security-hardening.yml

name: Security Hardening

on:
  push:
    branches-ignore:
      - 'dependabot/**'
    paths-ignore:
      - '**/*.md'
      - '**/*.cff'
  pull_request:
    branches:
      - '**'
    paths-ignore:
      - '**/*.md'
      - '**/*.cff'

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

permissions: read-all

jobs:
  security-hardening:
    name: Harden Security
    runs-on: ubuntu-latest

    steps:
      - name: Checkout the Repository
        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332  # v4.1.7

      - name: Ensure SHA Pinned Actions
        uses: zgosalvez/github-actions-ensure-sha-pinned-actions@74606c30450304eee8660aae751818321754feb1  # v3.0.9