(hactoberfest): Fix code scanning alert #3821

[BLANKatGITHUB]

As first a student and first time contributor, I didn't understand fully what I had to do , but I tried my best. Thanks for giving me opportunity to learn :) .

[romange]

Thanks! A few questions:

1. Why github actions use hashes?
2. what step-security/harden-runner does? why do we need it in all the workflows?

[romange]

you should checkout with submodules. See how we checkout in other places.

what this action does?

[BLANKatGITHUB]

used to monitor and log all outgoing network traffic during your CI/CD workflows without blocking any traffic.

[romange]

what are these?

[BLANKatGITHUB]

gitleaks repo is used to detect and prevent hardcoded secrets like passwords, API keys and tokens in git repositries.

[romange]

My main comment is that this PR is huge and I prefer we take it by baby steps - since both you and I do not have much experience in this domain. Please choose 1-2 improvements you want to add and submit only them, no need to add everything at once.

[BLANKatGITHUB]

I appreciate your feedback, and I am sorry for inconvenience that I may have caused, I am somewhat familiar with GitHub Actions but never used them in real projects, I will try my best to solve these and add them incrementally . I hope you can guide me if I face a problem thanks.

[BLANKatGITHUB]

Thanks! A few questions:

1. Why github actions use hashes?

GitHub actions use hashes to use the specific commit or SHA of an action to ensure stability.

2. what step-security/harden-runner does? why do we need it in all the workflows?

step-security/harden-runner provides some security features like network egress filtering and runtime security.

[romange]

I prefer we won't use hashes and not add harden-runner - this should reduce the diff significantly.

[BLANKatGITHUB]

I will create a new pull request requesting change in one workflow.