Limit GITHUB_TOKEN permissions (#54)

Signed-off-by: Jed Salazar <[email protected]>

.github/workflows/buildifier.yaml

@@ -10,10 +10,18 @@ on:
   # Allows you to run this workflow manually from the Actions tab
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   check:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - name: Harden Runner
+        uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0
+        with:
+          egress-policy: audit
+
+      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
       - name: buildifier
         run: bazel run --enable_bzlmod //.github/workflows:buildifier.check