ci: eliminate, then harden, every secret-bearing job RE001 reports

.github/workflows/actions.lock

@@ -17,6 +17,7 @@ workflows:
         - 'taiki-e/install-action@v2.87.29'
     '.github/workflows/ci-health-sweep.yml':
         - 'actions/checkout@v7.0.1'
+        - 'step-security/harden-runner@v2.22.2'
     '.github/workflows/ci.yml':
         - 'actions/cache@v6.1.0'
         - 'actions/checkout@v7.0.1'
@@ -50,10 +51,12 @@ workflows:
         - 'metadatastician/standards@333b06a01db1874ffedb2de1bfabb195640927c7'
     '.github/workflows/hypatia-remediation-sweep.yml':
         - 'actions/upload-artifact@v7.0.2'
+        - 'step-security/harden-runner@v2.22.2'
     '.github/workflows/hypatia-scan.yml':
         - 'metadatastician/standards@333b06a01db1874ffedb2de1bfabb195640927c7'
     '.github/workflows/inbox-steward-intake.yml':
         - 'actions/checkout@v7.0.1'
+        - 'step-security/harden-runner@v2.22.2'
     '.github/workflows/label-triage.yml': []
     '.github/workflows/labels.yml': []
     '.github/workflows/language-blockers.yml':
@@ -71,6 +74,7 @@ workflows:
         - 'actions/upload-pages-artifact@v5.0.0'
     '.github/workflows/push-email-notify.yml':
         - 'hyperpolymath/smtp-notify-action@v0.5.0'
+        - 'step-security/harden-runner@v2.22.2'
     '.github/workflows/quality.yml':
         - 'actions/checkout@v7.0.1'
         - 'actions/deploy-pages@v5.0.1'
@@ -94,6 +98,7 @@ workflows:
         - 'swatinem/rust-cache@v2.9.3'
     '.github/workflows/roadmap-sync.yml':
         - 'actions/create-github-app-token@v3.3.0'
+        - 'step-security/harden-runner@v2.22.2'
     '.github/workflows/rsr-oracle.yml':
         - 'actions/checkout@v7.0.1'
         - 'erlef/setup-beam@v1.24.1'

.github/workflows/ci-health-sweep.yml

@@ -45,6 +45,15 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 30
     steps:
+      - name: Harden the runner
+        uses: step-security/harden-runner@v2.22.2
+        with:
+          egress-policy: block
+          # The checkout, and gh against the GitHub API (scripts/ci-health/).
+          allowed-endpoints: >
+            github.com:443
+            api.github.com:443
+
       - uses: actions/checkout@v7.0.1
       - name: Run CI-health sweep
         env:

.github/workflows/hypatia-remediation-sweep.yml

@@ -62,6 +62,17 @@ jobs:
     timeout-minutes: 30
 
     steps:
+      - name: Harden the runner
+        uses: step-security/harden-runner@v2.22.2
+        with:
+          egress-policy: block
+          # gh against the GitHub API, plus the artifact service and its blob
+          # storage for the target-list upload.
+          allowed-endpoints: >
+            api.github.com:443
+            results-receiver.actions.githubusercontent.com:443
+            *.blob.core.windows.net:443
+
       - name: Resolve inputs
         id: cfg
         run: |

.github/workflows/inbox-steward-intake.yml

@@ -52,6 +52,15 @@ jobs:
       merged_count: ${{ steps.record.outputs.merged_count }}
 
     steps:
+      - name: Harden the runner
+        uses: step-security/harden-runner@v2.22.2
+        with:
+          egress-policy: block
+          # git and gh against GitHub only.
+          allowed-endpoints: >
+            github.com:443
+            api.github.com:443
+
       - name: Checkout hypatia
         uses: actions/checkout@v7.0.1
         with:
@@ -126,11 +135,22 @@ jobs:
       rule_updates: ${{ steps.analyze.outputs.rule_updates }}
 
     steps:
+      - name: Harden the runner
+        uses: step-security/harden-runner@v2.22.2
+        with:
+          egress-policy: block
+          # git and gh against GitHub only.
+          allowed-endpoints: >
+            github.com:443
+            api.github.com:443
+
+      # Read-only: nothing is pushed from this job, so the checkout needs no
+      # PAT and keeps none in .git/config.
       - name: Checkout hypatia
         uses: actions/checkout@v7.0.1
         with:
           fetch-depth: 0
-          token: ${{ secrets.FARM_PAT }}
+          persist-credentials: false
 
       - name: Analyze merged PR patterns
         id: analyze
@@ -226,6 +246,15 @@ jobs:
     if: needs.analyze-patterns.result == 'success' && inputs.dry_run != 'true'
 
     steps:
+      - name: Harden the runner
+        uses: step-security/harden-runner@v2.22.2
+        with:
+          egress-policy: block
+          # git and gh against GitHub only.
+          allowed-endpoints: >
+            github.com:443
+            api.github.com:443
+
       - name: Checkout hypatia
         uses: actions/checkout@v7.0.1
         with:
@@ -279,8 +308,13 @@ jobs:
     if: always() && needs.record-report.result == 'success'
 
     steps:
-      - name: Checkout hypatia
-        uses: actions/checkout@v7.0.1
+      - name: Harden the runner
+        uses: step-security/harden-runner@v2.22.2
+        with:
+          egress-policy: block
+          # One gh api call: the dispatch to .git-private-farm.
+          allowed-endpoints: >
+            api.github.com:443
 
       - name: Send dispatch to .git-private-farm
         env:

.github/workflows/push-email-notify.yml

@@ -40,6 +40,19 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 5
     steps:
+      - name: Harden the runner
+        uses: step-security/harden-runner@v2.22.2
+        with:
+          egress-policy: block
+          # The action downloads its pinned binary from its GitHub release, then
+          # speaks SMTP to the org mail host. The host is itself a secret, so it
+          # is allowed from the secret, and stays masked in the log.
+          allowed-endpoints: >
+            github.com:443
+            release-assets.githubusercontent.com:443
+            objects.githubusercontent.com:443
+            ${{ secrets.SMTP_HOST }}:${{ secrets.SMTP_PORT || '465' }}
+
       - name: Send push notification email
         uses: hyperpolymath/smtp-notify-action@v0.5.0
         with:

.github/workflows/roadmap-sync.yml

@@ -46,6 +46,14 @@ jobs:
       EXCLUDE: 'idaptik burble rattlescript vcl-ut'
       WINDOW_MIN: ${{ inputs.window_min || '45' }}   # look-back window (> cron interval for overlap)
     steps:
+      - name: Harden the runner
+        uses: step-security/harden-runner@v2.22.2
+        with:
+          egress-policy: block
+          # The App token mint and every gh call go to the GitHub API.
+          allowed-endpoints: >
+            api.github.com:443
+
       - name: Mint App installation token
         id: app
         uses: actions/create-github-app-token@v3.3.0

.github/workflows/security-policy.yml

@@ -302,7 +302,10 @@ jobs:
         uses: gitleaks/gitleaks-action@v3.0.0
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          GITLEAKS_LICENSE: ${{ secrets.GITLEAKS_LICENSE }}
+          # No GITLEAKS_LICENSE: gitleaks-action requires one only for an
+          # organization owner, and logs "[hyperpolymath] is an individual
+          # user. No license key is required." The secret was never set (the
+          # step's env showed it empty). Restore it if the repo moves to an org.
 
   secret-trufflehog:
     name: Secret Detection (TruffleHog)