From d57458d05b5937df3e11cf2639b4a4d0d53eb180 Mon Sep 17 00:00:00 2001
From: StepSecurity Bot <bot@stepsecurity.io>
Date: Tue, 7 Apr 2026 13:29:52 -0700
Subject: [PATCH] [StepSecurity] ci: Harden GitHub Actions (#27202)

Signed-off-by: StepSecurity Bot <bot@stepsecurity.io>
---
 .github/workflows/copilot-setup-steps.yml     | 64 +++++++++++++++++++
 .../workflows/windows-packaging-reusable.yml  |  3 +
 .github/workflows/xunit-tests.yml             |  3 +
 3 files changed, 70 insertions(+)
 create mode 100644 .github/workflows/copilot-setup-steps.yml

diff --git a/.github/workflows/copilot-setup-steps.yml b/.github/workflows/copilot-setup-steps.yml
new file mode 100644
index 00000000000..7c63c9122a8
--- /dev/null
+++ b/.github/workflows/copilot-setup-steps.yml
@@ -0,0 +1,64 @@
+name: "Copilot Setup Steps"
+
+# Allow testing of the setup steps from your repository's "Actions" tab.
+on:
+  workflow_dispatch:
+
+  pull_request:
+    branches:
+      - master
+    paths:
+      - ".github/workflows/copilot-setup-steps.yml"
+
+permissions:
+  contents: read
+
+jobs:
+  # The job MUST be called `copilot-setup-steps` or it will not be picked up by Copilot.
+  # See https://docs.github.com/en/copilot/customizing-copilot/customizing-the-development-environment-for-copilot-coding-agent
+  copilot-setup-steps:
+    runs-on: ubuntu-latest
+
+    permissions:
+      contents: read
+
+    # You can define any steps you want, and they will run before the agent starts.
+    # If you do not check out your code, Copilot will do this for you.
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          fetch-depth: 1000
+
+      - name: Bootstrap
+        if: success()
+        run: |-
+          $title = 'Import Build.psm1'
+          Write-Host "::group::$title"
+          Import-Module ./build.psm1 -Verbose -ErrorAction Stop
+          Write-LogGroupEnd -Title $title
+
+          $title = 'Switch to public feed'
+          Write-LogGroupStart -Title $title
+          Switch-PSNugetConfig -Source Public
+          Write-LogGroupEnd -Title $title
+
+          $title = 'Bootstrap'
+          Write-LogGroupStart -Title $title
+          Start-PSBootstrap -Scenario DotNet
+          Write-LogGroupEnd -Title $title
+
+          $title = 'Install .NET Tools'
+          Write-LogGroupStart -Title $title
+          Start-PSBootstrap -Scenario Tools
+          Write-LogGroupEnd -Title $title
+
+          $title = 'Sync Tags'
+          Write-LogGroupStart -Title $title
+          Sync-PSTags -AddRemoteIfMissing
+          Write-LogGroupEnd -Title $title
+
+          $title = 'Setup .NET environment variables'
+          Write-LogGroupStart -Title $title
+          Find-DotNet -SetDotnetRoot
+          Write-LogGroupEnd -Title $title
+        shell: pwsh
diff --git a/.github/workflows/windows-packaging-reusable.yml b/.github/workflows/windows-packaging-reusable.yml
index 77a207217a0..436287e96f9 100644
--- a/.github/workflows/windows-packaging-reusable.yml
+++ b/.github/workflows/windows-packaging-reusable.yml
@@ -13,6 +13,9 @@ env:
   SYSTEM_ARTIFACTSDIRECTORY: ${{ github.workspace }}/artifacts
   BUILD_ARTIFACTSTAGINGDIRECTORY: ${{ github.workspace }}/artifacts
 
+permissions:
+  contents: read
+
 jobs:
   package:
     name: ${{ matrix.architecture }} - ${{ matrix.channel }}
diff --git a/.github/workflows/xunit-tests.yml b/.github/workflows/xunit-tests.yml
index e16b9fa068f..1495f91b9a1 100644
--- a/.github/workflows/xunit-tests.yml
+++ b/.github/workflows/xunit-tests.yml
@@ -14,6 +14,9 @@ on:
         required: false
         default: testResults-xunit
 
+permissions:
+  contents: read
+
 jobs:
   xunit:
     name: Run xUnit Tests