[StepSecurity] Apply security best practices

.github/workflows/git.yml

@@ -1,5 +1,8 @@
 on: [push, pull_request]
 name: Git Compatibility
+permissions:
+  contents: read
+
 jobs:
   test:
     strategy:
@@ -13,13 +16,18 @@ jobs:
         GIT_DIST_PATH: .git-dist/${{ matrix.git[0] }}
 
     steps:
+    - name: Harden the runner (Audit all outbound calls)
+      uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
+      with:
+        egress-policy: audit
+
     - name: Install Go
-      uses: actions/setup-go@v1
+      uses: actions/setup-go@0caeaed6fd66a828038c2da3c0f662a42862658f # v1.1.3
       with:
         go-version: 1.14.x
 
     - name: Checkout code
-      uses: actions/checkout@v2
+      uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2.7.0
 
     - name: Install build dependencies
       run: sudo apt-get install gettext

.github/workflows/test.yml

@@ -10,13 +10,18 @@ jobs:
 
     runs-on: ${{ matrix.platform }}
     steps:
+    - name: Harden the runner (Audit all outbound calls)
+      uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
+      with:
+        egress-policy: audit
+
     - name: Install Go
-      uses: actions/setup-go@v1
+      uses: actions/setup-go@0caeaed6fd66a828038c2da3c0f662a42862658f # v1.1.3
       with:
         go-version: ${{ matrix.go-version }}   
 
     - name: Checkout code
-      uses: actions/checkout@v2
+      uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2.7.0
 
     - name: Configure known hosts
       if: matrix.platform != 'ubuntu-latest'
@@ -34,14 +39,14 @@ jobs:
 
     - name: Convert coverage to lcov
       if: matrix.platform == 'ubuntu-latest' && matrix.go-version == '1.14.x' 
-      uses: jandelgado/gcov2lcov-action@v1.0.0
+      uses: jandelgado/gcov2lcov-action@04274be12945a9e1a03fb3cc141e65d043cb04cd # v1.0.0
       with:
           infile: coverage.out
           outfile: coverage.lcov
 
     - name: Coveralls
       if: matrix.platform == 'ubuntu-latest' && matrix.go-version == '1.14.x' 
-      uses: coverallsapp/github-action@master
+      uses: coverallsapp/github-action@09b709cf6a16e30b0808ba050c7a6e8a5ef13f8d # master
       with:
         github-token: ${{ secrets.GITHUB_TOKEN }}
         path-to-lcov: coverage.lcov