ci: Harden CI workflow

sjinks · Mar 26, 2023 · 8c6fbc1 · 8c6fbc1
1 parent 013c74c
commit 8c6fbc1
Show file tree

Hide file tree

Showing 2 changed files with 50 additions and 1 deletion.
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -13,6 +13,16 @@ jobs:
     runs-on: ubuntu-latest
     if: ${{ !contains(github.event.head_commit.message, '[ci skip]') || github.event_name == 'workflow_dispatch' }}
     steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@1f99358870fe1c846a3ccba386cc2b2246836776 # v2.2.1
+        with:
+          disable-sudo: true
+          disable-file-monitoring: true
+          egress-policy: block
+          allowed-endpoints: >
+            github.com:443
+            registry.npmjs.org:443
+
       - name: Check out the source code
         uses: actions/checkout@8f4b7f84864484a7bf31766abe9204da3cbe65b3 # v3.5.0
 
@@ -32,6 +42,19 @@ jobs:
     name: Test
     runs-on: ubuntu-latest
     steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@1f99358870fe1c846a3ccba386cc2b2246836776 # v2.2.1
+        with:
+          disable-sudo: true
+          egress-policy: block
+          allowed-endpoints: >
+            api.wordpress.org:80
+            api.wordpress.org:443
+            wordpress.org:443
+            develop.svn.wordpress.org:443
+            plugins.svn.wordpress.org:443
+            github.com:443
+
       - name: Check out the source code
         uses: actions/checkout@8f4b7f84864484a7bf31766abe9204da3cbe65b3 # v3.5.0
 
@@ -62,6 +85,21 @@ jobs:
           MYSQL_PASSWORD: wordpress
           MYSQL_DATABASE: wordpress_test
     steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@1f99358870fe1c846a3ccba386cc2b2246836776 # v2.2.1
+        with:
+          egress-policy: block
+          allowed-endpoints: >
+            api.github.com:443
+            api.wordpress.org:80
+            api.wordpress.org:443
+            wordpress.org:443
+            develop.svn.wordpress.org:443
+            plugins.svn.wordpress.org:443
+            github.com:443
+            objects.githubusercontent.com:443
+            packagist.org:443
+
       - name: Check out the source code
         uses: actions/checkout@8f4b7f84864484a7bf31766abe9204da3cbe65b3 # v3.5.0
 
@@ -96,6 +134,16 @@ jobs:
     name: Check dist
     runs-on: ubuntu-latest
     steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@1f99358870fe1c846a3ccba386cc2b2246836776 # v2.2.1
+        with:
+          disable-sudo: true
+          disable-file-monitoring: true
+          egress-policy: block
+          allowed-endpoints: >
+            github.com:443
+            registry.npmjs.org:443
+
       - name: Check out the source code
         uses: actions/checkout@8f4b7f84864484a7bf31766abe9204da3cbe65b3 # v3.5.0