[StepSecurity] Apply security best practices

.github/workflows/build-tokens.yml

@@ -15,6 +15,11 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
+      - name: Harden the runner (Audit all outbound calls)
+        uses: step-security/harden-runner@v2
+        with:
+          egress-policy: audit
+
       - name: 🏗 Setup repo
         uses: pnpm/action-setup@v4
         with:

.github/workflows/checks.yml

@@ -6,11 +6,19 @@ on:
     branches:
       - main
 
+permissions:
+  contents: read
+
 jobs:
   checks:
     name: Code Checks
     runs-on: ubuntu-latest
     steps:
+      - name: Harden the runner (Audit all outbound calls)
+        uses: step-security/harden-runner@v2
+        with:
+          egress-policy: audit
+
       - uses: pnpm/action-setup@v4
         with:
           version: 9

.github/workflows/chromatic.yml

@@ -11,6 +11,11 @@ jobs:
   chromatic-deployment:
     runs-on: ubuntu-latest
     steps:
+      - name: Harden the runner (Audit all outbound calls)
+        uses: step-security/harden-runner@v2
+        with:
+          egress-policy: audit
+
       - uses: pnpm/action-setup@v4
         with:
           version: 9

.github/workflows/code-connect.yml

@@ -7,11 +7,19 @@ on:
     branches:
       - main
 
+permissions:
+  contents: read
+
 jobs:
   code-connect:
     name: Code Connect
     runs-on: ubuntu-latest
     steps:
+      - name: Harden the runner (Audit all outbound calls)
+        uses: step-security/harden-runner@v2
+        with:
+          egress-policy: audit
+
       - name: 🏗 Setup repo
         uses: pnpm/action-setup@v4
         with:

.github/workflows/generate-colour-system.yml

@@ -21,11 +21,19 @@ on:
 env:
   CI: true
 
+permissions:
+  contents: read
+
 jobs:
   generate:
     name: Generate colour system
     runs-on: ubuntu-latest
     steps:
+      - name: Harden the runner (Audit all outbound calls)
+        uses: step-security/harden-runner@v2
+        with:
+          egress-policy: audit
+
       - uses: pnpm/action-setup@v4
         with:
           version: 9

.github/workflows/previews-cleanup.yml

@@ -8,13 +8,21 @@ on:
       - 'packages/native-ui/**'
       - 'apps/native-ui-storybook/**'
 
+permissions:
+  contents: read
+
 jobs:
   cleanup:
     name: Cleanup Previews
     runs-on: ubuntu-latest
     continue-on-error: true
     if: ${{ github.event.before && github.head_commit.author.username != 'github-actions[bot]'}}
     steps:
+      - name: Harden the runner (Audit all outbound calls)
+        uses: step-security/harden-runner@v2
+        with:
+          egress-policy: audit
+
       - name: 🔧 Setup pnpm
         uses: pnpm/action-setup@v4
         with:

.github/workflows/previews.yml

@@ -24,6 +24,11 @@ jobs:
       group: preview-android-${{ github.ref }}
       cancel-in-progress: true
     steps:
+      - name: Harden the runner (Audit all outbound calls)
+        uses: step-security/harden-runner@v2
+        with:
+          egress-policy: audit
+
       - name: 🔍 Check if Android build should run
         id: check_build
         run: |
@@ -157,6 +162,11 @@ jobs:
       group: preview-ios-${{ github.ref }}
       cancel-in-progress: true
     steps:
+      - name: Harden the runner (Audit all outbound calls)
+        uses: step-security/harden-runner@v2
+        with:
+          egress-policy: audit
+
       - name: 🔍 Check if iOS build should run
         id: check_build
         run: |
@@ -294,6 +304,11 @@ jobs:
       VERCEL_ORG_ID: ${{ secrets.VERCEL_ORG_ID }}
       VERCEL_PROJECT_ID: ${{ secrets.VERCEL_PROJECT_ID }}
     steps:
+      - name: Harden the runner (Audit all outbound calls)
+        uses: step-security/harden-runner@v2
+        with:
+          egress-policy: audit
+
       - name: 📝 Echo needs
         run: |
           echo "Needs: ${{ toJson(needs) }}"

.github/workflows/release.yml

@@ -6,11 +6,22 @@ on:
 env:
   CI: true
 
+permissions:
+  contents: read
+
 jobs:
   release:
+    permissions:
+      contents: write  # for changesets/action to push to the repo
+      pull-requests: write  # for changesets/action to create PRs
     name: Release
     runs-on: ubuntu-latest
     steps:
+      - name: Harden the runner (Audit all outbound calls)
+        uses: step-security/harden-runner@v2
+        with:
+          egress-policy: audit
+
       - uses: pnpm/action-setup@v4
         with:
           version: 9