security-hardening.yml

name: Security Hardening

on:
  push:
    branches-ignore:
      - 'dependabot/**'
    paths-ignore:
      - '**/*.md'
      - '**/*.cff'
  pull_request:
    branches:
      - '**'
    paths-ignore:
      - '**/*.md'
      - '**/*.cff'

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

permissions: read-all

jobs:
  security-hardening:
    name: Harden Security
    runs-on: ubuntu-latest

    steps:
      - name: Checkout the Repository
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2

      - name: Ensure SHA Pinned Actions
        uses: zgosalvez/github-actions-ensure-sha-pinned-actions@fc87bb5b5a97953d987372e74478de634726b3e5  # v3.0.25