From 97dd2fd3ff15fc1e61a25c27e211f991757d9f07 Mon Sep 17 00:00:00 2001
From: "stepsecurity-app[bot]"
 <188008098+stepsecurity-app[bot]@users.noreply.github.com>
Date: Sat, 11 Jul 2026 08:18:44 +0000
Subject: [PATCH] ci: [StepSecurity] Apply security best practices

Signed-off-by: StepSecurity Bot <bot@stepsecurity.io>
---
 .github/workflows/size_labels.yml | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/.github/workflows/size_labels.yml b/.github/workflows/size_labels.yml
index 885fe68c5..2894724e4 100644
--- a/.github/workflows/size_labels.yml
+++ b/.github/workflows/size_labels.yml
@@ -2,6 +2,9 @@ name: "Pull request size labels"
 
 on: [pull_request]
 
+permissions:
+  contents: read
+
 jobs:
   labeler:
     permissions:
@@ -9,6 +12,11 @@ jobs:
       contents: read
     runs-on: ubuntu-latest
     steps:
+      - name: Harden the runner (Audit all outbound calls)
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        with:
+          egress-policy: audit
+
       - name: Size Labeler
         uses: codelytv/pr-size-labeler@095a41fca88b8764fd9e008ad269bcdb82bb38b9
         with: