From 74c930363487e598be68b96e4062eac631a57c7c Mon Sep 17 00:00:00 2001
From: "stepsecurity-app[bot]"
 <188008098+stepsecurity-app[bot]@users.noreply.github.com>
Date: Tue, 25 Aug 2026 16:21:51 +0000
Subject: [PATCH] [StepSecurity] Apply security best practices

Signed-off-by: StepSecurity Bot <bot@stepsecurity.io>
---
 .github/workflows/base-std-docs-sync.yml | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/.github/workflows/base-std-docs-sync.yml b/.github/workflows/base-std-docs-sync.yml
index 64f02600c..6c82f8690 100644
--- a/.github/workflows/base-std-docs-sync.yml
+++ b/.github/workflows/base-std-docs-sync.yml
@@ -36,6 +36,11 @@ jobs:
     permissions:
       contents: read
     steps:
+      - name: Harden the runner (Audit all outbound calls)
+        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
+        with:
+          egress-policy: audit
+
       - name: Validate actor and event
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}