chore(ci): bump huntridge-labs/argus/.github/workflows/reusable-security-hardening.yml from 1.12.7 to 1.12.8

[dependabot]

Bumps huntridge-labs/argus/.github/workflows/reusable-security-hardening.yml from 1.12.7 to 1.12.8.

Release notes

Sourced from huntridge-labs/argus/.github/workflows/reusable-security-hardening.yml's releases.

Release 1.12.8

1.12.8 (2026-10-05)

Bug Fixes

• cli: apply per-scanner path and keep locations repo-relative (#459) (d3c20f4), closes #458
• deps: remove all pnpm overrides; don't force versions tools don't declare (#452) (bb568f6)
• scanners: pass native config and ignore files to the tool (#457) (7d01d61)

Maintenance

• deps: bump node (#460) (5deab88)
• deps: bump the pip-all group with 2 updates (#461) (6eda535)

Changelog

Sourced from huntridge-labs/argus/.github/workflows/reusable-security-hardening.yml's changelog.

Changelog

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

1.12.8 (2026-10-05)

Bug Fixes

• cli: apply per-scanner path and keep locations repo-relative (#459) (d3c20f4), closes #458
• deps: remove all pnpm overrides; don't force versions tools don't declare (#452) (bb568f6)
• scanners: pass native config and ignore files to the tool (#457) (7d01d61)

Dependencies

• deps: bump node (#460) (5deab88)
• deps: bump the pip-all group with 2 updates (#461) (6eda535)

1.12.7 (2026-10-01)

Bug Fixes

• core: apply each tool's ignore file to that tool only (#447) (9105252)
• deps: raise fast-uri and js-yaml override floors (#442) (01ac364)
• deps: raise fast-uri, ip-address and undici override floors (#445) (bb6aced)
• examples: pin third-party actions; annotate Argus self-references (#444) (9f57eda)
• security: only open https URLs in enrichment and tool-currency fetches (#443) (2d6d0f2)

Security Tools

• deps: update grype, syft, checkov and terraform pins (#450) (3f52427), references #449 #448

Dependencies

• deps: bump the docker-all group across 1 directory with 2 updates (#451) (1779318)
• deps: bump the npm-minor-patch group across 1 directory with 3 updates (#438) (0c231fa)
• deps: Update github-actions-minor-patch (#435) (98456e0)
• deps: update python-slugify requirement (#440) (a50e85b)

Continuous Integration

• pre-commit: enforce hooks in CI; local hook checks staged files only (#441) (514fd0b)

1.12.6 (2026-09-22)

... (truncated)

Commits

• cf54e58 chore(release): 1.12.8
• 6eda535 chore(deps): bump the pip-all group with 2 updates (#461)
• 5deab88 chore(deps): bump node (#460)
• d3c20f4 fix(cli): apply per-scanner path and keep locations repo-relative (#459)
• 7d01d61 fix(scanners): pass native config and ignore files to the tool (#457)
• bb568f6 fix(deps): remove all pnpm overrides; don't force versions tools don't declar...
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Labels

The following labels could not be found: github-actions. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[github-actions]

🛡️ Security Hardening Pipeline Results

Branch: dependabot/github_actions/beta/huntridge-labs/argus/dot-github/workflows/reusable-security-hardening.yml-1.12.8
Commit: 4eaaf3b

Workflow Run: 557
Branch: dependabot/github_actions/beta/huntridge-labs/argus/dot-github/workflows/reusable-security-hardening.yml-1.12.8
Commit: 4eaaf3b

Scan Status

Scanner	Status
bandit	⏭️ skipped
checkov	⏭️ skipped
clamav	⏭️ skipped
codeql	✅ PASS
container	⏭️ skipped
dependency-review	✅ PASS
gitleaks	✅ PASS
grype	⏭️ skipped
lint	⏭️ skipped
opengrep	⏭️ skipped
osv	✅ PASS
sbom	⏭️ skipped
supply-chain	⏭️ skipped
trivy-container	⏭️ skipped
trivy-iac	⏭️ skipped
zap	⏭️ skipped

✅ All enabled scanners completed successfully.

Summaries Collected: 4

Scanner Results

🔬 CodeQL SAST (Javascript)

Status: Completed

Findings Summary

Critical	High	Medium	Low	Total
0	0	0	0	0

No security findings detected for Javascript.

Artifacts: CodeQL Reports (Javascript)

🔗 Dependency Review

Status: ✅ No issues found

No vulnerable or license-violating dependencies detected in this PR.
📋 View full report

🔑 Gitleaks (Secrets)

No 🔑 Gitleaks (Secrets) findings summary was produced.

📦 OSV (Dependencies)

No 📦 OSV (Dependencies) findings summary was produced.

---

Generated by Argus

---

Generated by Argus