[StepSecurity] ci: Harden GitHub Actions (#746)

Signed-off-by: StepSecurity Bot <[email protected]>

.github/workflows/clang.yml

@@ -18,9 +18,9 @@ jobs:
       with:
         egress-policy: audit
 
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
     - name: Run clang-format style check for C/C++ programs.
-      uses: jidicula/[email protected]
+      uses: jidicula/clang-format-action@c74383674bf5f7c69f60ce562019c1c94bc1421a # v4.13.0
       with:
         clang-format-version: '17'
         exclude-regex: 'mapistub/*'

.github/workflows/github-ci.yml

@@ -53,13 +53,13 @@ jobs:
       run: cmd /c "$env:VSDevTestCmd" /Parallel /EnableCodeCoverage /Logger:trx "${{github.workspace}}\\bin\\${{matrix.platform}}\\UnitTest\\${{matrix.configuration}}\\UnitTest.dll"
 
     # - name: Upload Event File
-    #   uses: actions/upload-artifact@v4
+    #   uses: actions/upload-artifact@834a144ee995460fba8ed112a2fc961b36a5ec5a # v4.3.6
     #   with:
     #     name: Event File (${{ matrix.platform }} - ${{ matrix.configuration }})
     #     path: ${{ github.event_path }}
 
     - name: Upload Test Result Files
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@834a144ee995460fba8ed112a2fc961b36a5ec5a # v4.3.6
       if: always()
       with:
         name: Test Results (${{ matrix.platform }} - ${{ matrix.configuration }})
@@ -81,12 +81,17 @@ jobs:
     if: always()
 
     steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@5c7944e73c4c2a096b17a9cb74d65b6c2bbafbde # v2.9.1
+        with:
+          egress-policy: audit
+
       - name: Download Artifacts
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
         with:
           path: artifacts
 
       - name: Publish Test Results
-        uses: EnricoMi/[email protected]
+        uses: EnricoMi/publish-unit-test-result-action@567cc7f8dcea3eba5da355f6ebc95663310d8a07 # v2.17.0
         with:
           files: "artifacts/**/*.trx"