ci: apply security best practices #92

	# Vulnerability details at https://securitylab.github.com/advisories/GHSL-2023-271_changed-files/
	name: "Changed-Files Vulnerability: Without Harden-Runner"

	on:
	pull_request:
	branches:
	- main

	permissions:
	pull-requests: read

	jobs:
	changed_files:
	runs-on: ubuntu-latest
	name: Test changed-files
	steps:
	- name: Harden the runner (Audit all outbound calls)
	uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0
	with:
	egress-policy: audit

	- uses: actions/checkout@v4
	with:
	fetch-depth: 0

	# Example 1
	- name: Get changed files
	id: changed-files
	uses: step-security/changed-files@95b56dadb92a30ca9036f16423fd3c088a71ee94 # v46.0.5

	- name: List all changed files
	run: \|
	for file in ${{ steps.changed-files.outputs.all_changed_files }}; do
	echo "$file was changed"
	done

Provide feedback