diff --git a/.github/workflows/_build-cached.yml b/.github/workflows/_build-cached.yml index 67e2ce1e766..6feab26de03 100644 --- a/.github/workflows/_build-cached.yml +++ b/.github/workflows/_build-cached.yml @@ -28,7 +28,7 @@ jobs: valid-cache: ${{ steps.cache_deps.outputs.cache-hit }} steps: - name: Harden Runner - uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 + uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0 continue-on-error: true with: egress-policy: audit diff --git a/.github/workflows/_build-core.yml b/.github/workflows/_build-core.yml index 650a03102ea..514161b8f08 100644 --- a/.github/workflows/_build-core.yml +++ b/.github/workflows/_build-core.yml @@ -32,7 +32,7 @@ jobs: steps: - name: Harden Runner - uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 + uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0 continue-on-error: true with: egress-policy: audit @@ -98,7 +98,7 @@ jobs: # ── macOS ─────────────────────────────────────────────────────────────────── - name: Install cmake 3.31.x (macOS) if: runner.os == 'macOS' - uses: lukka/get-cmake@e6906078ebd1ccb8ce51ab4626ac46a1b5a517e3 # v4.4.0 + uses: lukka/get-cmake@fffaaafeea488556c2c12dad60690008bc1caacb # v4.4.2 with: cmakeVersion: "~3.31.0" useLocalCache: true @@ -223,7 +223,7 @@ jobs: # ── Windows ───────────────────────────────────────────────────────────────── - name: Install cmake 3.31.x (Windows) if: runner.os == 'Windows' - uses: lukka/get-cmake@e6906078ebd1ccb8ce51ab4626ac46a1b5a517e3 # v4.4.0 + uses: lukka/get-cmake@fffaaafeea488556c2c12dad60690008bc1caacb # v4.4.2 with: cmakeVersion: "~3.31.0" useLocalCache: true diff --git a/.github/workflows/_build-deps.yml b/.github/workflows/_build-deps.yml index 589712d2228..be9ecdf5c01 100644 --- a/.github/workflows/_build-deps.yml +++ b/.github/workflows/_build-deps.yml @@ -32,7 +32,7 @@ jobs: date: steps: - name: Harden Runner - uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 + uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0 with: egress-policy: audit @@ -54,7 +54,7 @@ jobs: - name: Install cmake 3.31.x (Windows) if: startsWith(inputs.os, 'windows-') - uses: lukka/get-cmake@e6906078ebd1ccb8ce51ab4626ac46a1b5a517e3 # v4.4.0 + uses: lukka/get-cmake@fffaaafeea488556c2c12dad60690008bc1caacb # v4.4.2 with: cmakeVersion: "~3.31.0" useLocalCache: true @@ -140,7 +140,7 @@ jobs: - name: Install cmake 3.31.x (macOS) if: startsWith(inputs.os, 'macos-') - uses: lukka/get-cmake@e6906078ebd1ccb8ce51ab4626ac46a1b5a517e3 # v4.4.0 + uses: lukka/get-cmake@fffaaafeea488556c2c12dad60690008bc1caacb # v4.4.2 with: cmakeVersion: "~3.31.0" useLocalCache: true diff --git a/.github/workflows/automation-ai-fix.yml b/.github/workflows/automation-ai-fix.yml index c6ae3b42441..d943b987998 100644 --- a/.github/workflows/automation-ai-fix.yml +++ b/.github/workflows/automation-ai-fix.yml @@ -20,7 +20,7 @@ jobs: steps: - name: Harden Runner - uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 + uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0 with: egress-policy: audit diff --git a/.github/workflows/automation-assign-project.yml b/.github/workflows/automation-assign-project.yml index 580cbd053af..455de585eac 100644 --- a/.github/workflows/automation-assign-project.yml +++ b/.github/workflows/automation-assign-project.yml @@ -23,7 +23,7 @@ jobs: if: github.event_name == 'issues' || github.event_name == 'pull_request_target' steps: - name: Harden Runner - uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 + uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0 with: egress-policy: block allowed-endpoints: | diff --git a/.github/workflows/automation-label-issues.yml b/.github/workflows/automation-label-issues.yml index 9722ff3ec46..9b9d798bd45 100644 --- a/.github/workflows/automation-label-issues.yml +++ b/.github/workflows/automation-label-issues.yml @@ -19,7 +19,7 @@ jobs: timeout-minutes: 10 steps: - name: Harden Runner - uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 + uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0 with: egress-policy: block allowed-endpoints: | diff --git a/.github/workflows/automation-label-prs.yml b/.github/workflows/automation-label-prs.yml index a9301bad438..eef0e0021e5 100644 --- a/.github/workflows/automation-label-prs.yml +++ b/.github/workflows/automation-label-prs.yml @@ -16,7 +16,7 @@ jobs: timeout-minutes: 10 steps: - name: Harden Runner - uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 + uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c with: egress-policy: block allowed-endpoints: | diff --git a/.github/workflows/cd-deploy-apt.yml b/.github/workflows/cd-deploy-apt.yml index 52161c72636..90be9b206ed 100644 --- a/.github/workflows/cd-deploy-apt.yml +++ b/.github/workflows/cd-deploy-apt.yml @@ -42,7 +42,7 @@ jobs: steps: - name: Harden Runner - uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 + uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0 with: egress-policy: audit diff --git a/.github/workflows/cd-deploy-aur.yml b/.github/workflows/cd-deploy-aur.yml index 3792da6f98a..e55423b854c 100644 --- a/.github/workflows/cd-deploy-aur.yml +++ b/.github/workflows/cd-deploy-aur.yml @@ -42,7 +42,7 @@ jobs: steps: - name: Harden Runner - uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 + uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0 with: egress-policy: audit diff --git a/.github/workflows/cd-deploy-copr.yml b/.github/workflows/cd-deploy-copr.yml index 0c0b7027110..23692635672 100644 --- a/.github/workflows/cd-deploy-copr.yml +++ b/.github/workflows/cd-deploy-copr.yml @@ -55,7 +55,7 @@ jobs: steps: - name: Harden Runner - uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 + uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0 with: egress-policy: audit diff --git a/.github/workflows/cd-deploy-flatpak.yml b/.github/workflows/cd-deploy-flatpak.yml index 520e4072d34..16b845fe2ac 100644 --- a/.github/workflows/cd-deploy-flatpak.yml +++ b/.github/workflows/cd-deploy-flatpak.yml @@ -29,7 +29,7 @@ jobs: steps: - name: Harden Runner - uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 + uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0 with: egress-policy: audit - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 diff --git a/.github/workflows/cd-deploy-homebrew.yml b/.github/workflows/cd-deploy-homebrew.yml index 2923c620a5f..1a9abcbf961 100644 --- a/.github/workflows/cd-deploy-homebrew.yml +++ b/.github/workflows/cd-deploy-homebrew.yml @@ -25,7 +25,7 @@ jobs: steps: - name: Harden Runner - uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 + uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0 with: # audit (not block) to match the other deploy workflows — block mode # rejected the checkout connection to github.com even though it was diff --git a/.github/workflows/cd-deploy-ppa.yml b/.github/workflows/cd-deploy-ppa.yml index 04a917d1360..7e9be15d5f9 100644 --- a/.github/workflows/cd-deploy-ppa.yml +++ b/.github/workflows/cd-deploy-ppa.yml @@ -63,7 +63,7 @@ jobs: steps: - name: Harden Runner - uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 + uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0 with: egress-policy: audit diff --git a/.github/workflows/cd-deploy-winget.yml b/.github/workflows/cd-deploy-winget.yml index 01b7b57ff20..d1fef463314 100644 --- a/.github/workflows/cd-deploy-winget.yml +++ b/.github/workflows/cd-deploy-winget.yml @@ -25,7 +25,7 @@ jobs: timeout-minutes: 15 steps: - name: Harden Runner - uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 + uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0 with: egress-policy: block allowed-endpoints: | diff --git a/.github/workflows/cd-nightly.yml b/.github/workflows/cd-nightly.yml index 459a1886f99..f57a9cfd714 100644 --- a/.github/workflows/cd-nightly.yml +++ b/.github/workflows/cd-nightly.yml @@ -26,7 +26,7 @@ jobs: has_changes: ${{ steps.check.outputs.has_changes }} steps: - name: Harden Runner - uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 + uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0 with: egress-policy: block allowed-endpoints: > @@ -179,7 +179,7 @@ jobs: steps: - name: Harden Runner - uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 + uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0 with: egress-policy: audit @@ -275,7 +275,7 @@ jobs: steps: - name: Harden Runner - uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 + uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0 with: egress-policy: audit @@ -350,7 +350,7 @@ jobs: - name: Generate SBOM if: steps.check.outputs.n > 0 - uses: anchore/sbom-action@e22c389904149dbc22b58101806040fa8d37a610 # v0.24.0 + uses: anchore/sbom-action@3ad7283483fc7af8ff2b4ea19663c2d5ca935e26 # v0.24.2 with: path: artifacts/ format: spdx-json @@ -363,7 +363,7 @@ jobs: - name: Attest build provenance if: steps.check.outputs.n > 0 - uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373 # v4.1.1 + uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2 with: subject-path: artifacts/** @@ -506,7 +506,7 @@ jobs: steps: - name: Harden Runner - uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 + uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0 with: egress-policy: audit diff --git a/.github/workflows/cd-packages.yml b/.github/workflows/cd-packages.yml index 9215976fda0..ef45c8501e4 100644 --- a/.github/workflows/cd-packages.yml +++ b/.github/workflows/cd-packages.yml @@ -62,7 +62,7 @@ jobs: steps: - name: Harden Runner - uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 + uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0 with: egress-policy: audit @@ -191,7 +191,7 @@ jobs: steps: - name: Harden Runner - uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 + uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0 with: egress-policy: audit @@ -261,7 +261,7 @@ jobs: steps: - name: Harden Runner - uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 + uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0 with: egress-policy: audit @@ -282,7 +282,7 @@ jobs: key: pkg-deps-arch-${{ hashFiles('deps/CMakeLists.txt', 'deps/**/*.cmake') }} - name: Install cmake 3.31.x (Arch) - uses: lukka/get-cmake@e6906078ebd1ccb8ce51ab4626ac46a1b5a517e3 # v4.4.0 + uses: lukka/get-cmake@fffaaafeea488556c2c12dad60690008bc1caacb # v4.4.2 with: cmakeVersion: "~3.31.0" useLocalCache: true diff --git a/.github/workflows/cd-release-candidate.yml b/.github/workflows/cd-release-candidate.yml index dfadda3bd43..d3aa2e62205 100644 --- a/.github/workflows/cd-release-candidate.yml +++ b/.github/workflows/cd-release-candidate.yml @@ -120,7 +120,7 @@ jobs: steps: - name: Harden Runner - uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 + uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0 with: egress-policy: audit @@ -211,7 +211,7 @@ jobs: steps: - name: Harden Runner - uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 + uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0 with: egress-policy: audit @@ -289,7 +289,7 @@ jobs: - name: Generate SBOM if: steps.check.outputs.n > 0 - uses: anchore/sbom-action@e22c389904149dbc22b58101806040fa8d37a610 # v0.24.0 + uses: anchore/sbom-action@3ad7283483fc7af8ff2b4ea19663c2d5ca935e26 # v0.24.2 with: path: artifacts/ format: spdx-json @@ -302,7 +302,7 @@ jobs: - name: Attest build provenance if: steps.check.outputs.n > 0 - uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373 # v4.1.1 + uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2 with: subject-path: artifacts/** @@ -390,7 +390,7 @@ jobs: steps: - name: Harden Runner - uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 + uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0 with: egress-policy: audit diff --git a/.github/workflows/cd-release.yml b/.github/workflows/cd-release.yml index dba9c921add..5d97f6b9bd8 100644 --- a/.github/workflows/cd-release.yml +++ b/.github/workflows/cd-release.yml @@ -32,7 +32,7 @@ jobs: steps: - name: Harden Runner - uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 + uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0 with: egress-policy: block allowed-endpoints: > @@ -77,7 +77,7 @@ jobs: steps: - name: Harden Runner - uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 + uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0 with: egress-policy: audit @@ -245,7 +245,7 @@ jobs: steps: - name: Harden Runner - uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 + uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0 with: egress-policy: audit @@ -279,7 +279,7 @@ jobs: run: find release-assets/ -type f | sort - name: Generate SBOM - uses: anchore/sbom-action@e22c389904149dbc22b58101806040fa8d37a610 # v0.24.0 + uses: anchore/sbom-action@3ad7283483fc7af8ff2b4ea19663c2d5ca935e26 # v0.24.2 with: path: release-assets/ format: spdx-json @@ -290,7 +290,7 @@ jobs: run: bash scripts/generate-checksums.sh release-assets/ - name: Attest build provenance - uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373 # v4.1.1 + uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2 with: subject-path: release-assets/** @@ -347,7 +347,7 @@ jobs: steps: - name: Harden Runner - uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 + uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0 with: egress-policy: audit @@ -398,7 +398,7 @@ jobs: steps: - name: Harden Runner - uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 + uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0 with: egress-policy: audit diff --git a/.github/workflows/ci-arch-container.yml b/.github/workflows/ci-arch-container.yml index 01784c294ac..634ae66b0b7 100644 --- a/.github/workflows/ci-arch-container.yml +++ b/.github/workflows/ci-arch-container.yml @@ -29,7 +29,7 @@ jobs: steps: - name: Harden Runner - uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 + uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0 with: egress-policy: audit @@ -37,10 +37,10 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Set up Docker Buildx - uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0 + uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0 - name: Log in to ghcr.io - uses: docker/login-action@abd2ef45e78c5afb21d64d4ca52ee8550d9572c7 # v4.5.1 + uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0 with: registry: ghcr.io username: ${{ github.actor }} diff --git a/.github/workflows/ci-debian-container.yml b/.github/workflows/ci-debian-container.yml index 3814ade8834..ce1150a9468 100644 --- a/.github/workflows/ci-debian-container.yml +++ b/.github/workflows/ci-debian-container.yml @@ -29,7 +29,7 @@ jobs: steps: - name: Harden Runner - uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 + uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0 with: egress-policy: audit @@ -37,10 +37,10 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Set up Docker Buildx - uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0 + uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0 - name: Log in to ghcr.io - uses: docker/login-action@abd2ef45e78c5afb21d64d4ca52ee8550d9572c7 # v4.5.1 + uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0 with: registry: ghcr.io username: ${{ github.actor }} diff --git a/.github/workflows/ci-fedora-container.yml b/.github/workflows/ci-fedora-container.yml index c2354162987..60a7be3e7b1 100644 --- a/.github/workflows/ci-fedora-container.yml +++ b/.github/workflows/ci-fedora-container.yml @@ -29,7 +29,7 @@ jobs: steps: - name: Harden Runner - uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 + uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0 with: egress-policy: audit @@ -37,10 +37,10 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Set up Docker Buildx - uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0 + uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0 - name: Log in to ghcr.io - uses: docker/login-action@abd2ef45e78c5afb21d64d4ca52ee8550d9572c7 # v4.5.1 + uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0 with: registry: ghcr.io username: ${{ github.actor }} diff --git a/.github/workflows/ci-lint.yml b/.github/workflows/ci-lint.yml index 1dd9bedfe1d..61a207d9bb8 100644 --- a/.github/workflows/ci-lint.yml +++ b/.github/workflows/ci-lint.yml @@ -24,7 +24,7 @@ jobs: steps: - name: Harden Runner - uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 + uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0 with: egress-policy: audit - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 diff --git a/.github/workflows/ci-pull-request.yml b/.github/workflows/ci-pull-request.yml index 07694e6c589..0c03a8cf217 100644 --- a/.github/workflows/ci-pull-request.yml +++ b/.github/workflows/ci-pull-request.yml @@ -28,7 +28,7 @@ jobs: code: ${{ steps.check.outputs.code }} steps: - name: Harden Runner - uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 + uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0 with: egress-policy: audit @@ -106,7 +106,7 @@ jobs: steps: - name: Harden Runner - uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 + uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0 with: egress-policy: audit @@ -167,7 +167,7 @@ jobs: steps: - name: Harden Runner - uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 + uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0 with: egress-policy: audit diff --git a/.github/workflows/maintenance-stale.yml b/.github/workflows/maintenance-stale.yml index aea7b985112..f715290d1d6 100644 --- a/.github/workflows/maintenance-stale.yml +++ b/.github/workflows/maintenance-stale.yml @@ -17,12 +17,12 @@ jobs: timeout-minutes: 10 steps: - name: Harden Runner - uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 + uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0 with: egress-policy: block allowed-endpoints: | api.github.com:443 - - uses: actions/stale@1e223db275d687790206a7acac4d1a11bd6fe629 # v10.4.0 + - uses: actions/stale@4391f3da665fdf50b6810c1a66712fb9ba21aa93 # v11.0.0 with: repo-token: ${{ secrets.GITHUB_TOKEN }} stale-issue-message: > diff --git a/.github/workflows/maintenance-upstream-sync.yml b/.github/workflows/maintenance-upstream-sync.yml index 4a9ccfd5e4a..9c15df17989 100644 --- a/.github/workflows/maintenance-upstream-sync.yml +++ b/.github/workflows/maintenance-upstream-sync.yml @@ -17,7 +17,7 @@ jobs: steps: - name: Harden Runner - uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 + uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0 with: egress-policy: audit diff --git a/.github/workflows/maintenance-version-bump.yml b/.github/workflows/maintenance-version-bump.yml index 946122de232..1be0c051531 100644 --- a/.github/workflows/maintenance-version-bump.yml +++ b/.github/workflows/maintenance-version-bump.yml @@ -29,7 +29,7 @@ jobs: steps: - name: Harden Runner - uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 + uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0 with: egress-policy: block allowed-endpoints: | diff --git a/.github/workflows/security-codeql.yml b/.github/workflows/security-codeql.yml index bd2adc74b8c..7e518cb07a8 100644 --- a/.github/workflows/security-codeql.yml +++ b/.github/workflows/security-codeql.yml @@ -39,7 +39,7 @@ jobs: steps: - name: Harden Runner - uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 + uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0 with: egress-policy: audit - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 @@ -47,7 +47,7 @@ jobs: submodules: false - name: Initialize CodeQL - uses: github/codeql-action/init@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3 + uses: github/codeql-action/init@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9 with: languages: ${{ matrix.language }} build-mode: manual @@ -80,6 +80,6 @@ jobs: --parallel 4 2>&1 | head -5000 || true - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3 + uses: github/codeql-action/analyze@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9 with: category: "/language:${{ matrix.language }}" diff --git a/.github/workflows/security-dependency-review.yml b/.github/workflows/security-dependency-review.yml index 831cc29da35..1943e8ae824 100644 --- a/.github/workflows/security-dependency-review.yml +++ b/.github/workflows/security-dependency-review.yml @@ -16,7 +16,7 @@ jobs: timeout-minutes: 10 steps: - name: Harden Runner - uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 + uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0 with: egress-policy: block # Use folded (>), NOT literal (|): harden-runner splits allowed-endpoints on diff --git a/.github/workflows/security-scorecard.yml b/.github/workflows/security-scorecard.yml index eb9b30371dc..bd42940180b 100644 --- a/.github/workflows/security-scorecard.yml +++ b/.github/workflows/security-scorecard.yml @@ -23,7 +23,7 @@ jobs: steps: - name: Harden Runner - uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 + uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0 with: # audit instead of block: scorecard-action runs in a Docker container # whose DNS (UDP) is blocked by egress-policy:block even for listed @@ -42,6 +42,6 @@ jobs: publish_results: true - name: Upload SARIF results - uses: github/codeql-action/upload-sarif@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3 + uses: github/codeql-action/upload-sarif@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9 with: sarif_file: results.sarif