[improve](sec): step-security recommendation

Signed-off-by: Ralph Hightower <[email protected]>

.github/workflows/release.yml

@@ -7,7 +7,10 @@ on:
       - beta
       - "*.x"
 permissions:
-  contents: read # for checkout
+  contents: write
+  issues: write
+  pull-requests: write
+
 jobs:
   release:
     permissions:
@@ -18,21 +21,27 @@ jobs:
     name: release
     runs-on: ubuntu-latest
     steps:
-      - name: Harden Runner
-        uses: step-security/harden-runner@0080882f6c36860b6ba35c610c98ce87d4e2f26f # v2.10.2
-        with:
-          egress-policy: audit
+    - name: Harden Runner
+      uses: step-security/harden-runner@0080882f6c36860b6ba35c610c98ce87d4e2f26f # v2.10.0
+      with:
+        disable-sudo: true
+        egress-policy: block
+        allowed-endpoints: >
+          api.github.com:443
+          github.com:443
+          registry.npmjs.org:443
+          tuf-repo-cdn.sigstore.dev:443
 
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-      - uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af # v4.1.0
-        with:
-          cache: npm
-          node-version: lts/*
-      - run: npm clean-install
-      - run: corepack npm audit signatures
-      # pinned version updated automatically by Renovate.
-      # details at https://semantic-release.gitbook.io/semantic-release/usage/installation#global-installation
-      - run: npx [email protected]
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
+    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+    - uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af # v4.1.0
+      with:
+        cache: npm
+        node-version: lts/*
+    - run: npm clean-install
+    - run: corepack npm audit signatures
+    # pinned version updated automatically by Renovate.
+    # details at https://semantic-release.gitbook.io/semantic-release/usage/installation#global-installation
+    - run: npx [email protected]
+      env:
+        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        NPM_TOKEN: ${{ secrets.NPM_TOKEN }}