Harden CI follow up (#437)

* more CI hardening

* cleanup testing bits

.github/workflows/strict-integration.yaml

@@ -8,11 +8,18 @@ on:
       - 'autoupdate/sync/**'
   pull_request:
 
+permissions:
+  contents: read
+
 jobs:
   build:
     name: Build
     runs-on: ubuntu-20.04
     steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@v2
+        with:
+          egress-policy: audit
       - name: Checking out repo
         uses: actions/checkout@v4
       - name: Install lxd

.github/workflows/strict.yaml

@@ -16,6 +16,10 @@ jobs:
     outputs:
       strict: ${{ steps.determine.outputs.strict }}
     steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@v2
+        with:
+          egress-policy: audit
       - name: Determine Strict branch
         id: determine
         env:
@@ -37,6 +41,10 @@ jobs:
     needs: [ prepare ]
     if: ${{ needs.prepare.outputs.strict }}
     steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@v2
+        with:
+          egress-policy: audit
       - name: Sync ${{ github.ref }} to ${{ needs.prepare.outputs.strict }}
         uses: actions/checkout@v4
         with:

.github/workflows/update-components.yaml

@@ -5,8 +5,14 @@ on:
   schedule:
     - cron: "0 10 * * *"
 
+permissions:
+  contents: read
+
 jobs:
   update:
+    permissions:
+      contents: write # for peter-evans/create-pull-request to create branch
+      pull-requests: write # for peter-evans/create-pull-request to create a PR
     runs-on: ubuntu-latest
     strategy:
       fail-fast: false
@@ -18,6 +24,10 @@ jobs:
           - release-1.30
 
     steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@v2
+        with:
+          egress-policy: audit
       - name: Checking out repo
         uses: actions/checkout@v4
         with: