From c0e9c50bf8a83a4d1c2b561a578fcf30c3464cf6 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 13 Jul 2026 02:34:39 +0000 Subject: [PATCH] ci(deps): bump the all-dependencies group with 12 updates Bumps the all-dependencies group with 12 updates: | Package | From | To | | --- | --- | --- | | [step-security/harden-runner](https://github.com/step-security/harden-runner) | `2.19.4` | `2.20.0` | | [lycheeverse/lychee-action](https://github.com/lycheeverse/lychee-action) | `2.8.0` | `2.9.0` | | [github/codeql-action/upload-sarif](https://github.com/github/codeql-action) | `4.36.2` | `4.36.3` | | [github/codeql-action/init](https://github.com/github/codeql-action) | `4.36.2` | `4.36.3` | | [github/codeql-action/autobuild](https://github.com/github/codeql-action) | `4.36.2` | `4.36.3` | | [github/codeql-action/analyze](https://github.com/github/codeql-action) | `4.36.2` | `4.36.3` | | [docker/setup-qemu-action](https://github.com/docker/setup-qemu-action) | `4.1.0` | `4.2.0` | | [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action) | `4.1.0` | `4.2.0` | | [docker/login-action](https://github.com/docker/login-action) | `4.2.0` | `4.4.0` | | [docker/metadata-action](https://github.com/docker/metadata-action) | `6.1.0` | `6.2.0` | | [docker/build-push-action](https://github.com/docker/build-push-action) | `7.2.0` | `7.3.0` | | [actions/labeler](https://github.com/actions/labeler) | `6.1.0` | `6.2.0` | Updates `step-security/harden-runner` from 2.19.4 to 2.20.0 - [Release notes](https://github.com/step-security/harden-runner/releases) - [Commits](https://github.com/step-security/harden-runner/compare/9af89fc71515a100421586dfdb3dc9c984fbf411...bf7454d06d71f1098171f2acdf0cd4708d7b5920) Updates `lycheeverse/lychee-action` from 2.8.0 to 2.9.0 - [Release notes](https://github.com/lycheeverse/lychee-action/releases) - [Commits](https://github.com/lycheeverse/lychee-action/compare/8646ba30535128ac92d33dfc9133794bfdd9b411...e7477775783ea5526144ba13e8db5eec57747ce8) Updates `github/codeql-action/upload-sarif` from 4.36.2 to 4.36.3 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/8aad20d150bbac5944a9f9d289da16a4b0d87c1e...54f647b7e1bb85c95cddabcd46b0c578ec92bc1a) Updates `github/codeql-action/init` from 4.36.2 to 4.36.3 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/8aad20d150bbac5944a9f9d289da16a4b0d87c1e...54f647b7e1bb85c95cddabcd46b0c578ec92bc1a) Updates `github/codeql-action/autobuild` from 4.36.2 to 4.36.3 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/8aad20d150bbac5944a9f9d289da16a4b0d87c1e...54f647b7e1bb85c95cddabcd46b0c578ec92bc1a) Updates `github/codeql-action/analyze` from 4.36.2 to 4.36.3 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/8aad20d150bbac5944a9f9d289da16a4b0d87c1e...54f647b7e1bb85c95cddabcd46b0c578ec92bc1a) Updates `docker/setup-qemu-action` from 4.1.0 to 4.2.0 - [Release notes](https://github.com/docker/setup-qemu-action/releases) - [Commits](https://github.com/docker/setup-qemu-action/compare/06116385d9baf250c9f4dcb4858b16962ea869c3...96fe6ef7f33517b61c61be40b68a1882f3264fb8) Updates `docker/setup-buildx-action` from 4.1.0 to 4.2.0 - [Release notes](https://github.com/docker/setup-buildx-action/releases) - [Commits](https://github.com/docker/setup-buildx-action/compare/d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5...bb05f3f5519dd87d3ba754cc423b652a5edd6d2c) Updates `docker/login-action` from 4.2.0 to 4.4.0 - [Release notes](https://github.com/docker/login-action/releases) - [Commits](https://github.com/docker/login-action/compare/650006c6eb7dba73a995cc03b0b2d7f5ca915bee...af1e73f918a031802d376d3c8bbc3fe56130a9b0) Updates `docker/metadata-action` from 6.1.0 to 6.2.0 - [Release notes](https://github.com/docker/metadata-action/releases) - [Commits](https://github.com/docker/metadata-action/compare/80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9...dc802804100637a589fabce1cb79ff13a1411302) Updates `docker/build-push-action` from 7.2.0 to 7.3.0 - [Release notes](https://github.com/docker/build-push-action/releases) - [Commits](https://github.com/docker/build-push-action/compare/f9f3042f7e2789586610d6e8b85c8f03e5195baf...53b7df96c91f9c12dcc8a07bcb9ccacbed38856a) Updates `actions/labeler` from 6.1.0 to 6.2.0 - [Release notes](https://github.com/actions/labeler/releases) - [Commits](https://github.com/actions/labeler/compare/f27b608878404679385c85cfa523b85ccb86e213...b8dd2d9be0f68b860e7dae5dae7d772984eacd6d) --- updated-dependencies: - dependency-name: step-security/harden-runner dependency-version: 2.20.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: all-dependencies - dependency-name: lycheeverse/lychee-action dependency-version: 2.9.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: all-dependencies - dependency-name: github/codeql-action/upload-sarif dependency-version: 4.36.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: all-dependencies - dependency-name: github/codeql-action/init dependency-version: 4.36.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: all-dependencies - dependency-name: github/codeql-action/autobuild dependency-version: 4.36.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: all-dependencies - dependency-name: github/codeql-action/analyze dependency-version: 4.36.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: all-dependencies - dependency-name: docker/setup-qemu-action dependency-version: 4.2.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: all-dependencies - dependency-name: docker/setup-buildx-action dependency-version: 4.2.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: all-dependencies - dependency-name: docker/login-action dependency-version: 4.4.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: all-dependencies - dependency-name: docker/metadata-action dependency-version: 6.2.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: all-dependencies - dependency-name: docker/build-push-action dependency-version: 7.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: all-dependencies - dependency-name: actions/labeler dependency-version: 6.2.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: all-dependencies ... Signed-off-by: dependabot[bot] --- .github/workflows/cache.yml | 2 +- .github/workflows/cd.yml | 6 +++--- .github/workflows/ci.yml | 12 ++++++------ .github/workflows/codeql.yml | 8 ++++---- .github/workflows/dco.yml | 2 +- .github/workflows/dependabot-auto-merge.yml | 2 +- .github/workflows/dependabot-sync.yml | 2 +- .github/workflows/docker.yml | 18 +++++++++--------- .github/workflows/labeler.yml | 4 ++-- .github/workflows/nightly-audit.yml | 2 +- .github/workflows/pages.yml | 4 ++-- .github/workflows/pr-title.yml | 2 +- .github/workflows/scorecard.yml | 4 ++-- .github/workflows/stale.yml | 2 +- 14 files changed, 35 insertions(+), 35 deletions(-) diff --git a/.github/workflows/cache.yml b/.github/workflows/cache.yml index a68a59c8..58104175 100644 --- a/.github/workflows/cache.yml +++ b/.github/workflows/cache.yml @@ -41,7 +41,7 @@ jobs: timeout-minutes: 40 # 10m is more than enough for cache list/delete operations steps: - name: "🔒 Harden Runner" - uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4 + uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 with: disable-sudo: true egress-policy: block diff --git a/.github/workflows/cd.yml b/.github/workflows/cd.yml index 5e449f7e..64fced4b 100644 --- a/.github/workflows/cd.yml +++ b/.github/workflows/cd.yml @@ -52,7 +52,7 @@ jobs: steps: - name: "🔒 Harden Runner" if: matrix.os == 'ubuntu-latest' - uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4 + uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 with: disable-sudo: true egress-policy: block @@ -189,7 +189,7 @@ jobs: ${{ runner.os }}-lychee- - name: "🔗 Verify Documentation Links (Lychee)" - uses: lycheeverse/lychee-action@8646ba30535128ac92d33dfc9133794bfdd9b411 # v2.8.0 + uses: lycheeverse/lychee-action@e7477775783ea5526144ba13e8db5eec57747ce8 # v2.9.0 if: ${{ always() && matrix.os == 'ubuntu-latest' }} continue-on-error: true # Don't block CD on link check failures (network issues, rate limits, etc.) with: @@ -215,7 +215,7 @@ jobs: skip-dirs: "unirtm_data,cmd/unirtm_data" - name: "📤 Upload Security Audit (SARIF)" - uses: github/codeql-action/upload-sarif@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2 + uses: github/codeql-action/upload-sarif@54f647b7e1bb85c95cddabcd46b0c578ec92bc1a # v4.36.3 if: always() && matrix.os == 'ubuntu-latest' with: sarif_file: "trivy-results.sarif" diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 5b8530d4..0d7b2c71 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -38,7 +38,7 @@ jobs: contents: read steps: - name: "🔒 Harden Runner" - uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4 + uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 with: disable-sudo: true egress-policy: block @@ -151,7 +151,7 @@ jobs: steps: - name: "🔒 Harden Runner" if: matrix.os == 'ubuntu-latest' - uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4 + uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 with: disable-sudo: true egress-policy: block @@ -279,7 +279,7 @@ jobs: steps: - name: "🔒 Harden Runner" if: matrix.os == 'ubuntu-latest' - uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4 + uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 with: disable-sudo: true egress-policy: block @@ -448,7 +448,7 @@ jobs: PYTHONUTF8: 1 steps: - name: "🔒 Harden Runner" - uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4 + uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 with: disable-sudo: true egress-policy: block @@ -576,7 +576,7 @@ jobs: ${{ runner.os }}-lychee- - name: "🔗 Verify Documentation Links (Lychee)" - uses: lycheeverse/lychee-action@8646ba30535128ac92d33dfc9133794bfdd9b411 # v2.8.0 + uses: lycheeverse/lychee-action@e7477775783ea5526144ba13e8db5eec57747ce8 # v2.9.0 if: ${{ always() }} continue-on-error: true # Don't block CI on link check failures (network issues, rate limits, etc.) with: @@ -602,7 +602,7 @@ jobs: skip-dirs: "unirtm_data,cmd/unirtm_data" - name: "📤 Upload Security Audit (SARIF)" - uses: github/codeql-action/upload-sarif@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2 + uses: github/codeql-action/upload-sarif@54f647b7e1bb85c95cddabcd46b0c578ec92bc1a # v4.36.3 if: always() with: sarif_file: "." diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 4e568166..9ce190c8 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -68,7 +68,7 @@ jobs: steps: - name: "🔒 Harden Runner" - uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4 + uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 with: disable-sudo: true egress-policy: block @@ -154,18 +154,18 @@ jobs: persist-credentials: false - name: "🛡️ Initialize CodeQL Engine" - uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2 + uses: github/codeql-action/init@54f647b7e1bb85c95cddabcd46b0c578ec92bc1a # v4.36.3 with: # Sets up the CodeQL database for the specified technical stack (e.g., Python, Go). languages: ${{ matrix.language }} config-file: .github/codeql/codeql-config.yml - name: "🚀 Bootstrap Target Build" - uses: github/codeql-action/autobuild@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2 + uses: github/codeql-action/autobuild@54f647b7e1bb85c95cddabcd46b0c578ec92bc1a # v4.36.3 # Attempts to automatically compile the project to enable full-trace analysis. - name: "🔍 Perform Deep Security Analysis" - uses: github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2 + uses: github/codeql-action/analyze@54f647b7e1bb85c95cddabcd46b0c578ec92bc1a # v4.36.3 with: # Executes the semantic queries and generates the final vulnerability report. category: "/language:${{ matrix.language }}" diff --git a/.github/workflows/dco.yml b/.github/workflows/dco.yml index 45cdfa01..0b5ad17f 100644 --- a/.github/workflows/dco.yml +++ b/.github/workflows/dco.yml @@ -38,7 +38,7 @@ jobs: timeout-minutes: 30 steps: - name: "🔒 Harden Runner" - uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4 + uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 with: disable-sudo: true egress-policy: block diff --git a/.github/workflows/dependabot-auto-merge.yml b/.github/workflows/dependabot-auto-merge.yml index 0a28ba5e..1bb02528 100644 --- a/.github/workflows/dependabot-auto-merge.yml +++ b/.github/workflows/dependabot-auto-merge.yml @@ -25,7 +25,7 @@ jobs: if: github.event.pull_request.user.login == 'dependabot[bot]' steps: - name: "🔒 Harden Runner" - uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4 + uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 with: disable-sudo: true egress-policy: block diff --git a/.github/workflows/dependabot-sync.yml b/.github/workflows/dependabot-sync.yml index 81c250f4..308376fc 100644 --- a/.github/workflows/dependabot-sync.yml +++ b/.github/workflows/dependabot-sync.yml @@ -62,7 +62,7 @@ jobs: timeout-minutes: 30 steps: - name: "🔒 Harden Runner" - uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4 + uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 with: disable-sudo: true egress-policy: block diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml index 27f207c1..00085ff4 100644 --- a/.github/workflows/docker.yml +++ b/.github/workflows/docker.yml @@ -109,7 +109,7 @@ jobs: - name: "🔒 Harden Runner (Security Egress Audit)" if: steps.version-filter.outputs.skip != 'true' - uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4 + uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 with: egress-policy: block allowed-endpoints: > @@ -196,11 +196,11 @@ jobs: - name: "🏗️ Configure QEMU Emulation" if: steps.version-filter.outputs.skip != 'true' - uses: docker/setup-qemu-action@06116385d9baf250c9f4dcb4858b16962ea869c3 # v4.1.0 + uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0 - name: "🛠️ Configure Docker Buildx" if: steps.version-filter.outputs.skip != 'true' - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0 + uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0 with: buildkitd-config: .github/buildkitd.toml @@ -208,7 +208,7 @@ jobs: if: steps.version-filter.outputs.skip != 'true' id: login-dockerhub continue-on-error: true - uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0 + uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0 with: username: ${{ secrets.DOCKER_HUB_USERNAME }} password: ${{ secrets.DOCKER_HUB_TOKEN }} @@ -217,7 +217,7 @@ jobs: if: steps.version-filter.outputs.skip != 'true' id: login-quay continue-on-error: true - uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0 + uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0 with: registry: quay.io username: ${{ secrets.QUAY_USERNAME }} @@ -227,7 +227,7 @@ jobs: if: steps.version-filter.outputs.skip != 'true' id: login-ghcr continue-on-error: true - uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0 + uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0 with: registry: ghcr.io username: ${{ github.repository_owner }} @@ -251,7 +251,7 @@ jobs: - name: "🏷️ Generate Docker Metadata" if: steps.version-filter.outputs.skip != 'true' id: meta - uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6.1.0 + uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0 with: images: | name=snowdreamtech/debian,enable=true @@ -299,7 +299,7 @@ jobs: steps.version-filter.outputs.skip != 'true' && ((github.event_name != 'push' || !startsWith(github.ref, 'refs/tags/')) || (startsWith(github.ref, format('refs/tags/{0}-', matrix.version)))) - uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0 + uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0 with: context: docker/${{ matrix.version }} build-args: | @@ -527,7 +527,7 @@ jobs: - name: "📤 Upload Image Security Scan (SARIF)" if: steps.version-filter.outputs.skip != 'true' && steps.build.conclusion == 'success' && steps.trivy.outcome == 'success' continue-on-error: true - uses: github/codeql-action/upload-sarif@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2 + uses: github/codeql-action/upload-sarif@54f647b7e1bb85c95cddabcd46b0c578ec92bc1a # v4.36.3 with: sarif_file: "trivy-image-${{ matrix.version }}.sarif" category: "trivy-image-debian-${{ matrix.version }}" diff --git a/.github/workflows/labeler.yml b/.github/workflows/labeler.yml index 95ad7f51..60520e0e 100644 --- a/.github/workflows/labeler.yml +++ b/.github/workflows/labeler.yml @@ -39,7 +39,7 @@ jobs: timeout-minutes: 30 # Path-based labeling is extremely fast steps: - name: "🔒 Harden Runner" - uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4 + uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 with: disable-sudo: true egress-policy: block @@ -120,7 +120,7 @@ jobs: fulcio.sigstore.dev:443 api.sigstore.dev:443 - name: "🔍 Triage Pull Request (Labeler)" - uses: actions/labeler@f27b608878404679385c85cfa523b85ccb86e213 # v6.1.0 + uses: actions/labeler@b8dd2d9be0f68b860e7dae5dae7d772984eacd6d # v6.2.0 with: # Automatically applies labels based on file path changes to improve maintenance visibility. repo-token: ${{ secrets.GITHUB_TOKEN }} diff --git a/.github/workflows/nightly-audit.yml b/.github/workflows/nightly-audit.yml index 7fa50f78..b61ada34 100644 --- a/.github/workflows/nightly-audit.yml +++ b/.github/workflows/nightly-audit.yml @@ -28,7 +28,7 @@ jobs: timeout-minutes: 120 steps: - name: "🔒 Harden Runner" - uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4 + uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 with: disable-sudo: true egress-policy: block diff --git a/.github/workflows/pages.yml b/.github/workflows/pages.yml index 40d4c5e6..c9e431c5 100644 --- a/.github/workflows/pages.yml +++ b/.github/workflows/pages.yml @@ -57,7 +57,7 @@ jobs: steps: - name: "🔒 Harden Runner" - uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4 + uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 with: disable-sudo: true egress-policy: block @@ -183,7 +183,7 @@ jobs: timeout-minutes: 40 steps: - name: "🔒 Harden Runner" - uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4 + uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 with: disable-sudo: true egress-policy: block diff --git a/.github/workflows/pr-title.yml b/.github/workflows/pr-title.yml index 6c4c2550..74599819 100644 --- a/.github/workflows/pr-title.yml +++ b/.github/workflows/pr-title.yml @@ -41,7 +41,7 @@ jobs: timeout-minutes: 30 # Title linting is near-instant steps: - name: "🔒 Harden Runner" - uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4 + uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 with: disable-sudo: true egress-policy: block diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index 12bce092..0f934db7 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -40,7 +40,7 @@ jobs: steps: - name: "🔒 Harden Runner" - uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4 + uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 with: disable-sudo: true egress-policy: block @@ -137,6 +137,6 @@ jobs: # Upload the results to GitHub's code scanning dashboard. - name: "📤 Upload SARIF Results" - uses: github/codeql-action/upload-sarif@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2 + uses: github/codeql-action/upload-sarif@54f647b7e1bb85c95cddabcd46b0c578ec92bc1a # v4.36.3 with: sarif_file: results.sarif diff --git a/.github/workflows/stale.yml b/.github/workflows/stale.yml index 4fe8ebe2..11ab85dd 100644 --- a/.github/workflows/stale.yml +++ b/.github/workflows/stale.yml @@ -41,7 +41,7 @@ jobs: timeout-minutes: 40 # Maintenance tasks are usually fast API operations steps: - name: "🔒 Harden Runner" - uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4 + uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 with: disable-sudo: true egress-policy: block