From e6d67f26f44df6714669388c78bffc05b874de03 Mon Sep 17 00:00:00 2001
From: "stepsecurity-app[bot]"
 <188008098+stepsecurity-app[bot]@users.noreply.github.com>
Date: Wed, 5 Aug 2026 12:33:23 +0000
Subject: [PATCH] Apply GitHub Actions security best practices

Signed-off-by: StepSecurity Bot <bot@stepsecurity.io>
---
 .github/workflows/ci.yaml | 27 ++++++++++++++++++++-------
 1 file changed, 20 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index a50b095..c7f15d7 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -10,6 +10,9 @@ on:
 env:
   RUSTFLAGS: -Dwarnings
 
+permissions:
+  contents: read
+
 jobs:
   build_and_test:
     name: Build and test
@@ -20,28 +23,33 @@ jobs:
         rust: [stable]
 
     steps:
-    - uses: actions/checkout@master
+    - name: Harden the runner (Audit all outbound calls)
+      uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
+      with:
+        egress-policy: audit
+
+    - uses: actions/checkout@61b9e3751b92087fd0b06925ba6dd6314e06f089 # master
 
     - name: Install ${{ matrix.rust }}
-      uses: actions-rs/toolchain@v1
+      uses: step-security/actions-rs-toolchain@40a2f87e50bed6faa2d050e99810b226b75d8c8a # v1.0.7
       with:
         toolchain: ${{ matrix.rust }}
         override: true
 
     - name: check
-      uses: actions-rs/cargo@v1
+      uses: step-security/actions-rs-cargo@34f23e8d4bb3618bc5485c3341f2bf88024fc4dc # v1.0.1
       with:
         command: check
         args: --all --bins --examples
 
     - name: check unstable
-      uses: actions-rs/cargo@v1
+      uses: step-security/actions-rs-cargo@34f23e8d4bb3618bc5485c3341f2bf88024fc4dc # v1.0.1
       with:
         command:  check
         args: --all --benches --bins --examples --tests
 
     - name: tests
-      uses: actions-rs/cargo@v1
+      uses: step-security/actions-rs-cargo@34f23e8d4bb3618bc5485c3341f2bf88024fc4dc # v1.0.1
       with:
         command: test
         args: --all
@@ -50,8 +58,13 @@ jobs:
     name: Checking fmt and docs
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@master
-    - uses: actions-rs/toolchain@v1
+    - name: Harden the runner (Audit all outbound calls)
+      uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
+      with:
+        egress-policy: audit
+
+    - uses: actions/checkout@61b9e3751b92087fd0b06925ba6dd6314e06f089 # master
+    - uses: step-security/actions-rs-toolchain@40a2f87e50bed6faa2d050e99810b226b75d8c8a # v1.0.7
       with:
         toolchain: nightly
         components: rustfmt, clippy