From 61556032511c093e6626feb871e1e7b669e8d818 Mon Sep 17 00:00:00 2001
From: "stepsecurity-app[bot]"
 <188008098+stepsecurity-app[bot]@users.noreply.github.com>
Date: Wed, 1 Apr 2026 05:28:11 +0000
Subject: [PATCH] [StepSecurity] Apply security best practices

Signed-off-by: StepSecurity Bot <bot@stepsecurity.io>
---
 .github/workflows/build_and_test.yaml | 24 +++++++++++++++++-------
 .github/workflows/license_check.yaml  |  9 +++++++--
 .github/workflows/lint.yaml           | 11 ++++++++---
 .github/workflows/release.yaml        |  7 ++++++-
 4 files changed, 38 insertions(+), 13 deletions(-)

diff --git a/.github/workflows/build_and_test.yaml b/.github/workflows/build_and_test.yaml
index 2772cd4..7622cf6 100644
--- a/.github/workflows/build_and_test.yaml
+++ b/.github/workflows/build_and_test.yaml
@@ -34,8 +34,13 @@ jobs:
     name: ${{ matrix.name }}
     runs-on: ${{ matrix.runner }}
     steps:
-    - uses: actions/checkout@v4
-    - uses: Swatinem/rust-cache@v2
+    - name: Harden the runner (Audit all outbound calls)
+      uses: step-security/harden-runner@fa2e9d605c4eeb9fcad4c99c224cee0c6c7f3594 # v2.16.0
+      with:
+        egress-policy: audit
+
+    - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+    - uses: step-security/rust-cache@9be15b830520fab0ec3939586e917e4855cf76bd # v2.8.3
       with:
         # rust-cache already handles all the sane defaults for caching rust builds.
         # However because we are running seperate debug/release builds in parallel,
@@ -51,7 +56,7 @@ jobs:
         # * PRs that update rust version or changes deps will be slow to iterate on due to changes not being cached.
         save-if: ${{ github.ref == 'refs/heads/main' }}
     - name: Install nextest
-      uses: taiki-e/install-action@v2
+      uses: taiki-e/install-action@bfadeaba214680fb4ab63e710bcb2a6a17019fdc # v2.70.4
       with:
         tool: nextest@0.9.78
     - name: Build tests
@@ -59,7 +64,7 @@ jobs:
         cargo test --doc ${{ matrix.cargo_flags }} --all-features -- --show-output --nocapture
         cargo nextest archive --archive-file nextest-${{ matrix.profile }}.tar.zst ${{ matrix.cargo_flags }} --all-features --all-targets
     - name: Upload built tests to workflow
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
       with:
         name: nextest-${{ matrix.profile }}
         path: nextest-${{ matrix.profile }}.tar.zst
@@ -82,14 +87,19 @@ jobs:
     runs-on: ubuntu-latest
     needs: build_check_and_upload
     steps:
-    - uses: actions/checkout@v4
+    - name: Harden the runner (Audit all outbound calls)
+      uses: step-security/harden-runner@fa2e9d605c4eeb9fcad4c99c224cee0c6c7f3594 # v2.16.0
+      with:
+        egress-policy: audit
+
+    - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
     - name: Install nextest
-      uses: taiki-e/install-action@v2
+      uses: taiki-e/install-action@bfadeaba214680fb4ab63e710bcb2a6a17019fdc # v2.70.4
       with:
         tool: nextest@0.9.78
     - run: mkdir -p ~/.cargo/bin
     - name: Download archive
-      uses: actions/download-artifact@v4
+      uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
       with:
         name: nextest-${{ matrix.profile }}
     - name: Run tests
diff --git a/.github/workflows/license_check.yaml b/.github/workflows/license_check.yaml
index 18288ca..54ac3c8 100644
--- a/.github/workflows/license_check.yaml
+++ b/.github/workflows/license_check.yaml
@@ -20,9 +20,14 @@ jobs:
     runs-on: ubuntu-latest
     name: License Check
     steps:
-      - uses: actions/checkout@v4
+      - name: Harden the runner (Audit all outbound calls)
+        uses: step-security/harden-runner@fa2e9d605c4eeb9fcad4c99c224cee0c6c7f3594 # v2.16.0
+        with:
+          egress-policy: audit
+
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
       - name: Install cargo deny
-        uses: taiki-e/install-action@v2
+        uses: taiki-e/install-action@bfadeaba214680fb4ab63e710bcb2a6a17019fdc # v2.70.4
         with:
           tool: cargo-deny@0.18.2
       - run: cargo deny check licenses
diff --git a/.github/workflows/lint.yaml b/.github/workflows/lint.yaml
index 5d452ee..838d2d9 100644
--- a/.github/workflows/lint.yaml
+++ b/.github/workflows/lint.yaml
@@ -20,8 +20,13 @@ jobs:
     name: Formatting and lints
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v4
-    - uses: Swatinem/rust-cache@v2
+    - name: Harden the runner (Audit all outbound calls)
+      uses: step-security/harden-runner@fa2e9d605c4eeb9fcad4c99c224cee0c6c7f3594 # v2.16.0
+      with:
+        egress-policy: audit
+
+    - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+    - uses: step-security/rust-cache@9be15b830520fab0ec3939586e917e4855cf76bd # v2.8.3
       with:
         # this line means that only the main branch writes to the cache
         # benefits:
@@ -31,7 +36,7 @@ jobs:
         # * PRs that update rust version or changes deps will be slow to iterate on due to changes not being cached.
         save-if: ${{ github.ref == 'refs/heads/main' }}
     - name: Install cargo-hack
-      uses: taiki-e/install-action@v2
+      uses: taiki-e/install-action@bfadeaba214680fb4ab63e710bcb2a6a17019fdc # v2.70.4
       with:
         tool: cargo-hack@0.6.16
     - name: Ensure `cargo fmt --all` was run
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index 5ddf390..b59646c 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -11,7 +11,12 @@ jobs:
     name: "Publish to crates.io"
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - name: Harden the runner (Audit all outbound calls)
+        uses: step-security/harden-runner@fa2e9d605c4eeb9fcad4c99c224cee0c6c7f3594 # v2.16.0
+        with:
+          egress-policy: audit
+
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
       - name: Publish
         run: |
           cd windsock