From e8a60a872bba417add41adfb80c4d8e71445c7ee Mon Sep 17 00:00:00 2001
From: "stepsecurity-app[bot]"
 <188008098+stepsecurity-app[bot]@users.noreply.github.com>
Date: Tue, 16 Sep 2025 23:12:53 +0000
Subject: [PATCH] [StepSecurity] Apply security best practices

Signed-off-by: StepSecurity Bot <bot@stepsecurity.io>
---
 .github/workflows/git.yml  | 12 ++++++++++--
 .github/workflows/test.yml | 13 +++++++++----
 2 files changed, 19 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/git.yml b/.github/workflows/git.yml
index bbccaa36b..a403bf6f6 100644
--- a/.github/workflows/git.yml
+++ b/.github/workflows/git.yml
@@ -1,5 +1,8 @@
 on: [push, pull_request]
 name: Git Compatibility
+permissions:
+  contents: read
+
 jobs:
   test:
     strategy:
@@ -13,13 +16,18 @@ jobs:
         GIT_DIST_PATH: .git-dist/${{ matrix.git[0] }}
 
     steps:
+    - name: Harden the runner (Audit all outbound calls)
+      uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
+      with:
+        egress-policy: audit
+
     - name: Install Go
-      uses: actions/setup-go@v1
+      uses: actions/setup-go@0caeaed6fd66a828038c2da3c0f662a42862658f # v1.1.3
       with:
         go-version: 1.14.x
 
     - name: Checkout code
-      uses: actions/checkout@v2
+      uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2.7.0
 
     - name: Install build dependencies
       run: sudo apt-get install gettext
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 1644dcfc9..4be31b68f 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -10,13 +10,18 @@ jobs:
     
     runs-on: ${{ matrix.platform }}
     steps:
+    - name: Harden the runner (Audit all outbound calls)
+      uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
+      with:
+        egress-policy: audit
+
     - name: Install Go
-      uses: actions/setup-go@v1
+      uses: actions/setup-go@0caeaed6fd66a828038c2da3c0f662a42862658f # v1.1.3
       with:
         go-version: ${{ matrix.go-version }}   
 
     - name: Checkout code
-      uses: actions/checkout@v2
+      uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2.7.0
   
     - name: Configure known hosts
       if: matrix.platform != 'ubuntu-latest'
@@ -34,14 +39,14 @@ jobs:
 
     - name: Convert coverage to lcov
       if: matrix.platform == 'ubuntu-latest' && matrix.go-version == '1.14.x' 
-      uses: jandelgado/gcov2lcov-action@v1.0.0
+      uses: jandelgado/gcov2lcov-action@04274be12945a9e1a03fb3cc141e65d043cb04cd # v1.0.0
       with:
           infile: coverage.out
           outfile: coverage.lcov
 
     - name: Coveralls
       if: matrix.platform == 'ubuntu-latest' && matrix.go-version == '1.14.x' 
-      uses: coverallsapp/github-action@master
+      uses: coverallsapp/github-action@09b709cf6a16e30b0808ba050c7a6e8a5ef13f8d # master
       with:
         github-token: ${{ secrets.GITHUB_TOKEN }}
         path-to-lcov: coverage.lcov