[StepSecurity] Swap third-party actions to StepSecurity-maintained forks

[rehan-fr]

Swaps third-party GitHub Actions to their StepSecurity-maintained forks, pinned to the fork's latest release SHA:

• erlef/setup-beam -> step-security/setup-beam@05e480cfdc64 (v1.24.1)

• runs-on/cache -> step-security/runs-on-cache@e61ed9b0206c (v5.0.8)

• runs-on/cache/restore -> step-security/runs-on-cache/restore@e61ed9b0206c (v5.0.8)

• runs-on/cache/save -> step-security/runs-on-cache/save@e61ed9b0206c (v5.0.8)

• files changed: 2

• references swapped: 10

StepSecurity forks are drop-in replacements (same inputs/outputs) with security hardening and active maintenance. Part of the org-wide StepSecurity third-party-action migration (freshaengineering/team-devex#483).

🤖 Generated with Claude Code

[stepsecurity-app]

Harden Runner Policy Violation

This workflow run was blocked by the block jobs without harden runner run policy.

Jobs not protected by Harden Runner:

• .github/workflows/ci.yml::check_release
• .github/workflows/ci.yml::interop-tests
• .github/workflows/ci.yml::permit
• .github/workflows/ci.yml::publish
• .github/workflows/ci.yml::static
• .github/workflows/ci.yml::test

Update the affected jobs so Harden Runner is initialized before any other action or command runs.

What this means: a job in this workflow does not run the harden-runner step with the org policy store, so its network egress and runtime might be unmonitored.

How to fix: add step-security/harden-runner (pinned to a full commit SHA) as the first step of the job, with use-policy-store: true and the org API key — copy the "Harden the runner" step from any existing workflow. Questions? Contact #team-devex in Slack

For more information, see StepSecurity's documentation.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	step-security/​runs-on-cache@​e61ed9b0206c630e9a6bb5f12ca4cd78ae7bbe93
	step-security/​harden-runner@​9af89fc71515a100421586dfdb3dc9c984fbf411
	step-security/​setup-beam@​05e480cfdc64c72ab6c25b134dd1f57e29776c84

View full report