From b7af0b9abf66a601239cc14349b7067e4b4e38ab Mon Sep 17 00:00:00 2001
From: "stepsecurity-app[bot]"
 <188008098+stepsecurity-app[bot]@users.noreply.github.com>
Date: Wed, 5 Nov 2025 20:22:02 +0000
Subject: [PATCH] [StepSecurity] Apply security best practices

Signed-off-by: StepSecurity Bot <bot@stepsecurity.io>
---
 .github/workflows/copy-tags.yml   |  7 ++++++-
 .github/workflows/test-action.yml | 14 ++++++++++++--
 .pre-commit-config.yaml           |  6 ++++++
 3 files changed, 24 insertions(+), 3 deletions(-)
 create mode 100644 .pre-commit-config.yaml

diff --git a/.github/workflows/copy-tags.yml b/.github/workflows/copy-tags.yml
index 1ec94d7..1fa3cc0 100644
--- a/.github/workflows/copy-tags.yml
+++ b/.github/workflows/copy-tags.yml
@@ -16,8 +16,13 @@ jobs:
   copy-tags:
     runs-on: ubuntu-latest
     steps:
+      - name: Harden the runner (Audit all outbound calls)
+        uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
+        with:
+          egress-policy: audit
+
       - name: 🧑‍💻 Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
         with:
           fetch-depth: 1
           fetch-tags: true
diff --git a/.github/workflows/test-action.yml b/.github/workflows/test-action.yml
index 4aba902..4b10f16 100644
--- a/.github/workflows/test-action.yml
+++ b/.github/workflows/test-action.yml
@@ -29,6 +29,11 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
+      - name: Harden the runner (Audit all outbound calls)
+        uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
+        with:
+          egress-policy: audit
+
       - name: Check preconditions 📃
         id: preconditions
         shell: bash
@@ -45,7 +50,7 @@ jobs:
       # It seems you need to checkout the code before you can use an action from the same repo
       - name: Load action ✅
         if: ${{ steps.preconditions.outputs.secret_missing != 'true' }}
-        uses: actions/checkout@v4
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
         with:
           ref: ${{ github.ref }}
 
@@ -78,8 +83,13 @@ jobs:
     name: "Analyze scripts 👮"
     runs-on: ubuntu-latest
     steps:
+      - name: Harden the runner (Audit all outbound calls)
+        uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
+        with:
+          egress-policy: audit
+
       - name: ✅ Checkout action
-        uses: actions/checkout@v4
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
 
       - name: 📃 Run script analyzer
         shell: pwsh
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
new file mode 100644
index 0000000..479defe
--- /dev/null
+++ b/.pre-commit-config.yaml
@@ -0,0 +1,6 @@
+repos:
+- repo: https://github.com/pre-commit/pre-commit-hooks
+  rev: v4.4.0
+  hooks:
+  - id: end-of-file-fixer
+  - id: trailing-whitespace