From 38b6c706da1e73b07562a5c8225653688aa43682 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Thu, 17 Sep 2026 06:21:58 +0000 Subject: [PATCH] ci(deps): Bump the github-actions group with 3 updates Bumps the github-actions group with 3 updates: [step-security/harden-runner](https://github.com/step-security/harden-runner), [anchore/sbom-action](https://github.com/anchore/sbom-action) and [softprops/action-gh-release](https://github.com/softprops/action-gh-release). Updates `step-security/harden-runner` from 2.21.0 to 2.21.1 - [Release notes](https://github.com/step-security/harden-runner/releases) - [Commits](https://github.com/step-security/harden-runner/compare/05e31511f85b41b11d1cf0ef85d0992719546e2c...e14015d583714f6e62063499dc959a02595150a1) Updates `anchore/sbom-action` from 0.24.1 to 0.24.2 - [Release notes](https://github.com/anchore/sbom-action/releases) - [Changelog](https://github.com/anchore/sbom-action/blob/main/RELEASE.md) - [Commits](https://github.com/anchore/sbom-action/compare/aa80c8c5bd439a416a62804f2151ab38c671a638...3ad7283483fc7af8ff2b4ea19663c2d5ca935e26) Updates `softprops/action-gh-release` from 3.0.2 to 3.0.3 - [Release notes](https://github.com/softprops/action-gh-release/releases) - [Changelog](https://github.com/softprops/action-gh-release/blob/master/CHANGELOG.md) - [Commits](https://github.com/softprops/action-gh-release/compare/3d0d9888cb7fd7b750713d6e236d1fcb99157228...efb35369e0ad2afab669f228072c1b0d510eae64) --- updated-dependencies: - dependency-name: step-security/harden-runner dependency-version: 2.21.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: anchore/sbom-action dependency-version: 0.24.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: softprops/action-gh-release dependency-version: 3.0.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions ... Signed-off-by: dependabot[bot] --- .github/workflows/adoption-metrics.yml | 2 +- .github/workflows/codeql.yml | 2 +- .github/workflows/commits.yml | 2 +- .github/workflows/conformance.yml | 6 +++--- .github/workflows/corpus-cloud.yml | 4 ++-- .github/workflows/dependency-review.yml | 2 +- .github/workflows/drift.yml | 6 +++--- .github/workflows/falsify.yml | 2 +- .github/workflows/go.yml | 6 +++--- .github/workflows/night-report.yml | 2 +- .github/workflows/plumber.yml | 2 +- .github/workflows/release.yml | 12 ++++++------ .github/workflows/runtime-proof.yml | 8 ++++---- .github/workflows/sbom.yml | 8 ++++---- .github/workflows/scorecard.yml | 2 +- .github/workflows/secrets.yml | 2 +- .github/workflows/tap.yml | 2 +- .github/workflows/unblock.yml | 2 +- .github/workflows/userns-probe.yml | 2 +- .github/workflows/workflow-security.yml | 10 +++++----- 20 files changed, 42 insertions(+), 42 deletions(-) diff --git a/.github/workflows/adoption-metrics.yml b/.github/workflows/adoption-metrics.yml index 52c6153c..7850d782 100644 --- a/.github/workflows/adoption-metrics.yml +++ b/.github/workflows/adoption-metrics.yml @@ -41,7 +41,7 @@ jobs: contents: write steps: - name: Harden runner - uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0 + uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1 with: egress-policy: audit diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 678596dc..c632a767 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -22,7 +22,7 @@ jobs: security-events: write steps: - name: Harden runner - uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0 + uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1 with: egress-policy: audit - name: Checkout diff --git a/.github/workflows/commits.yml b/.github/workflows/commits.yml index 1c601dff..2eb202d9 100644 --- a/.github/workflows/commits.yml +++ b/.github/workflows/commits.yml @@ -31,7 +31,7 @@ jobs: contents: read steps: - name: Harden the runner - uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0 + uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1 with: egress-policy: audit diff --git a/.github/workflows/conformance.yml b/.github/workflows/conformance.yml index 74a20c34..6334c1f5 100644 --- a/.github/workflows/conformance.yml +++ b/.github/workflows/conformance.yml @@ -44,7 +44,7 @@ jobs: contents: read steps: - name: Harden runner - uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0 + uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1 with: egress-policy: audit - name: Checkout @@ -83,7 +83,7 @@ jobs: contents: read steps: - name: Harden runner - uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0 + uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1 with: egress-policy: audit - name: Checkout @@ -197,7 +197,7 @@ jobs: client: [scw-cli, terraform, opentofu, octl, exo-cli, probe, fields] steps: - name: Harden runner - uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0 + uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1 with: egress-policy: audit - name: Checkout diff --git a/.github/workflows/corpus-cloud.yml b/.github/workflows/corpus-cloud.yml index 9e284e32..2d23d70a 100644 --- a/.github/workflows/corpus-cloud.yml +++ b/.github/workflows/corpus-cloud.yml @@ -42,7 +42,7 @@ jobs: moved: ${{ steps.replay.outputs.moved }} steps: - name: Harden runner - uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0 + uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1 with: egress-policy: audit - name: Checkout @@ -187,7 +187,7 @@ jobs: pull-requests: write # open the PR steps: - name: Harden runner - uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0 + uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1 with: egress-policy: audit - name: Checkout diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml index 6a13ded4..c3abbf9c 100644 --- a/.github/workflows/dependency-review.yml +++ b/.github/workflows/dependency-review.yml @@ -17,7 +17,7 @@ jobs: contents: read steps: - name: Harden runner - uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0 + uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1 with: egress-policy: audit - name: Checkout diff --git a/.github/workflows/drift.yml b/.github/workflows/drift.yml index c771f8be..99b6492b 100644 --- a/.github/workflows/drift.yml +++ b/.github/workflows/drift.yml @@ -44,7 +44,7 @@ jobs: contracts: ${{ steps.contracts.outputs.changed }} steps: - name: Harden runner - uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0 + uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1 with: egress-policy: audit - name: Checkout @@ -222,7 +222,7 @@ jobs: pull-requests: write # open the PR steps: - name: Harden runner - uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0 + uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1 with: egress-policy: audit - name: Checkout @@ -331,7 +331,7 @@ jobs: issues: write steps: - name: Harden runner - uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0 + uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1 with: egress-policy: audit diff --git a/.github/workflows/falsify.yml b/.github/workflows/falsify.yml index b077fe4d..f15af547 100644 --- a/.github/workflows/falsify.yml +++ b/.github/workflows/falsify.yml @@ -56,7 +56,7 @@ jobs: contents: read steps: - name: Harden the runner - uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0 + uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1 with: egress-policy: audit diff --git a/.github/workflows/go.yml b/.github/workflows/go.yml index 0df5e980..c1d69ce1 100644 --- a/.github/workflows/go.yml +++ b/.github/workflows/go.yml @@ -20,7 +20,7 @@ jobs: contents: read steps: - name: Harden runner - uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0 + uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1 with: egress-policy: audit - name: Checkout @@ -172,7 +172,7 @@ jobs: contents: read steps: - name: Harden runner - uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0 + uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1 with: egress-policy: audit - name: Checkout @@ -230,7 +230,7 @@ jobs: # Linux only: the action installs an eBPF agent and is a no-op that # still costs a minute elsewhere. if: ${{ startsWith(matrix.runner, 'ubuntu') }} - uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0 + uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1 with: egress-policy: audit - name: Checkout diff --git a/.github/workflows/night-report.yml b/.github/workflows/night-report.yml index 000a04a7..38f959e7 100644 --- a/.github/workflows/night-report.yml +++ b/.github/workflows/night-report.yml @@ -59,7 +59,7 @@ jobs: issues: write # the issue itself steps: - name: Harden the runner - uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0 + uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1 with: egress-policy: audit diff --git a/.github/workflows/plumber.yml b/.github/workflows/plumber.yml index 2896d452..861db71c 100644 --- a/.github/workflows/plumber.yml +++ b/.github/workflows/plumber.yml @@ -46,7 +46,7 @@ jobs: id-token: write steps: - name: Harden the runner - uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0 + uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1 with: egress-policy: audit diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index dbcabc68..6b05845e 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -26,7 +26,7 @@ jobs: - { goos: darwin, goarch: arm64 } steps: - name: Harden runner - uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0 + uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1 with: egress-policy: audit - name: Checkout @@ -84,7 +84,7 @@ jobs: IMAGE: ghcr.io/${{ github.repository }} steps: - name: Harden runner - uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0 + uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1 with: egress-policy: audit - name: Checkout @@ -175,7 +175,7 @@ jobs: push-to-registry: true - name: Generate the image SBOM (Syft, CycloneDX) - uses: anchore/sbom-action@aa80c8c5bd439a416a62804f2151ab38c671a638 # v0.24.1 + uses: anchore/sbom-action@3ad7283483fc7af8ff2b4ea19663c2d5ca935e26 # v0.24.2 with: image: ${{ env.IMAGE }}@${{ steps.push.outputs.digest }} format: cyclonedx-json @@ -240,7 +240,7 @@ jobs: attestations: write # build attestation steps: - name: Harden runner - uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0 + uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1 with: egress-policy: audit - name: Checkout @@ -283,7 +283,7 @@ jobs: cat checksums.txt - name: Generate SBOM (Syft, CycloneDX) - uses: anchore/sbom-action@aa80c8c5bd439a416a62804f2151ab38c671a638 # v0.24.1 + uses: anchore/sbom-action@3ad7283483fc7af8ff2b4ea19663c2d5ca935e26 # v0.24.2 with: path: . format: cyclonedx-json @@ -372,7 +372,7 @@ jobs: } >> /tmp/notes.md - name: Create release with assets - uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3.0.2 + uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64 # v3.0.3 with: tag_name: ${{ github.ref_name }} name: ${{ github.ref_name }} diff --git a/.github/workflows/runtime-proof.yml b/.github/workflows/runtime-proof.yml index 6c084e91..003824e2 100644 --- a/.github/workflows/runtime-proof.yml +++ b/.github/workflows/runtime-proof.yml @@ -73,7 +73,7 @@ jobs: mode: [incus, incus-ovn] steps: - name: Harden the runner - uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0 + uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1 with: egress-policy: audit @@ -579,7 +579,7 @@ jobs: control: [false, true] steps: - name: Harden the runner - uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0 + uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1 with: egress-policy: audit @@ -894,7 +894,7 @@ jobs: contents: read steps: - name: Harden the runner - uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0 + uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1 with: egress-policy: audit @@ -964,7 +964,7 @@ jobs: contents: read steps: - name: Harden the runner - uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0 + uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1 with: egress-policy: audit diff --git a/.github/workflows/sbom.yml b/.github/workflows/sbom.yml index 867a9c1d..54ab9851 100644 --- a/.github/workflows/sbom.yml +++ b/.github/workflows/sbom.yml @@ -27,7 +27,7 @@ jobs: contents: read steps: - name: Harden runner - uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0 + uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1 with: egress-policy: audit - name: Checkout @@ -36,7 +36,7 @@ jobs: persist-credentials: false - name: Anchore SBOM Action (Syft) - uses: anchore/sbom-action@aa80c8c5bd439a416a62804f2151ab38c671a638 # v0.24.1 + uses: anchore/sbom-action@3ad7283483fc7af8ff2b4ea19663c2d5ca935e26 # v0.24.2 with: format: spdx-json output-file: feint.spdx.json @@ -52,7 +52,7 @@ jobs: contents: write # attach the SBOM to release assets steps: - name: Harden runner - uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0 + uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1 with: egress-policy: audit - name: Checkout @@ -61,7 +61,7 @@ jobs: persist-credentials: false - name: Anchore SBOM Action (Syft) - uses: anchore/sbom-action@aa80c8c5bd439a416a62804f2151ab38c671a638 # v0.24.1 + uses: anchore/sbom-action@3ad7283483fc7af8ff2b4ea19663c2d5ca935e26 # v0.24.2 with: format: spdx-json output-file: feint.spdx.json diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index c8ceec07..ac01d3da 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -30,7 +30,7 @@ jobs: actions: read steps: - name: Harden runner - uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0 + uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1 with: egress-policy: audit - name: Checkout diff --git a/.github/workflows/secrets.yml b/.github/workflows/secrets.yml index 5e56c527..fcc5ba07 100644 --- a/.github/workflows/secrets.yml +++ b/.github/workflows/secrets.yml @@ -20,7 +20,7 @@ jobs: contents: read steps: - name: Harden runner - uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0 + uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1 with: egress-policy: audit - name: Checkout diff --git a/.github/workflows/tap.yml b/.github/workflows/tap.yml index f540e85b..734db9ef 100644 --- a/.github/workflows/tap.yml +++ b/.github/workflows/tap.yml @@ -49,7 +49,7 @@ jobs: contents: read steps: - name: Harden the runner - uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0 + uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1 with: egress-policy: audit diff --git a/.github/workflows/unblock.yml b/.github/workflows/unblock.yml index 97ef37f1..15721e41 100644 --- a/.github/workflows/unblock.yml +++ b/.github/workflows/unblock.yml @@ -38,7 +38,7 @@ jobs: issues: write # the sync adds and removes the blocked label steps: - name: Harden the runner - uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0 + uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1 with: egress-policy: audit diff --git a/.github/workflows/userns-probe.yml b/.github/workflows/userns-probe.yml index 0c8f78f4..de38128a 100644 --- a/.github/workflows/userns-probe.yml +++ b/.github/workflows/userns-probe.yml @@ -27,7 +27,7 @@ jobs: # records an empty list, which is the point — the probe touches only the # kernel's namespace machinery. - name: Harden the runner - uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0 + uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1 with: egress-policy: audit diff --git a/.github/workflows/workflow-security.yml b/.github/workflows/workflow-security.yml index 84fc6a49..d255ec73 100644 --- a/.github/workflows/workflow-security.yml +++ b/.github/workflows/workflow-security.yml @@ -47,7 +47,7 @@ jobs: # tampered with. `audit` records outbound calls without failing the run — # the recorded list is what a future `block` policy would be built from. - name: Harden the runner - uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0 + uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1 with: egress-policy: audit @@ -108,7 +108,7 @@ jobs: contents: read steps: - name: Harden the runner - uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0 + uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1 with: egress-policy: audit @@ -150,7 +150,7 @@ jobs: contents: read steps: - name: Harden the runner - uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0 + uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1 with: egress-policy: audit @@ -197,7 +197,7 @@ jobs: contents: read steps: - name: Harden the runner - uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0 + uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1 with: egress-policy: audit @@ -242,7 +242,7 @@ jobs: contents: read steps: - name: Harden the runner - uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0 + uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1 with: egress-policy: audit