ci: address review findings for Harden-Runner egress policy

- Add allowed-endpoints to ast-grep.yml matching test-ast-grep.yml
- Add pypi.org and files.pythonhosted.org to sonarcloud.yml for Python coverage
- Add packages.microsoft.com:443 and https mirrors to apt allowed-endpoints
- Set unvalidated reusable workflows (release, docker-build, gate, etc.) to audit mode

.github/workflows/ast-grep.yml

@@ -39,6 +39,11 @@ jobs:
         uses: step-security/harden-runner@1d88384fd173af6ecb012dfd0264a306b711241a # v2.22.4
         with:
           egress-policy: block
+          allowed-endpoints: >
+            api.github.com:443
+            github.com:443
+            objects.githubusercontent.com:443
+            release-assets.githubusercontent.com:443
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false

.github/workflows/changed-paths.yml

@@ -48,7 +48,7 @@ jobs:
       - name: Harden runner
         uses: step-security/harden-runner@1d88384fd173af6ecb012dfd0264a306b711241a # v2.22.4
         with:
-          egress-policy: block
+          egress-policy: audit
       # Two commits deep for the merge commit's first parent; trees only, no file contents.
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:

.github/workflows/docker-build.yml

@@ -110,7 +110,7 @@ jobs:
       - name: Harden runner
         uses: step-security/harden-runner@1d88384fd173af6ecb012dfd0264a306b711241a # v2.22.4
         with:
-          egress-policy: block
+          egress-policy: audit
       - name: Check out
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
@@ -253,7 +253,7 @@ jobs:
       - name: Harden runner
         uses: step-security/harden-runner@1d88384fd173af6ecb012dfd0264a306b711241a # v2.22.4
         with:
-          egress-policy: block
+          egress-policy: audit
       - name: Download digests
         uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:

.github/workflows/flatpak-oci.yml

@@ -37,7 +37,7 @@ jobs:
       - name: Harden runner
         uses: step-security/harden-runner@1d88384fd173af6ecb012dfd0264a306b711241a # v2.22.4
         with:
-          egress-policy: block
+          egress-policy: audit
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2

.github/workflows/freebsd.yml

@@ -74,7 +74,7 @@ jobs:
       - name: Harden runner
         uses: step-security/harden-runner@1d88384fd173af6ecb012dfd0264a306b711241a # v2.22.4
         with:
-          egress-policy: block
+          egress-policy: audit
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Check out craft-fonts
         if: inputs.craft-fonts-ref != ''

.github/workflows/gate.yml

@@ -121,7 +121,7 @@ jobs:
       - name: Harden runner
         uses: step-security/harden-runner@1d88384fd173af6ecb012dfd0264a306b711241a # v2.22.4
         with:
-          egress-policy: block
+          egress-policy: audit
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false

.github/workflows/git-sources.yml

@@ -30,7 +30,7 @@ jobs:
       - name: Harden runner
         uses: step-security/harden-runner@1d88384fd173af6ecb012dfd0264a306b711241a # v2.22.4
         with:
-          egress-policy: block
+          egress-policy: audit
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false

.github/workflows/nix.yml

@@ -21,7 +21,7 @@ jobs:
       - name: Harden runner
         uses: step-security/harden-runner@1d88384fd173af6ecb012dfd0264a306b711241a # v2.22.4
         with:
-          egress-policy: block
+          egress-policy: audit
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: DeterminateSystems/nix-installer-action@3138316df39ed29be04236d7ffc686fa525866aa # v23
       - name: Check flake evaluation

.github/workflows/packaging-lint.yml

@@ -27,10 +27,13 @@ jobs:
             api.github.com:443
             archive.ubuntu.com:80
             azure.archive.ubuntu.com:80
+            azure.archive.ubuntu.com:443
+            packages.microsoft.com:443
             github.com:443
             objects.githubusercontent.com:443
             release-assets.githubusercontent.com:443
             security.ubuntu.com:80
+            security.ubuntu.com:443
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Run packaging lint
         uses: storytold/craft-common-actions/actions/packaging-lint@main

.github/workflows/refresh-contributors.yml

@@ -21,7 +21,7 @@ jobs:
       - name: Harden runner
         uses: step-security/harden-runner@1d88384fd173af6ecb012dfd0264a306b711241a # v2.22.4
         with:
-          egress-policy: block
+          egress-policy: audit
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0

.github/workflows/release.yml

@@ -151,7 +151,7 @@ jobs:
       - name: Harden runner
         uses: step-security/harden-runner@1d88384fd173af6ecb012dfd0264a306b711241a # v2.22.4
         with:
-          egress-policy: block
+          egress-policy: audit
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Git dependencies come from storytold
         run: |
@@ -198,7 +198,7 @@ jobs:
       - name: Harden runner
         uses: step-security/harden-runner@1d88384fd173af6ecb012dfd0264a306b711241a # v2.22.4
         with:
-          egress-policy: block
+          egress-policy: audit
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - id: v
         name: Resolve version
@@ -225,7 +225,7 @@ jobs:
       - name: Harden runner
         uses: step-security/harden-runner@1d88384fd173af6ecb012dfd0264a306b711241a # v2.22.4
         with:
-          egress-policy: block
+          egress-policy: audit
       # A signed job reads only the secrets the caller lists in its `secrets:` block; values come
       # from the repo's `release` environment. An unlisted name is empty, and the app's packaging
       # would then warn and ship unsigned, so on the release branch fail here instead.
@@ -349,7 +349,7 @@ jobs:
       - name: Harden runner
         uses: step-security/harden-runner@1d88384fd173af6ecb012dfd0264a306b711241a # v2.22.4
         with:
-          egress-policy: block
+          egress-policy: audit
       # See the macOS job: unlisted secrets are empty, and the build would ship unsigned.
       # Signing needs either the PFX pair or all six Azure Trusted Signing values.
       - name: Require signing secrets on the release branch
@@ -458,7 +458,7 @@ jobs:
       - name: Harden runner
         uses: step-security/harden-runner@1d88384fd173af6ecb012dfd0264a306b711241a # v2.22.4
         with:
-          egress-policy: block
+          egress-policy: audit
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Load refreshed contributor credits
         if: inputs.contributors-artifact != ''
@@ -555,7 +555,7 @@ jobs:
       - name: Harden runner
         uses: step-security/harden-runner@1d88384fd173af6ecb012dfd0264a306b711241a # v2.22.4
         with:
-          egress-policy: block
+          egress-policy: audit
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Export the app's build variables
         id: app-env
@@ -676,7 +676,7 @@ jobs:
       - name: Harden runner
         uses: step-security/harden-runner@1d88384fd173af6ecb012dfd0264a306b711241a # v2.22.4
         with:
-          egress-policy: block
+          egress-policy: audit
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
@@ -739,7 +739,7 @@ jobs:
       - name: Harden runner
         uses: step-security/harden-runner@1d88384fd173af6ecb012dfd0264a306b711241a # v2.22.4
         with:
-          egress-policy: block
+          egress-policy: audit
       - name: Check the FreeBSD architecture
         env:
           ARCH: ${{ matrix.arch }}
@@ -972,7 +972,7 @@ jobs:
       - name: Harden runner
         uses: step-security/harden-runner@1d88384fd173af6ecb012dfd0264a306b711241a # v2.22.4
         with:
-          egress-policy: block
+          egress-policy: audit
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Load refreshed contributor credits
         if: inputs.contributors-artifact != ''
@@ -1048,7 +1048,7 @@ jobs:
       - name: Harden runner
         uses: step-security/harden-runner@1d88384fd173af6ecb012dfd0264a306b711241a # v2.22.4
         with:
-          egress-policy: block
+          egress-policy: audit
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Load refreshed contributor credits
         if: inputs.contributors-artifact != ''
@@ -1146,7 +1146,7 @@ jobs:
       - name: Harden runner
         uses: step-security/harden-runner@1d88384fd173af6ecb012dfd0264a306b711241a # v2.22.4
         with:
-          egress-policy: block
+          egress-policy: audit
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Load refreshed contributor credits
         if: inputs.contributors-artifact != ''
@@ -1201,7 +1201,7 @@ jobs:
       - name: Harden runner
         uses: step-security/harden-runner@1d88384fd173af6ecb012dfd0264a306b711241a # v2.22.4
         with:
-          egress-policy: block
+          egress-policy: audit
       - uses: storytold/craft-common-actions/actions/draft-release@main
         with:
           version: ${{ needs.version.outputs.version }}

.github/workflows/sonarcloud.yml

@@ -74,14 +74,19 @@ jobs:
             api.github.com:443
             archive.ubuntu.com:80
             azure.archive.ubuntu.com:80
+            azure.archive.ubuntu.com:443
+            packages.microsoft.com:443
             binaries.sonarsource.com:443
             crates.io:443
+            files.pythonhosted.org:443
             github.com:443
             index.crates.io:443
             objects.githubusercontent.com:443
+            pypi.org:443
             release-assets.githubusercontent.com:443
             scanner.sonarcloud.io:443
             security.ubuntu.com:80
+            security.ubuntu.com:443
             sonarcloud.io:443
             static.crates.io:443
             static.rust-lang.org:443
@@ -124,14 +129,19 @@ jobs:
             api.github.com:443
             archive.ubuntu.com:80
             azure.archive.ubuntu.com:80
+            azure.archive.ubuntu.com:443
+            packages.microsoft.com:443
             binaries.sonarsource.com:443
             crates.io:443
+            files.pythonhosted.org:443
             github.com:443
             index.crates.io:443
             objects.githubusercontent.com:443
+            pypi.org:443
             release-assets.githubusercontent.com:443
             scanner.sonarcloud.io:443
             security.ubuntu.com:80
+            security.ubuntu.com:443
             sonarcloud.io:443
             static.crates.io:443
             static.rust-lang.org:443
@@ -214,14 +224,19 @@ jobs:
             api.github.com:443
             archive.ubuntu.com:80
             azure.archive.ubuntu.com:80
+            azure.archive.ubuntu.com:443
+            packages.microsoft.com:443
             binaries.sonarsource.com:443
             crates.io:443
+            files.pythonhosted.org:443
             github.com:443
             index.crates.io:443
             objects.githubusercontent.com:443
+            pypi.org:443
             release-assets.githubusercontent.com:443
             scanner.sonarcloud.io:443
             security.ubuntu.com:80
+            security.ubuntu.com:443
             sonarcloud.io:443
             static.crates.io:443
             static.rust-lang.org:443
@@ -304,14 +319,19 @@ jobs:
             api.github.com:443
             archive.ubuntu.com:80
             azure.archive.ubuntu.com:80
+            azure.archive.ubuntu.com:443
+            packages.microsoft.com:443
             binaries.sonarsource.com:443
             crates.io:443
+            files.pythonhosted.org:443
             github.com:443
             index.crates.io:443
             objects.githubusercontent.com:443
+            pypi.org:443
             release-assets.githubusercontent.com:443
             scanner.sonarcloud.io:443
             security.ubuntu.com:80
+            security.ubuntu.com:443
             sonarcloud.io:443
             static.crates.io:443
             static.rust-lang.org:443

.github/workflows/supply-chain.yml

@@ -25,7 +25,7 @@ jobs:
       - name: Harden runner
         uses: step-security/harden-runner@1d88384fd173af6ecb012dfd0264a306b711241a # v2.22.4
         with:
-          egress-policy: block
+          egress-policy: audit
       - name: Download release artifacts
         uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:

.github/workflows/test-freebsd.yml

@@ -32,6 +32,8 @@ jobs:
             github.com:443
             archive.ubuntu.com:80
             azure.archive.ubuntu.com:80
+            azure.archive.ubuntu.com:443
+            packages.microsoft.com:443
             security.ubuntu.com:80
             archive.ubuntu.com:443
             azure.archive.ubuntu.com:443

.github/workflows/test-house-rules.yml

@@ -28,6 +28,9 @@ jobs:
         uses: step-security/harden-runner@1d88384fd173af6ecb012dfd0264a306b711241a # v2.22.4
         with:
           egress-policy: block
+          allowed-endpoints: >
+            api.github.com:443
+            github.com:443
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false

.github/workflows/test-install-apt-packages.yml

@@ -29,6 +29,8 @@ jobs:
             github.com:443
             archive.ubuntu.com:80
             azure.archive.ubuntu.com:80
+            azure.archive.ubuntu.com:443
+            packages.microsoft.com:443
             security.ubuntu.com:80
             archive.ubuntu.com:443
             azure.archive.ubuntu.com:443

.github/workflows/windows-arm64.yml

@@ -58,7 +58,7 @@ jobs:
       - name: Harden runner
         uses: step-security/harden-runner@1d88384fd173af6ecb012dfd0264a306b711241a # v2.22.4
         with:
-          egress-policy: block
+          egress-policy: audit
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Check out craft-i18n
         uses: storytold/craft-common-actions/actions/checkout-craft-i18n@main
@@ -98,7 +98,7 @@ jobs:
       - name: Harden runner
         uses: step-security/harden-runner@1d88384fd173af6ecb012dfd0264a306b711241a # v2.22.4
         with:
-          egress-policy: block
+          egress-policy: audit
       - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: ${{ inputs.app-name }}-windows-arm64