[StepSecurity] Apply security best practices

[stepsecurity-app]

Summary

This pull request has been generated by StepSecurity as part of your enterprise subscription to ensure compliance with recommended security best practices. Please review and merge the pull request to apply these security enhancements.

Security Fixes

Harden Runner

Harden-Runner is an open-source security agent for the GitHub-hosted runner to prevent software supply chain attacks. It prevents exfiltration of credentials, detects tampering of source code during build, and enables running jobs without sudo access.

• GitHub Security Guide
• The Open Source Security Foundation (OpenSSF) Security Guide

Feedback

For bug reports, feature requests, and general feedback; please create an issue in step-security/secure-repo or contact us via our website.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	step-security/​harden-runner@​9af89fc71515a100421586dfdb3dc9c984fbf411

View full report

[rehan-fr]

Approving StepSecurity security-best-practices changes.

[ooaklee]

Reviewed the workflow hardening changes. The diff is scoped and the modified workflows remain valid; any current failing checks are unrelated to this change.

[rehan-fr]

Reviewed via Claude Code agent fleet: diff classified, every sha-pin verified against its claimed tag, fork input/output compatibility checked at the pinned sha, permissions and harden-runner impact audited, CI triaged.

Purely mechanical StepSecurity PR: adds an identical sha-pinned harden-runner step (v2.19.4) to 8 jobs across ci.yml, cron_ci.yml, and dev-publish.yaml with zero deletions and no other changes. Pin verified against the upstream repo, and all CI failures on the PR are identical to pre-existing failures on master, so it is safe to merge.

Notes:

• Pinned sha 9af89fc71515a100421586dfdb3dc9c984fbf411 verified as tag v2.19.4 of step-security/harden-runner (comment says '# v2'; the moving v2 tag now points to a newer commit bf7454d, so this pin lags the latest v2 release — fine, just not latest).
• Egress policy is not declared in the workflow: 'use-policy-store: true' means the policy (audit vs block, allowed endpoints) lives in StepSecurity's remote policy store and cannot be audited from the repo. Observed PR run shows harden-runner succeeded in every job and no step failed due to blocked egress, so current behavior is non-breaking, but a later policy-store change to 'block' could break builds without a repo diff.
• Follows the org convention seen elsewhere: use-policy-store: true + api-key: secrets.GH_FRESHAENGINEERING_STEP_SECURITY_API_KEY.
• Harden-runner was added inside container jobs (elixir:1.9, elixir:1.10-slim containers) as well as self-hosted-style 'runs-on' runners; all such steps completed successfully in the PR run, though its agent logs show minor errors (feature-flag fetch 404, auditd status) that do not fail the jobs.