From 980259f709fb46e0ce91c496f57de325bed858c1 Mon Sep 17 00:00:00 2001
From: "stepsecurity-app[bot]"
 <188008098+stepsecurity-app[bot]@users.noreply.github.com>
Date: Sat, 11 Jul 2026 16:36:18 +0000
Subject: [PATCH] [StepSecurity] Apply security best practices

Signed-off-by: StepSecurity Bot <bot@stepsecurity.io>
---
 .github/workflows/changesets.yml           |  8 ++++++++
 .github/workflows/i18n-static-gh-pages.yml | 13 +++++++++----
 2 files changed, 17 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/changesets.yml b/.github/workflows/changesets.yml
index 7e106154..77d20d48 100644
--- a/.github/workflows/changesets.yml
+++ b/.github/workflows/changesets.yml
@@ -6,6 +6,9 @@ on:
 env:
   CI: true
 
+permissions:
+  contents: read
+
 jobs:
   version:
     timeout-minutes: 15
@@ -15,6 +18,11 @@ jobs:
       contents: write # Required for changesets to push version commit
       pull-requests: write # Required for changesets to create PRs
     steps:
+      - name: Harden the runner (Audit all outbound calls)
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        with:
+          egress-policy: audit
+
       - name: Checkout code repository
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
diff --git a/.github/workflows/i18n-static-gh-pages.yml b/.github/workflows/i18n-static-gh-pages.yml
index d93ed8c5..01e96ef3 100644
--- a/.github/workflows/i18n-static-gh-pages.yml
+++ b/.github/workflows/i18n-static-gh-pages.yml
@@ -29,15 +29,20 @@ jobs:
       url: ${{ steps.deployment.outputs.page_url }}
     runs-on: ubuntu-latest
     steps:
+      - name: Harden the runner (Audit all outbound calls)
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        with:
+          egress-policy: audit
+
       - name: Checkout
-        uses: actions/checkout@v7.0.0
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - name: Setup Pages
-        uses: actions/configure-pages@v6
+        uses: actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d # v6.0.0
       - name: Upload artifact
-        uses: actions/upload-pages-artifact@v5
+        uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0
         with:
           # Upload entire repository
           path: './workspaces/i18n'
       - name: Deploy to GitHub Pages
         id: deployment
-        uses: actions/deploy-pages@v5
+        uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5.0.0