From 850f93cc12f9adfa3c200cf6239edd98c1aff1a1 Mon Sep 17 00:00:00 2001
From: "stepsecurity-app[bot]"
 <188008098+stepsecurity-app[bot]@users.noreply.github.com>
Date: Tue, 21 Jul 2026 18:18:31 +0000
Subject: [PATCH] Apply GitHub Actions security best practices

Signed-off-by: StepSecurity Bot <bot@stepsecurity.io>
---
 .github/workflows/check-fallback-versions.yml | 12 ++++++++++--
 .github/workflows/test.yml                    | 14 ++++++++++++--
 2 files changed, 22 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/check-fallback-versions.yml b/.github/workflows/check-fallback-versions.yml
index ee23ca7..d32acfb 100644
--- a/.github/workflows/check-fallback-versions.yml
+++ b/.github/workflows/check-fallback-versions.yml
@@ -4,13 +4,21 @@ on:
 name: Check fallback versions are fresh
 
 # Runs when a release branch is created/updated to check pinned CLI version
+permissions:
+  contents: read
+
 jobs:
   check-fallback-versions:
     name: "Check baked-in fallback versions are up to date"
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
-      - uses: actions/setup-node@v6
+      - name: Harden the runner (Audit all outbound calls)
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        with:
+          egress-policy: audit
+
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
         with:
           node-version: 24
       - run: npm ci
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 69d37af..1982ecb 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -87,7 +87,12 @@ jobs:
           - channel: latest-beta
             versionPath: .CLI2.beta.version
     steps:
-      - uses: actions/checkout@v6
+      - name: Harden the runner (Audit all outbound calls)
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        with:
+          egress-policy: audit
+
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
       - name: Capture expected ${{ matrix.channel }} version from app-updates
         id: expected
         run: |
@@ -118,7 +123,12 @@ jobs:
           - channel: latest-beta
             key: latestBeta
     steps:
-      - uses: actions/checkout@v6
+      - name: Harden the runner (Audit all outbound calls)
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        with:
+          egress-policy: audit
+
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
       - name: Read expected baked-in ${{ matrix.channel }} version
         id: expected
         run: |