diff --git a/.github/workflows/adoption-metrics.yml b/.github/workflows/adoption-metrics.yml index 52c6153..7850d78 100644 --- a/.github/workflows/adoption-metrics.yml +++ b/.github/workflows/adoption-metrics.yml @@ -41,7 +41,7 @@ jobs: contents: write steps: - name: Harden runner - uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0 + uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1 with: egress-policy: audit diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 678596d..c632a76 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -22,7 +22,7 @@ jobs: security-events: write steps: - name: Harden runner - uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0 + uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1 with: egress-policy: audit - name: Checkout diff --git a/.github/workflows/commits.yml b/.github/workflows/commits.yml index 1c601df..2eb202d 100644 --- a/.github/workflows/commits.yml +++ b/.github/workflows/commits.yml @@ -31,7 +31,7 @@ jobs: contents: read steps: - name: Harden the runner - uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0 + uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1 with: egress-policy: audit diff --git a/.github/workflows/conformance.yml b/.github/workflows/conformance.yml index 74a20c3..6334c1f 100644 --- a/.github/workflows/conformance.yml +++ b/.github/workflows/conformance.yml @@ -44,7 +44,7 @@ jobs: contents: read steps: - name: Harden runner - uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0 + uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1 with: egress-policy: audit - name: Checkout @@ -83,7 +83,7 @@ jobs: contents: read steps: - name: Harden runner - uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0 + uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1 with: egress-policy: audit - name: Checkout @@ -197,7 +197,7 @@ jobs: client: [scw-cli, terraform, opentofu, octl, exo-cli, probe, fields] steps: - name: Harden runner - uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0 + uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1 with: egress-policy: audit - name: Checkout diff --git a/.github/workflows/corpus-cloud.yml b/.github/workflows/corpus-cloud.yml index 9e284e3..2d23d70 100644 --- a/.github/workflows/corpus-cloud.yml +++ b/.github/workflows/corpus-cloud.yml @@ -42,7 +42,7 @@ jobs: moved: ${{ steps.replay.outputs.moved }} steps: - name: Harden runner - uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0 + uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1 with: egress-policy: audit - name: Checkout @@ -187,7 +187,7 @@ jobs: pull-requests: write # open the PR steps: - name: Harden runner - uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0 + uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1 with: egress-policy: audit - name: Checkout diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml index 6a13ded..c3abbf9 100644 --- a/.github/workflows/dependency-review.yml +++ b/.github/workflows/dependency-review.yml @@ -17,7 +17,7 @@ jobs: contents: read steps: - name: Harden runner - uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0 + uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1 with: egress-policy: audit - name: Checkout diff --git a/.github/workflows/drift.yml b/.github/workflows/drift.yml index c771f8b..99b6492 100644 --- a/.github/workflows/drift.yml +++ b/.github/workflows/drift.yml @@ -44,7 +44,7 @@ jobs: contracts: ${{ steps.contracts.outputs.changed }} steps: - name: Harden runner - uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0 + uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1 with: egress-policy: audit - name: Checkout @@ -222,7 +222,7 @@ jobs: pull-requests: write # open the PR steps: - name: Harden runner - uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0 + uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1 with: egress-policy: audit - name: Checkout @@ -331,7 +331,7 @@ jobs: issues: write steps: - name: Harden runner - uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0 + uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1 with: egress-policy: audit diff --git a/.github/workflows/falsify.yml b/.github/workflows/falsify.yml index b077fe4..f15af54 100644 --- a/.github/workflows/falsify.yml +++ b/.github/workflows/falsify.yml @@ -56,7 +56,7 @@ jobs: contents: read steps: - name: Harden the runner - uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0 + uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1 with: egress-policy: audit diff --git a/.github/workflows/go.yml b/.github/workflows/go.yml index 0df5e98..c1d69ce 100644 --- a/.github/workflows/go.yml +++ b/.github/workflows/go.yml @@ -20,7 +20,7 @@ jobs: contents: read steps: - name: Harden runner - uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0 + uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1 with: egress-policy: audit - name: Checkout @@ -172,7 +172,7 @@ jobs: contents: read steps: - name: Harden runner - uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0 + uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1 with: egress-policy: audit - name: Checkout @@ -230,7 +230,7 @@ jobs: # Linux only: the action installs an eBPF agent and is a no-op that # still costs a minute elsewhere. if: ${{ startsWith(matrix.runner, 'ubuntu') }} - uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0 + uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1 with: egress-policy: audit - name: Checkout diff --git a/.github/workflows/night-report.yml b/.github/workflows/night-report.yml index 000a04a..38f959e 100644 --- a/.github/workflows/night-report.yml +++ b/.github/workflows/night-report.yml @@ -59,7 +59,7 @@ jobs: issues: write # the issue itself steps: - name: Harden the runner - uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0 + uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1 with: egress-policy: audit diff --git a/.github/workflows/plumber.yml b/.github/workflows/plumber.yml index 2896d45..861db71 100644 --- a/.github/workflows/plumber.yml +++ b/.github/workflows/plumber.yml @@ -46,7 +46,7 @@ jobs: id-token: write steps: - name: Harden the runner - uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0 + uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1 with: egress-policy: audit diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index dbcabc6..6b05845 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -26,7 +26,7 @@ jobs: - { goos: darwin, goarch: arm64 } steps: - name: Harden runner - uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0 + uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1 with: egress-policy: audit - name: Checkout @@ -84,7 +84,7 @@ jobs: IMAGE: ghcr.io/${{ github.repository }} steps: - name: Harden runner - uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0 + uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1 with: egress-policy: audit - name: Checkout @@ -175,7 +175,7 @@ jobs: push-to-registry: true - name: Generate the image SBOM (Syft, CycloneDX) - uses: anchore/sbom-action@aa80c8c5bd439a416a62804f2151ab38c671a638 # v0.24.1 + uses: anchore/sbom-action@3ad7283483fc7af8ff2b4ea19663c2d5ca935e26 # v0.24.2 with: image: ${{ env.IMAGE }}@${{ steps.push.outputs.digest }} format: cyclonedx-json @@ -240,7 +240,7 @@ jobs: attestations: write # build attestation steps: - name: Harden runner - uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0 + uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1 with: egress-policy: audit - name: Checkout @@ -283,7 +283,7 @@ jobs: cat checksums.txt - name: Generate SBOM (Syft, CycloneDX) - uses: anchore/sbom-action@aa80c8c5bd439a416a62804f2151ab38c671a638 # v0.24.1 + uses: anchore/sbom-action@3ad7283483fc7af8ff2b4ea19663c2d5ca935e26 # v0.24.2 with: path: . format: cyclonedx-json @@ -372,7 +372,7 @@ jobs: } >> /tmp/notes.md - name: Create release with assets - uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3.0.2 + uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64 # v3.0.3 with: tag_name: ${{ github.ref_name }} name: ${{ github.ref_name }} diff --git a/.github/workflows/runtime-proof.yml b/.github/workflows/runtime-proof.yml index 6c084e9..003824e 100644 --- a/.github/workflows/runtime-proof.yml +++ b/.github/workflows/runtime-proof.yml @@ -73,7 +73,7 @@ jobs: mode: [incus, incus-ovn] steps: - name: Harden the runner - uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0 + uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1 with: egress-policy: audit @@ -579,7 +579,7 @@ jobs: control: [false, true] steps: - name: Harden the runner - uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0 + uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1 with: egress-policy: audit @@ -894,7 +894,7 @@ jobs: contents: read steps: - name: Harden the runner - uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0 + uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1 with: egress-policy: audit @@ -964,7 +964,7 @@ jobs: contents: read steps: - name: Harden the runner - uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0 + uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1 with: egress-policy: audit diff --git a/.github/workflows/sbom.yml b/.github/workflows/sbom.yml index 867a9c1..54ab985 100644 --- a/.github/workflows/sbom.yml +++ b/.github/workflows/sbom.yml @@ -27,7 +27,7 @@ jobs: contents: read steps: - name: Harden runner - uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0 + uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1 with: egress-policy: audit - name: Checkout @@ -36,7 +36,7 @@ jobs: persist-credentials: false - name: Anchore SBOM Action (Syft) - uses: anchore/sbom-action@aa80c8c5bd439a416a62804f2151ab38c671a638 # v0.24.1 + uses: anchore/sbom-action@3ad7283483fc7af8ff2b4ea19663c2d5ca935e26 # v0.24.2 with: format: spdx-json output-file: feint.spdx.json @@ -52,7 +52,7 @@ jobs: contents: write # attach the SBOM to release assets steps: - name: Harden runner - uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0 + uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1 with: egress-policy: audit - name: Checkout @@ -61,7 +61,7 @@ jobs: persist-credentials: false - name: Anchore SBOM Action (Syft) - uses: anchore/sbom-action@aa80c8c5bd439a416a62804f2151ab38c671a638 # v0.24.1 + uses: anchore/sbom-action@3ad7283483fc7af8ff2b4ea19663c2d5ca935e26 # v0.24.2 with: format: spdx-json output-file: feint.spdx.json diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index c8ceec0..ac01d3d 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -30,7 +30,7 @@ jobs: actions: read steps: - name: Harden runner - uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0 + uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1 with: egress-policy: audit - name: Checkout diff --git a/.github/workflows/secrets.yml b/.github/workflows/secrets.yml index 5e56c52..fcc5ba0 100644 --- a/.github/workflows/secrets.yml +++ b/.github/workflows/secrets.yml @@ -20,7 +20,7 @@ jobs: contents: read steps: - name: Harden runner - uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0 + uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1 with: egress-policy: audit - name: Checkout diff --git a/.github/workflows/tap.yml b/.github/workflows/tap.yml index f540e85..734db9e 100644 --- a/.github/workflows/tap.yml +++ b/.github/workflows/tap.yml @@ -49,7 +49,7 @@ jobs: contents: read steps: - name: Harden the runner - uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0 + uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1 with: egress-policy: audit diff --git a/.github/workflows/unblock.yml b/.github/workflows/unblock.yml index 97ef37f..15721e4 100644 --- a/.github/workflows/unblock.yml +++ b/.github/workflows/unblock.yml @@ -38,7 +38,7 @@ jobs: issues: write # the sync adds and removes the blocked label steps: - name: Harden the runner - uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0 + uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1 with: egress-policy: audit diff --git a/.github/workflows/userns-probe.yml b/.github/workflows/userns-probe.yml index 0c8f78f..de38128 100644 --- a/.github/workflows/userns-probe.yml +++ b/.github/workflows/userns-probe.yml @@ -27,7 +27,7 @@ jobs: # records an empty list, which is the point — the probe touches only the # kernel's namespace machinery. - name: Harden the runner - uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0 + uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1 with: egress-policy: audit diff --git a/.github/workflows/workflow-security.yml b/.github/workflows/workflow-security.yml index 84fc6a4..d255ec7 100644 --- a/.github/workflows/workflow-security.yml +++ b/.github/workflows/workflow-security.yml @@ -47,7 +47,7 @@ jobs: # tampered with. `audit` records outbound calls without failing the run — # the recorded list is what a future `block` policy would be built from. - name: Harden the runner - uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0 + uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1 with: egress-policy: audit @@ -108,7 +108,7 @@ jobs: contents: read steps: - name: Harden the runner - uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0 + uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1 with: egress-policy: audit @@ -150,7 +150,7 @@ jobs: contents: read steps: - name: Harden the runner - uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0 + uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1 with: egress-policy: audit @@ -197,7 +197,7 @@ jobs: contents: read steps: - name: Harden the runner - uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0 + uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1 with: egress-policy: audit @@ -242,7 +242,7 @@ jobs: contents: read steps: - name: Harden the runner - uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0 + uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1 with: egress-policy: audit