[StepSecurity] Apply security best practices

[stepsecurity-app]

Summary

This pull request has been generated by StepSecurity as part of your enterprise subscription to ensure compliance with recommended security best practices. Please review and merge the pull request to apply these security enhancements.

Security Fixes

Harden Runner

Harden-Runner is an open-source security agent for the GitHub-hosted runner to prevent software supply chain attacks. It prevents exfiltration of credentials, detects tampering of source code during build, and enables running jobs without sudo access.

• GitHub Security Guide
• The Open Source Security Foundation (OpenSSF) Security Guide

Least Privileged GitHub Actions Token Permissions

The GITHUB_TOKEN is an automatically generated secret to make authenticated calls to the GitHub API. GitHub recommends setting minimum token permissions for the GITHUB_TOKEN.

• GitHub Security Guide
• The Open Source Security Foundation (OpenSSF) Security Guide

Pinned Dependencies

Pinning GitHub Actions to specific versions or commit SHAs ensures that your workflows remain consistent and secure.
Unpinned actions can lead to unexpected changes or vulnerabilities caused by upstream updates.

• GitHub Security Guide
• The Open Source Security Foundation (OpenSSF) Security Guide

StepSecurity Maintained Actions

Risky GitHub Actions can expose your project to potential security risks. Risky actions have been replaced with StepSecurity maintained actions, that are secure drop-in replacements.

• StepSecurity Maintained Actions

Feedback

For bug reports, feature requests, and general feedback; please create an issue in step-security/secure-repo or contact us via our website.

[Copilot]

Pull request overview

Applies GitHub Actions security hardening across CI and scheduled reporting workflows by introducing hardened runner auditing, least-privilege default token permissions, and pinning/replacing selected third-party actions.

Changes:

• Add permissions: contents: read at the workflow level to enforce least-privilege defaults.
• Add StepSecurity Harden Runner in CI and report workflows with egress-policy: audit.
• Pin actions/create-github-app-token to a commit SHA and replace peter-evans/create-issue-from-file / stefanzweifel/git-auto-commit-action with StepSecurity-maintained equivalents.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.

File	Description
.github/workflows/report-repos-with-no-team.yml	Adds hardened-runner, workflow-level token permissions, pins app-token action, and swaps issue upload action to StepSecurity-maintained version.
.github/workflows/report-repos-with-no-admin-team.yml	Same security hardening/pinning and StepSecurity action replacement for this report workflow.
.github/workflows/report-repos-with-multi-admin-teams.yml	Same security hardening/pinning and StepSecurity action replacement for this report workflow.
.github/workflows/ci.yml	Adds workflow-level token permissions, hardened-runner, and swaps auto-commit action to StepSecurity-maintained version.

[Copilot]

Pull request overview

Applies GitHub Actions security hardening recommended by StepSecurity across the repository’s CI and scheduled governance report workflows to reduce token exposure and improve supply-chain defenses.

Changes:

• Adds workflow-level least-privilege GITHUB_TOKEN permissions (contents: read) to the affected workflows.
• Adds StepSecurity’s harden-runner step (egress audit mode) to CI and scheduled report workflows.
• Pins actions/create-github-app-token to a specific commit SHA and replaces select third-party actions with StepSecurity-maintained equivalents.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated no comments.

File	Description
.github/workflows/report-repos-with-no-team.yml	Adds minimal workflow permissions, hardens runner, pins token action, switches issue uploader action to StepSecurity-maintained variant.
.github/workflows/report-repos-with-no-admin-team.yml	Same security hardening pattern as other report workflows (permissions + harden-runner + pinned action + StepSecurity replacement).
.github/workflows/report-repos-with-multi-admin-teams.yml	Same security hardening pattern as other report workflows (permissions + harden-runner + pinned action + StepSecurity replacement).
.github/workflows/ci.yml	Adds workflow permissions, hardens runner in both jobs, pins GitHub App token action, and switches auto-commit action to StepSecurity-maintained variant.