ci: adopt harden-runner in standards-only workflows (#941)

.github/workflows/actions.lock

@@ -14,6 +14,7 @@ workflows:
         - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1'
         - 'actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1'
         - 'actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a'
+        - 'step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1'
     '.github/workflows/boj-build.yml':
         - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1'
     '.github/workflows/canon-spine-lockstep.yml':
@@ -84,6 +85,7 @@ workflows:
     '.github/workflows/lockfile-drift-detect.yml':
         - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1'
         - 'actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a'
+        - 'step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1'
     '.github/workflows/makefile-blocker.yml':
         - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1'
     '.github/workflows/mirror-reusable.yml':
@@ -106,6 +108,7 @@ workflows:
         - 'actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9'
     '.github/workflows/propagate-hooks.yml':
         - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1'
+        - 'step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1'
     '.github/workflows/readme-derive-reusable.yml':
         - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1'
     '.github/workflows/readme-derive.yml': []
@@ -136,16 +139,19 @@ workflows:
     '.github/workflows/settings-drift-detect.yml':
         - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1'
         - 'actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a'
+        - 'step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1'
     '.github/workflows/signed-push-smoke.yml':
         - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1'
         - 'actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1'
         - 'asana/push-signed-commits@d615ca88d8e1a946734c24970d1e7a6c56f34897'
+        - 'step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1'
     '.github/workflows/spark-theatre-gate.yml':
         - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1'
     '.github/workflows/tag-ruleset-canon.yml':
         - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1'
         - 'actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1'
         - 'actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a'
+        - 'step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1'
     '.github/workflows/tailscale-connect-reusable.yml':
         - 'tailscale/github-action@d1b6cd204f8dceda5b3eaad7f1f767be390056cd'
 dependencies:
@@ -258,6 +264,11 @@ dependencies:
         commit: 'sha1-28959ce8df70de7be546dd1250a005dd32156697'
         owner_id: 18365890
         repo_id: 220359305
+    'step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1':
+        ref: 'v2.21.1'
+        commit: 'sha1-e14015d583714f6e62063499dc959a02595150a1'
+        owner_id: 88700172
+        repo_id: 422287306
     'swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6':
         ref: '6323deb102c322ba6fcbdcafc7e3dddab59af2b6'
         commit: 'sha1-6323deb102c322ba6fcbdcafc7e3dddab59af2b6'

.github/workflows/apply-workflow-pins.yml

@@ -55,6 +55,10 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 60
     steps:
+      - name: Harden runner (egress audit)
+        uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
+        with:
+          egress-policy: audit
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       # WHICH App's credentials belong in vars.APP_ID / secrets.APP_PRIVATE_KEY:

.github/workflows/lockfile-drift-detect.yml

@@ -49,6 +49,10 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 45
     steps:
+      - name: Harden runner (egress audit)
+        uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
+        with:
+          egress-policy: audit
       - name: Checkout standards (for the checker script)
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
 

.github/workflows/propagate-hooks.yml

@@ -50,6 +50,17 @@ jobs:
       dry_run: ${{ steps.config.outputs.dry_run }}
 
     steps:
+      - name: Harden runner (egress block)
+        uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
+        with:
+          # Runs on a protected-branch push (RE002): block, not audit. This
+          # job only talks to GitHub (checkout, the REST API, git transport).
+          egress-policy: block
+          allowed-endpoints: >
+            github.com:443
+            api.github.com:443
+            codeload.github.com:443
+            objects.githubusercontent.com:443
       - name: Checkout standards repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
@@ -177,6 +188,17 @@ jobs:
       fail-fast: false  # Don't stop on individual failures
 
     steps:
+      - name: Harden runner (egress block)
+        uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
+        with:
+          # Runs on a protected-branch push (RE002): block, not audit. This
+          # job only talks to GitHub (checkout, the REST API, git transport).
+          egress-policy: block
+          allowed-endpoints: >
+            github.com:443
+            api.github.com:443
+            codeload.github.com:443
+            objects.githubusercontent.com:443
       - name: Checkout standards repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 

.github/workflows/settings-drift-detect.yml

@@ -58,6 +58,10 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 45
     steps:
+      - name: Harden runner (egress audit)
+        uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
+        with:
+          egress-policy: audit
       - name: Checkout
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 

.github/workflows/signed-push-smoke.yml

@@ -27,6 +27,10 @@ jobs:
     permissions:
       contents: write
     steps:
+      - name: Harden runner (egress audit)
+        uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
+        with:
+          egress-policy: audit
       - name: Checkout
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:

.github/workflows/tag-ruleset-canon.yml

@@ -43,6 +43,10 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
+      - name: Harden runner (egress audit)
+        uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
+        with:
+          egress-policy: audit
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       # WHICH App's credentials belong in vars.APP_ID / secrets.APP_PRIVATE_KEY:

.hypatia-baseline.json

@@ -1013,15 +1013,6 @@
   "expires_at": "2026-12-22",
   "tracking_issue": "hyperpolymath/standards#944"
  },
- {
-  "severity": "warn",
-  "rule_module": "research_extensions",
-  "type": "RE001",
-  "file": ".github/workflows/signed-push-smoke.yml",
-  "note": "ESTATE DECISION PENDING (hypatia triage 2026-09-22): adopt step-security/harden-runner or record a principled WONTFIX; the estate uses it nowhere today.",
-  "expires_at": "2026-12-22",
-  "tracking_issue": "hyperpolymath/standards#941"
- },
  {
   "severity": "warn",
   "rule_module": "research_extensions",
@@ -1031,15 +1022,6 @@
   "expires_at": "2026-12-22",
   "tracking_issue": "hyperpolymath/standards#941"
  },
- {
-  "severity": "warn",
-  "rule_module": "research_extensions",
-  "type": "RE001",
-  "file": ".github/workflows/settings-drift-detect.yml",
-  "note": "ESTATE DECISION PENDING (hypatia triage 2026-09-22): adopt step-security/harden-runner or record a principled WONTFIX; the estate uses it nowhere today.",
-  "expires_at": "2026-12-22",
-  "tracking_issue": "hyperpolymath/standards#941"
- },
  {
   "severity": "warn",
   "rule_module": "research_extensions",
@@ -1094,24 +1076,6 @@
   "expires_at": "2026-12-22",
   "tracking_issue": "hyperpolymath/standards#941"
  },
- {
-  "severity": "warn",
-  "rule_module": "research_extensions",
-  "type": "RE001",
-  "file": ".github/workflows/apply-workflow-pins.yml",
-  "note": "ESTATE DECISION PENDING (hypatia triage 2026-09-22): adopt step-security/harden-runner or record a principled WONTFIX; the estate uses it nowhere today.",
-  "expires_at": "2026-12-22",
-  "tracking_issue": "hyperpolymath/standards#941"
- },
- {
-  "severity": "warn",
-  "rule_module": "research_extensions",
-  "type": "RE001",
-  "file": ".github/workflows/propagate-hooks.yml",
-  "note": "ESTATE DECISION PENDING (hypatia triage 2026-09-22): adopt step-security/harden-runner or record a principled WONTFIX; the estate uses it nowhere today.",
-  "expires_at": "2026-12-22",
-  "tracking_issue": "hyperpolymath/standards#941"
- },
  {
   "severity": "warn",
   "rule_module": "research_extensions",
@@ -1121,24 +1085,6 @@
   "expires_at": "2026-12-22",
   "tracking_issue": "hyperpolymath/standards#941"
  },
- {
-  "severity": "warn",
-  "rule_module": "research_extensions",
-  "type": "RE001",
-  "file": ".github/workflows/tag-ruleset-canon.yml",
-  "note": "ESTATE DECISION PENDING (hypatia triage 2026-09-22): adopt step-security/harden-runner or record a principled WONTFIX; the estate uses it nowhere today.",
-  "expires_at": "2026-12-22",
-  "tracking_issue": "hyperpolymath/standards#941"
- },
- {
-  "severity": "warn",
-  "rule_module": "research_extensions",
-  "type": "RE001",
-  "file": ".github/workflows/lockfile-drift-detect.yml",
-  "note": "ESTATE DECISION PENDING (hypatia triage 2026-09-22): adopt step-security/harden-runner or record a principled WONTFIX; the estate uses it nowhere today.",
-  "expires_at": "2026-12-22",
-  "tracking_issue": "hyperpolymath/standards#941"
- },
  {
   "severity": "warn",
   "rule_module": "research_extensions",

.machine_readable/REGISTRY.a2ml

@@ -207,7 +207,7 @@ name = "RSR — Rhodium Standard Repositories"
 stream = "governance"
 home = "rhodium-standard-repositories/"
 canonical_doc = "rhodium-standard-repositories/README.adoc"
-source_hash = "sha256:51b38eb327df7ea430078bd75566d15ab9a6618f19a3b9ee7c2a1cfb8ce6adda"
+source_hash = "sha256:3c7ccbf889b32ffac7566dcdf93ea9923d1b53f1c6055889f4a330a52c421d85"
 route = "the repository-compliance standard every repo is graded against"
 
 [[spec]]

config/settings/actions-allowlist.json

@@ -115,6 +115,7 @@
     "softprops/action-gh-release@*",
     "SonarSource/sonarcloud-github-action@*",
     "SonarSource/sonarqube-scan-action@*",
+    "step-security/harden-runner@*",
     "superfly/flyctl-actions/setup-flyctl@*",
     "Swatinem/rust-cache@*",
     "swatinem/rust-cache@*",

rhodium-standard-repositories/actions-allowlist/allowed-actions.json

@@ -86,6 +86,7 @@
     "softprops/action-gh-release@*",
     "SonarSource/sonarcloud-github-action@*",
     "SonarSource/sonarqube-scan-action@*",
+    "step-security/harden-runner@*",
     "Swatinem/rust-cache@*",
     "taiki-e/install-action@*",
     "trufflesecurity/trufflehog@*",