          release_files: rules_apko-*.tar.gz