Merge pull request #21 from cpanato/clean

apply ci best practices

Author: imjasonh

.github/workflows/build.yml

@@ -1,7 +1,7 @@
 name: Check npm build
 
 on:
-  workflow_dispatch:
+
   pull_request:
     branches:
       - main
@@ -11,17 +11,29 @@ on:
       - "package.json"
       - "package-lock.json"
 
+permissions: {}
+
 jobs:
   build:
     runs-on: ubuntu-latest
+
     permissions:
       contents: read  # Only need read access for checking
+
     steps:
+      - name: Harden the runner (Audit all outbound calls)
+        uses: step-security/harden-runner@002fdce3c6a235733a90a27c80493a3241e56863 # v2.12.1
+        with:
+          egress-policy: audit
+
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: true
 
       - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version: "20"
+          check-latest: true
 
       - name: Install dependencies
         run: npm ci

.github/workflows/example.yml

@@ -2,16 +2,24 @@ name: Malcontent Analysis
 
 on:
   pull_request:
-    types: [opened, synchronize, reopened]
+    branches:
+      - main
 
-permissions:
-  contents: read
-  pull-requests: write
+permissions: {}
 
 jobs:
   malcontent:
     runs-on: ubuntu-latest
+
+    permissions:
+      contents: read
+
     steps:
+      - name: Harden the runner (Audit all outbound calls)
+        uses: step-security/harden-runner@002fdce3c6a235733a90a27c80493a3241e56863 # v2.12.1
+        with:
+          egress-policy: audit
+
       - name: Checkout repository
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:

.github/workflows/format-check.yml

@@ -1,8 +1,5 @@
 name: Format Check
 
-permissions:
-  contents: read
-
 on:
   pull_request:
     branches:
@@ -13,18 +10,32 @@ on:
       - "package-lock.json"
       - ".prettierrc.json"
 
+permissions: {}
+
 jobs:
   format:
     runs-on: ubuntu-latest
+
+    permissions:
+      contents: read
+
     steps:
+      - name: Harden the runner (Audit all outbound calls)
+        uses: step-security/harden-runner@002fdce3c6a235733a90a27c80493a3241e56863 # v2.12.1
+        with:
+          egress-policy: audit
+
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: true
 
       - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version: "20"
+          check-latest: true
 
       - name: Install dependencies
         run: npm ci
 
       - name: Check formatting
-        run: npm run format:check
+        run: npm run format:check

.github/workflows/push-example.yml

@@ -2,17 +2,23 @@ name: Malcontent Analysis on Push
 
 on:
   push:
-    branches: [main, develop]
+    branches:
+      - main
 
-permissions:
-  contents: read
+permissions: {}
 
 jobs:
   malcontent:
     runs-on: ubuntu-latest
+
+    permissions:
+      contents: read
+
     steps:
-      - name: Checkout repository
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - name: Harden the runner (Audit all outbound calls)
+        uses: step-security/harden-runner@002fdce3c6a235733a90a27c80493a3241e56863 # v2.12.1
+        with:
+          egress-policy: audit
 
       - name: Checkout code
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2