[discussion] Add harden-runner (audit mode) to release job, ahead of signing pipeline restoration

.github/action-allowlist.txt

@@ -53,3 +53,24 @@ ossf/scorecard-action
 # (build commits committed mid-build can't tamper). Collaborated on by
 # Google, Chainguard, and the Linux Foundation.
 slsa-framework/slsa-github-generator
+
+# --- StepSecurity ---
+# Harden-Runner. Not a wrapper around a tool we'd otherwise invoke via
+# `run:` — its whole function is hooking the runner's networking before
+# anything else in the job executes, which a plain script can't do.
+# Added as the first step of release.yml's publish-source-release job
+# only, in `egress-policy: audit` (observe, never block). That job is
+# the one place in this repo with a `contents: write` token behind an
+# environment gate, and it's the job the not-yet-restored cosign/SBOM/
+# notarization pipeline (see release.yml history) will land in — this
+# gets egress visibility wired in ahead of that, rather than as a
+# follow-up once real signing/notarization credentials are present.
+# Deliberately not added to lint/test/build/codeql/vuln-scan/scorecard:
+# none of those jobs carry a token or secret worth watching, and
+# per-job StepSecurity is a privileged eBPF-based agent, not a passive
+# action — running it where there's nothing to protect is added attack
+# surface and an added external-service dependency for zero benefit.
+# Maintainer: StepSecurity (venture-backed security co., not a single
+# maintainer); action is widely adopted (OpenSSF, many CNCF projects).
+# Pinned SHA: e14015d583714f6e62063499dc959a02595150a1  # v2.21.1
+step-security/harden-runner

.github/workflows/release.yml

@@ -37,6 +37,15 @@ jobs:
     permissions:
       contents: write  # create the GitHub Release
     steps:
+      # Audit-only egress visibility on the one job in this repo that
+      # holds a write-scoped token behind an environment gate. See
+      # .github/action-allowlist.txt for the scoping rationale. Never
+      # blocking — this is observation, not enforcement.
+      - name: Harden Runner
+        uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1  # v2.21.1
+        with:
+          egress-policy: audit
+
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           fetch-depth: 0