feat(ci): add StepSecurity Harden-Runner to all workflow jobs (audit mode)

Author: n24q02m

.github/workflows/cd.yml

@@ -32,6 +32,11 @@ jobs:
       version: ${{ steps.release.outputs.version }}
       is_prerelease: ${{ steps.release.outputs.is_prerelease }}
     steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@v2
+        with:
+          egress-policy: audit
+
       - uses: actions/checkout@v6
         with:
           token: ${{ secrets.GH_PAT }}
@@ -59,6 +64,11 @@ jobs:
     if: needs.release.outputs.released == 'true'
     runs-on: ubuntu-latest
     steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@v2
+        with:
+          egress-policy: audit
+
       - uses: actions/checkout@v6
         with:
           ref: ${{ needs.release.outputs.tag }}

.github/workflows/ci.yml

@@ -15,6 +15,11 @@ jobs:
     name: Lint & Test
     runs-on: ubuntu-latest
     steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@v2
+        with:
+          egress-policy: audit
+
       - uses: actions/checkout@v6
       - uses: astral-sh/setup-uv@v6
         with:
@@ -39,6 +44,11 @@ jobs:
     if: github.event_name == 'pull_request'
     runs-on: ubuntu-latest
     steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@v2
+        with:
+          egress-policy: audit
+
       - uses: actions/checkout@v6
       - uses: actions/dependency-review-action@v4
         with: