Change egress policy of harden runner to audit

wabarc · Feb 26, 2024 · ecaba89 · ecaba89
1 parent 614f911
commit ecaba89
Show file tree

Hide file tree

Showing 2 changed files with 5 additions and 0 deletions.
diff --git a/.github/workflows/analysis.yml b/.github/workflows/analysis.yml
@@ -48,6 +48,7 @@ jobs:
     uses: wabarc/.github/.github/workflows/reusable-codeql.yml@main
     with:
       language: ${{ matrix.language }}
+      egress-policy: 'audit'
 
   nancy:
     name: Sonatype Nancy
@@ -75,6 +76,8 @@ jobs:
   dependency-review:
     name: Dependency Review
     uses: wabarc/.github/.github/workflows/reusable-dependency-review.yml@main
+    with:
+      egress-policy: 'audit'
 
   trivy:
     name: Trivy
@@ -84,5 +87,6 @@ jobs:
       security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
       #actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status
     with:
+      egress-policy: 'audit'
       scan-type: 'fs'
       sarif: 'filesystem.sarif'
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
@@ -76,3 +76,4 @@ jobs:
     uses: wabarc/.github/.github/workflows/reusable-releaser-go.yml@main
     with:
       product: ghostarchive
+      egress-policy: audit