update allowed sockets

Ouranosinc · Jan 15, 2024 · ac85c67 · ac85c67
1 parent 784e015
commit ac85c67
Show file tree

Hide file tree

Showing 7 changed files with 34 additions and 5 deletions.
diff --git a/.github/workflows/add-to-project.yml b/.github/workflows/add-to-project.yml
@@ -19,7 +19,11 @@ jobs:
       - name: Harden Runner
         uses: step-security/harden-runner@eb238b55efaa70779f274895e782ed17c84f2895 # v2.6.1
         with:
-          egress-policy: audit
+          disable-sudo: true
+          egress-policy: block
+          allowed-endpoints: >
+            api.github.com:443
+
       - uses: actions/[email protected]
         with:
           project-url: https://github.com/orgs/Ouranosinc/projects/6

diff --git a/.github/workflows/bump-version.yml b/.github/workflows/bump-version.yml
@@ -36,7 +36,12 @@ jobs:
       - name: Harden Runner
         uses: step-security/harden-runner@eb238b55efaa70779f274895e782ed17c84f2895 # v2.6.1
         with:
-          egress-policy: audit
+          disable-sudo: true
+          egress-policy: block
+          allowed-endpoints: >
+            files.pythonhosted.org:443
+            github.com:443
+            pypi.org:443
       - uses: actions/[email protected]
         with:
           persist-credentials: false

diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
@@ -39,7 +39,15 @@ jobs:
       - name: Harden Runner
         uses: step-security/harden-runner@eb238b55efaa70779f274895e782ed17c84f2895 # v2.6.1
         with:
-          egress-policy: audit
+          disable-sudo: true
+          egress-policy: block
+          allowed-endpoints: >
+            api.github.com:443
+            files.pythonhosted.org:443
+            github.com:443
+            objects.githubusercontent.com:443
+            pypi.org:443
+            uploads.github.com:443
       - name: Checkout repository
         uses: actions/[email protected]
       # Initializes the CodeQL tools for scanning.

diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml
@@ -23,7 +23,9 @@ jobs:
           allowed-endpoints: >
             api.github.com:443
             github.com:443
+
       - name: 'Checkout Repository'
         uses: actions/[email protected]
+
       - name: 'Dependency Review'
         uses: actions/[email protected]
diff --git a/.github/workflows/first_pull_request.yml b/.github/workflows/first_pull_request.yml
@@ -19,7 +19,10 @@ jobs:
       - name: Harden Runner
         uses: step-security/harden-runner@eb238b55efaa70779f274895e782ed17c84f2895 # v2.6.1
         with:
-          egress-policy: audit
+          disable-sudo: true
+          egress-policy: block
+          allowed-endpoints: >
+            api.github.com:443
 
       - uses: actions/[email protected]
         with:

diff --git a/.github/workflows/label_on_approval.yml b/.github/workflows/label_on_approval.yml
@@ -28,7 +28,11 @@ jobs:
       - name: Harden Runner
         uses: step-security/harden-runner@eb238b55efaa70779f274895e782ed17c84f2895 # v2.6.1
         with:
-          egress-policy: audit
+          disable-sudo: true
+          egress-policy: block
+          allowed-endpoints: >
+            api.github.com:443
+
       - name: Label Approved
         uses: actions/[email protected]
         with:

diff --git a/.github/workflows/upstream.yml b/.github/workflows/upstream.yml
@@ -46,11 +46,14 @@ jobs:
           egress-policy: block
           allowed-endpoints: >
             api.github.com:443
+            conda.anaconda.org:443
+            dap.service.does.not.exist:443
             files.pythonhosted.org:443
             github.com:443
             objects.githubusercontent.com:443
             pypi.org:443
             raw.githubusercontent.com:443
+            repo.anaconda.com:443
       - uses: actions/[email protected]
         with:
           fetch-depth: 0 # Fetch all history for all branches and tags.