Bump step-security/harden-runner from 2.8.1 to 2.9.0 #5352

	name: Docs builds

	concurrency:
	group: ${{ github.workflow }}-${{ github.event.pull_request.number \|\| github.ref }}
	cancel-in-progress: true

	on:
	push:
	paths-ignore:
	- 'locale/**'

	pull_request:
	paths-ignore:
	- 'locale/**'

	permissions: # added using https://github.com/step-security/secure-repo
	contents: read

	jobs:
	build:

	runs-on: ubuntu-latest
	strategy:
	matrix:
	format: [html, pdf]

	steps:
	- name: Harden Runner
	uses: step-security/harden-runner@0d381219ddf674d61a7572ddd19d7941e271515c # v2.9.0
	with:
	egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs

	- name: Check out repository
	uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
	with:
	fetch-depth: 1
	- name: Set up Python 3.9
	uses: actions/setup-python@82c7e631bb3cdc910f68e0081d67478d79c6982d # v5.1.0
	with:
	python-version: 3.9
	- name: Install Requirements
	run: \|
	if [[ ${{ matrix.format }} != "html" ]]; then
	sudo apt-get update && sudo apt-get install -y texlive-xetex fonts-freefont-otf
	fi

	python -m pip install --upgrade pip
	pip install -r REQUIREMENTS.txt

	- name: Build English ${{ matrix.format }} documentation
	run: \|
	make ${{ matrix.format }}
	- name: Upload ${{ matrix.format }} build artifact
	uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # v4.3.3
	with:
	name: ${{ matrix.format }} build
	path: build/${{ matrix.format }}
	retention-days: 15

Provide feedback