From a3593b649d7200f209ec238ea38584a1f4273292 Mon Sep 17 00:00:00 2001
From: "stepsecurity-app[bot]"
 <188008098+stepsecurity-app[bot]@users.noreply.github.com>
Date: Wed, 21 Jan 2026 16:27:42 +0000
Subject: [PATCH] [StepSecurity] Apply security best practices

Signed-off-by: StepSecurity Bot <bot@stepsecurity.io>
---
 ...uild-image-on-swift-image-using-copier.yml |  7 ++++++-
 .../workflows/build-image-using-copier.yml    | 21 ++++++++++++-------
 .github/workflows/docker-image-ci.yml         | 20 +++++++++++++-----
 3 files changed, 35 insertions(+), 13 deletions(-)

diff --git a/.github/workflows/build-image-on-swift-image-using-copier.yml b/.github/workflows/build-image-on-swift-image-using-copier.yml
index 2886bd2..c88dcd1 100644
--- a/.github/workflows/build-image-on-swift-image-using-copier.yml
+++ b/.github/workflows/build-image-on-swift-image-using-copier.yml
@@ -31,7 +31,12 @@ jobs:
     outputs:
       tags: ${{ steps.tags.outputs.tags }}
     steps:
-    - uses: actions/checkout@v6
+    - name: Harden the runner (Audit all outbound calls)
+      uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
+      with:
+        egress-policy: audit
+
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
 
     - id: latest_tags
       uses: ./.github/actions/tags_for_latest
diff --git a/.github/workflows/build-image-using-copier.yml b/.github/workflows/build-image-using-copier.yml
index c8b1eeb..7ad308e 100644
--- a/.github/workflows/build-image-using-copier.yml
+++ b/.github/workflows/build-image-using-copier.yml
@@ -16,6 +16,8 @@ on:
         required: true
         type: string
 
+permissions: {}
+
 jobs:
   build_image_using_copier:
     name: Build ${{ inputs.image_name }} image using copier
@@ -25,14 +27,19 @@ jobs:
       packages: write
 
     steps:
-    - uses: actions/checkout@v6
+    - name: Harden the runner (Audit all outbound calls)
+      uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
+      with:
+        egress-policy: audit
+
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
 
-    - uses: actions/download-artifact@v6
+    - uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
       with:
         name: swiftlint_amd64
         path: copier
 
-    - uses: actions/download-artifact@v6
+    - uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
       with:
         name: swiftlint_arm64
         path: copier
@@ -57,25 +64,25 @@ jobs:
     - run: echo "${{ inputs.tags }}"
 
     # - name: Login to Docker Hub
-    #   uses: step-security/docker-login-action@v3
+    #   uses: step-security/docker-login-action@c3e677aae8393bc9c81cfdf9709648720ea4bd4d # v3.6.0
     #   with:
     #     username: ${{ github.actor }}
     #     password: ${{ secrets.GITHUB_TOKEN }}
 
     - name: Login to GitHub Container Registry
-      uses: step-security/docker-login-action@v3
+      uses: step-security/docker-login-action@c3e677aae8393bc9c81cfdf9709648720ea4bd4d # v3.6.0
       with:
         registry: ghcr.io
         username: ${{ github.actor }}
         password: ${{ secrets.GITHUB_TOKEN }}
 
     - name: Set up Docker Buildx
-      uses: step-security/setup-buildx-action@v3
+      uses: step-security/setup-buildx-action@8c8aef2d414c0b66518fee2b7084e0986f82d7ac # v3.11.1
       with:
         version: latest
 
     - name: build image using copier
-      uses: step-security/docker-build-push-action@v6
+      uses: step-security/docker-build-push-action@a8c3d08b23f8be6aeed43eb1a14ce6fe51284438 # v6.18.0
       with:
         build-args: ${{ inputs.build-args }}
         context: copier
diff --git a/.github/workflows/docker-image-ci.yml b/.github/workflows/docker-image-ci.yml
index d8676fe..af69c33 100644
--- a/.github/workflows/docker-image-ci.yml
+++ b/.github/workflows/docker-image-ci.yml
@@ -43,7 +43,12 @@ jobs:
       swiftlint_revision: ${{ env.SWIFTLINT_REVISION }}
 
     steps:
-    - uses: actions/checkout@v6
+    - name: Harden the runner (Audit all outbound calls)
+      uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
+      with:
+        egress-policy: audit
+
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
 
     - name: Validate tag format
       if: github.event_name == 'workflow_dispatch'
@@ -58,12 +63,12 @@ jobs:
 
     - uses: ./.github/actions/configure-docker-containerd-image-store
 
-    - uses: step-security/setup-buildx-action@v3
+    - uses: step-security/setup-buildx-action@8c8aef2d414c0b66518fee2b7084e0986f82d7ac # v3.11.1
       with:
         version: latest
 
     - name: build ${{ matrix.target_arch }} architecture
-      uses: step-security/docker-build-push-action@v6
+      uses: step-security/docker-build-push-action@a8c3d08b23f8be6aeed43eb1a14ce6fe51284438 # v6.18.0
       with:
         build-args: |
           BUILDER_IMAGE=swift:6.2-jammy
@@ -84,7 +89,7 @@ jobs:
         > copier/swiftlint_linux_${{ matrix.target_arch }}.tar.gz
 
     - name: upload ${{ matrix.target_arch }} artifact
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
       with:
         name: swiftlint_${{ matrix.target_arch }}
         path: copier/swiftlint_linux_${{ matrix.target_arch }}.tar.gz
@@ -96,7 +101,12 @@ jobs:
     outputs:
       tags: ${{ steps.slim_tag_list.outputs.list }}
     steps:
-    - uses: actions/checkout@v6
+    - name: Harden the runner (Audit all outbound calls)
+      uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
+      with:
+        egress-policy: audit
+
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
 
     - id: slim_tags
       uses: ./.github/actions/product