🌱 .github: Audit CodeQL egress with harden-runner

[naveensrinivasan]

What kind of change does this PR introduce?

Included hard-runner to restrict egress traffic.

• PR title follows the guidelines defined in our pull request documentation

What is the current behavior?

What is the new behavior (if this is a feature change)?**

• Tests for the changes have been added (for bug fixes/features)

Which issue(s) this PR fixes

NONE

Special notes for your reviewer

Does this PR introduce a user-facing change?

For user-facing changes, please add a concise, human-readable release note to
the release-note

NONE

[naveensrinivasan]

@ossf/scorecard-maintainers I would like to propose this change. Let me know if someone has a different opinion.

cc @varunsh-coder

[codecov]

Codecov Report

Merging #1728 (9adb214) into main (c8af71c) will not change coverage.
The diff coverage is n/a.

@@           Coverage Diff           @@
##             main    #1728   +/-   ##
=======================================
  Coverage   57.02%   57.02%           
=======================================
  Files          63       63           
  Lines        6192     6192           
=======================================
  Hits         3531     3531           
  Misses       2420     2420           
  Partials      241      241           

[naveensrinivasan]

The license for hard-runner is https://github.com/step-security/harden-runner/blob/main/LICENSE

[github-actions]

Integration tests success for
[544e66f]
(https://github.com/ossf/scorecard/actions/runs/1976797558)

[github-actions]

Integration tests success for
[a40b6e9]
(https://github.com/ossf/scorecard/actions/runs/1983360145)

[varunsh-coder]

The license for hard-runner is https://github.com/step-security/harden-runner/blob/main/LICENSE

Thanks @naveensrinivasan for trying it out. Let me know if you need any help adding it. Note: the Action uses an agent, and the agent also has the same license.

https://github.com/step-security/agent/blob/main/LICENSE

I am trying to make harden-runner an OSSF project. So do share feedback from using this, as those improvement ideas can be used in the OSSF project, if/when that gets thru...Thanks!

[azeemshaikh38]

LGTM. @justaugustus @laurentsimon for a second opinion.

[justaugustus]

@naveensrinivasan -- Tweaked the PR title, since we're auditing egress, not blocking yet

[github-actions]

Integration tests success for
[9adb214]
(https://github.com/ossf/scorecard/actions/runs/1987850347)