ci: add harden-runner to all GitHub Actions workflows

[dangrondahl]

Summary

• Add step-security/harden-runner v2.16.1 as the first step in every job across all 14 workflow files
• Pinned to SHA fe104658747b27e96e4f7e80cd0a94068e53901d
• Configured with egress-policy: audit to monitor outbound traffic without blocking
• Improves CI/CD supply chain security posture

[meekrosoft]

Is there a way to log these egress activities to Kosli?

[dangrondahl]

Is there a way to log these egress activities to Kosli?

Good question. You mean as part of an attestation?

[dangrondahl]

Is there a way to log these egress activities to Kosli?

Good question. You mean as part of an attestation?

@meekrosoft
harden-runner can block egress and only allow endpoints on the allow-list. So the current audit mode is set as learning the baseline.
It doesn't offer an output, like a SARIF report, so the only way is to attach the link to the dashboard, e.g. as part of a generic attestation.
I don't know what's possible through their API.

[dangrondahl]

Code review

No issues found. Checked for bugs and CLAUDE.md compliance.

🤖 Generated with Claude Code

_{- If this code review was useful, please react with 👍. Otherwise, react with 👎.}

[mbevc1]

🔒