[StepSecurity] Apply security best practices

[stepsecurity-app]

Summary

This pull request has been generated by StepSecurity as part of your enterprise subscription to ensure compliance with recommended security best practices. Please review and merge the pull request to apply these security enhancements.

Security Fixes

Harden Runner

Harden-Runner is an open-source security agent for the GitHub-hosted runner to prevent software supply chain attacks. It prevents exfiltration of credentials, detects tampering of source code during build, and enables running jobs without sudo access.

• GitHub Security Guide
• The Open Source Security Foundation (OpenSSF) Security Guide

Pinned Dependencies

Pinning GitHub Actions to specific versions or commit SHAs ensures that your workflows remain consistent and secure.
Unpinned actions can lead to unexpected changes or vulnerabilities caused by upstream updates.

• GitHub Security Guide
• The Open Source Security Foundation (OpenSSF) Security Guide

Feedback

For bug reports, feature requests, and general feedback; please create an issue in step-security/secure-repo or contact us via our website.

[github-actions]

Interface Coverage

❌ Interface functions with no test coverage found.

Warning: Found unknown `base` config for profile `fork` defined in foundry.toml.
Warning: optimizer settings and `viaIR` have been disabled for accurate coverage reports.
If you encounter "stack too deep" errors, consider using `--ir-minimum` which enables `viaIR` with minimum optimization resolving most of the errors.
See more: https://book.getfoundry.sh/guides/best-practices/stack-too-deep\n```

[github-actions]

⚠️ Fork tests: 6 failed, 601 passed

These failures indicate divergences where base/base needs to catch up to the base-std spec. This check is advisory and does not block merging.

Failing tests

• test_createPolicy_revertOrder(address,address,uint8): vm.store: cannot use precompile 0x8453000000000000000000000000000000000002 as an argument; counterexample: calldata=0x5bc079710000000000000000000000004487de7865be8774c2c65f6a564f8beb7adc712d0000000000000000000000000e7430c6199c92b73fec2ca53f6c49d269374b10000000000000000000000000000000000000000000000000000000000000000c args=[0x4487De7865Be8774c2c65f6A564F8BeB7adC712D, 0x0e7430C6199C92B73Fec2cA53F6C49D269374B10, 12]
• test_createPolicy_revert_counterOverflow(address,address,uint8): vm.store: cannot use precompile 0x8453000000000000000000000000000000000002 as an argument; counterexample: calldata=0xe359ddcb000000000000000000000000c26ed61c0e00014f2d8e866132038e429e6f26f8000000000000000000000000c47ed23eb6bf8698589f4b9183c8c5f4f77bdfb00000000000000000000000000000000000000000000000000000000000000017 args=[0xC26ED61c0E00014F2d8e866132038e429E6f26F8, 0xC47eD23eB6BF8698589F4b9183c8c5f4f77bDfb0, 23]
  [FAIL: OPERATOR_ROLE() must not resolve (renamed to OPERATOR_ROLE)] test_operatorRole_success_renamedFromSecurityOperator() (gas: 10068)