From e86e5d4e99902e04d7b36cda908c686bae1dc449 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Fri, 23 Oct 2026 23:57:27 +0000 Subject: [PATCH] chore(deps): bump the github-actions-dependencies group with 7 updates Bumps the github-actions-dependencies group with 7 updates: | Package | From | To | | --- | --- | --- | | [step-security/harden-runner](https://github.com/step-security/harden-runner) | `2.21.1` | `2.22.1` | | [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) | `10.2.0` | `10.3.0` | | [github/codeql-action/upload-sarif](https://github.com/github/codeql-action) | `4.38.2` | `4.39.0` | | [soldevelo/infrascan](https://github.com/soldevelo/infrascan) | `1.2.0` | `1.2.3` | | [actions/upload-artifact](https://github.com/actions/upload-artifact) | `7.0.1` | `7.0.2` | | [ossf/scorecard-action](https://github.com/ossf/scorecard-action) | `2.4.4` | `2.5.0` | | [zizmorcore/zizmor-action](https://github.com/zizmorcore/zizmor-action) | `0.6.4` | `0.7.1` | Updates `step-security/harden-runner` from 2.21.1 to 2.22.1 - [Release notes](https://github.com/step-security/harden-runner/releases) - [Commits](https://github.com/step-security/harden-runner/compare/e14015d583714f6e62063499dc959a02595150a1...ccd8616d44fd3846e67624a50d5aad6d37bf2d25) Updates `astral-sh/setup-uv` from 10.2.0 to 10.3.0 - [Release notes](https://github.com/astral-sh/setup-uv/releases) - [Commits](https://github.com/astral-sh/setup-uv/compare/c18668ad3cf93ea998bef934396af7bb5c839dc7...1c37ad07a6a961277cf70c0d37d6f313000f5884) Updates `github/codeql-action/upload-sarif` from 4.38.2 to 4.39.0 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2...6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee) Updates `soldevelo/infrascan` from 1.2.0 to 1.2.3 - [Release notes](https://github.com/soldevelo/infrascan/releases) - [Changelog](https://github.com/SolDevelo/InfraScan/blob/main/docs/RELEASE_NOTES_1.2.1.md) - [Commits](https://github.com/soldevelo/infrascan/compare/7b56a90270606fa298aec4c82a93d0cd99f5d454...6c42c00e26dd7929674f1ef941ef66198c11190d) Updates `actions/upload-artifact` from 7.0.1 to 7.0.2 - [Release notes](https://github.com/actions/upload-artifact/releases) - [Commits](https://github.com/actions/upload-artifact/compare/043fb46d1a93c77aae656e7c1c64a875d1fc6a0a...cf430e030ddbb5b0abf93d22962f4752f3646cd9) Updates `ossf/scorecard-action` from 2.4.4 to 2.5.0 - [Release notes](https://github.com/ossf/scorecard-action/releases) - [Changelog](https://github.com/ossf/scorecard-action/blob/main/RELEASE.md) - [Commits](https://github.com/ossf/scorecard-action/compare/2d1146689b8cda280b9bc96326124645441f03bc...fa7117db83c52d787ae5a89f350999701505d78e) Updates `zizmorcore/zizmor-action` from 0.6.4 to 0.7.1 - [Release notes](https://github.com/zizmorcore/zizmor-action/releases) - [Commits](https://github.com/zizmorcore/zizmor-action/compare/cc914d7f3750a2d13d75c7f184a1060aa0e9d482...85b2b9fb8e3325e7a23d7d0a9d7ba5ae0f999e3e) --- updated-dependencies: - dependency-name: step-security/harden-runner dependency-version: 2.22.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions-dependencies - dependency-name: astral-sh/setup-uv dependency-version: 10.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions-dependencies - dependency-name: github/codeql-action/upload-sarif dependency-version: 4.39.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions-dependencies - dependency-name: soldevelo/infrascan dependency-version: 1.2.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions-dependencies - dependency-name: actions/upload-artifact dependency-version: 7.0.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions-dependencies - dependency-name: ossf/scorecard-action dependency-version: 2.5.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions-dependencies - dependency-name: zizmorcore/zizmor-action dependency-version: 0.7.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions-dependencies ... Signed-off-by: dependabot[bot] --- .github/workflows/cflite_build.yml | 2 +- .github/workflows/cflite_pr.yml | 2 +- .github/workflows/dependency-review.yml | 2 +- .github/workflows/docs-pages.yml | 8 ++++---- .github/workflows/iac-policy.yml | 10 +++++----- .github/workflows/infrascan-security-audit.yml | 6 +++--- .github/workflows/lambda-tests.yml | 6 +++--- .github/workflows/ministack-smoke.yml | 4 ++-- .github/workflows/ossf-scorecard.yml | 8 ++++---- .github/workflows/pre-commit.yml | 2 +- .github/workflows/quality-gates.yml | 8 ++++---- .github/workflows/release.yml | 2 +- .github/workflows/semantic-check.yml | 2 +- .github/workflows/zizmor.yml | 2 +- 14 files changed, 32 insertions(+), 32 deletions(-) diff --git a/.github/workflows/cflite_build.yml b/.github/workflows/cflite_build.yml index 8a5316345..5366f02d8 100644 --- a/.github/workflows/cflite_build.yml +++ b/.github/workflows/cflite_build.yml @@ -33,7 +33,7 @@ jobs: - address steps: - name: Harden the runner (Audit all outbound calls) - uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1 + uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25 # v2.22.1 with: egress-policy: audit diff --git a/.github/workflows/cflite_pr.yml b/.github/workflows/cflite_pr.yml index 9191beebc..4424b3fe9 100644 --- a/.github/workflows/cflite_pr.yml +++ b/.github/workflows/cflite_pr.yml @@ -38,7 +38,7 @@ jobs: - address steps: - name: Harden the runner (Audit all outbound calls) - uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1 + uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25 # v2.22.1 with: egress-policy: audit diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml index f8b002e25..d91f0e5ba 100644 --- a/.github/workflows/dependency-review.yml +++ b/.github/workflows/dependency-review.yml @@ -23,7 +23,7 @@ jobs: pull-requests: write # Required to publish the dependency review summary comment. steps: - name: Harden the runner (Audit all outbound calls) - uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1 + uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25 # v2.22.1 with: egress-policy: audit diff --git a/.github/workflows/docs-pages.yml b/.github/workflows/docs-pages.yml index 2a48f466c..cc0ba62e5 100644 --- a/.github/workflows/docs-pages.yml +++ b/.github/workflows/docs-pages.yml @@ -38,7 +38,7 @@ jobs: contents: read # Required to checkout repository content. steps: - name: Harden the runner - uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1 + uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25 # v2.22.1 with: egress-policy: audit @@ -53,7 +53,7 @@ jobs: python-version: '3.12' - name: Set up uv - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0 + uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0 with: version: 0.12.7 @@ -69,7 +69,7 @@ jobs: pages: write # Required to upload the GitHub Pages artifact. steps: - name: Harden the runner - uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1 + uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25 # v2.22.1 with: egress-policy: audit @@ -84,7 +84,7 @@ jobs: python-version: '3.12' - name: Set up uv - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0 + uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0 with: version: 0.12.7 diff --git a/.github/workflows/iac-policy.yml b/.github/workflows/iac-policy.yml index ec9c1569d..9290f24c2 100644 --- a/.github/workflows/iac-policy.yml +++ b/.github/workflows/iac-policy.yml @@ -57,7 +57,7 @@ jobs: pull-requests: write # Required to publish summaries back to pull requests. steps: - name: Harden the runner (Audit all outbound calls) - uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1 + uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25 # v2.22.1 with: egress-policy: audit @@ -72,7 +72,7 @@ jobs: python-version: '3.12' - name: Set up uv - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0 + uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0 with: version: 0.12.7 @@ -291,7 +291,7 @@ jobs: pull-requests: write # Required to publish summaries back to pull requests. steps: - name: Harden the runner (Audit all outbound calls) - uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1 + uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25 # v2.22.1 with: egress-policy: audit @@ -351,7 +351,7 @@ jobs: security-events: write # Required to upload Checkov SARIF to code scanning. steps: - name: Harden the runner (Audit all outbound calls) - uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1 + uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25 # v2.22.1 with: egress-policy: audit @@ -384,6 +384,6 @@ jobs: - name: Upload Checkov SARIF if: always() continue-on-error: true - uses: github/codeql-action/upload-sarif@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2 + uses: github/codeql-action/upload-sarif@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0 with: sarif_file: results.sarif diff --git a/.github/workflows/infrascan-security-audit.yml b/.github/workflows/infrascan-security-audit.yml index a93159160..2b2f68d4a 100644 --- a/.github/workflows/infrascan-security-audit.yml +++ b/.github/workflows/infrascan-security-audit.yml @@ -26,7 +26,7 @@ jobs: contents: read # Required to checkout repository content for scanning. steps: - name: Harden the runner (Audit all outbound calls) - uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1 + uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25 # v2.22.1 with: egress-policy: audit @@ -52,7 +52,7 @@ jobs: ./ .infrascan-src/ - name: Run InfraScan - uses: soldevelo/infrascan@7b56a90270606fa298aec4c82a93d0cd99f5d454 # v1.2.0 + uses: soldevelo/infrascan@6c42c00e26dd7929674f1ef941ef66198c11190d # v1.2.3 with: directory: .infrascan-src scanner: comprehensive @@ -61,7 +61,7 @@ jobs: fail-on: high_critical - name: Upload HTML report - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 if: always() with: name: infrascan-report diff --git a/.github/workflows/lambda-tests.yml b/.github/workflows/lambda-tests.yml index 4fa40d39b..1920c98b5 100644 --- a/.github/workflows/lambda-tests.yml +++ b/.github/workflows/lambda-tests.yml @@ -49,7 +49,7 @@ jobs: pull-requests: write # Required to publish summaries back to pull requests. steps: - name: Harden the runner (Audit all outbound calls) - uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1 + uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25 # v2.22.1 with: egress-policy: audit @@ -65,7 +65,7 @@ jobs: python-version: '3.12' - name: Set up uv - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0 + uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0 with: version: 0.12.7 @@ -88,7 +88,7 @@ jobs: - name: Upload coverage if: always() - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: lambda-test-results path: | diff --git a/.github/workflows/ministack-smoke.yml b/.github/workflows/ministack-smoke.yml index 171a1600b..277ab0715 100644 --- a/.github/workflows/ministack-smoke.yml +++ b/.github/workflows/ministack-smoke.yml @@ -50,7 +50,7 @@ jobs: MINISTACK_IMAGE: ministackorg/ministack:1.3.72-full@sha256:fda44c46c4cec06cd6774ce794eb68d5ab7e57a2ecb731fe7e7dda37fc2486be steps: - name: Harden the runner (Audit all outbound calls) - uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1 + uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25 # v2.22.1 with: egress-policy: audit @@ -65,7 +65,7 @@ jobs: python-version: '3.12' - name: Set up uv - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0 + uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0 with: version: 0.12.7 diff --git a/.github/workflows/ossf-scorecard.yml b/.github/workflows/ossf-scorecard.yml index fac59e1da..fb59dc854 100644 --- a/.github/workflows/ossf-scorecard.yml +++ b/.github/workflows/ossf-scorecard.yml @@ -30,7 +30,7 @@ jobs: security-events: write # Required to upload Scorecard SARIF results to code scanning. steps: - name: Harden the runner (Audit all outbound calls) - uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1 + uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25 # v2.22.1 with: egress-policy: audit @@ -40,20 +40,20 @@ jobs: persist-credentials: false - name: Run analysis - uses: ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc # v2.4.4 + uses: ossf/scorecard-action@fa7117db83c52d787ae5a89f350999701505d78e # v2.5.0 with: publish_results: true results_file: results.sarif results_format: sarif - name: Upload artifact - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: SARIF file path: results.sarif retention-days: 5 - name: Upload to code-scanning - uses: github/codeql-action/upload-sarif@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2 + uses: github/codeql-action/upload-sarif@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0 with: sarif_file: results.sarif diff --git a/.github/workflows/pre-commit.yml b/.github/workflows/pre-commit.yml index 0b9f3c299..e9aadc1e0 100644 --- a/.github/workflows/pre-commit.yml +++ b/.github/workflows/pre-commit.yml @@ -67,7 +67,7 @@ jobs: - name: Upload pre-commit log if: failure() - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: pre-commit-log path: pre-commit.log diff --git a/.github/workflows/quality-gates.yml b/.github/workflows/quality-gates.yml index 60e93fa07..212fe7b26 100644 --- a/.github/workflows/quality-gates.yml +++ b/.github/workflows/quality-gates.yml @@ -75,7 +75,7 @@ jobs: pull-requests: write # Required to publish summaries back to pull requests. steps: - name: Harden the runner (Audit all outbound calls) - uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1 + uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25 # v2.22.1 with: egress-policy: audit @@ -90,7 +90,7 @@ jobs: python-version: '3.12' - name: Set up uv - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0 + uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0 with: version: 0.12.7 @@ -123,7 +123,7 @@ jobs: pull-requests: write # Required to publish summaries back to pull requests. steps: - name: Harden the runner (Audit all outbound calls) - uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1 + uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25 # v2.22.1 with: egress-policy: audit @@ -138,7 +138,7 @@ jobs: python-version: '3.12' - name: Set up uv - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0 + uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0 with: version: 0.12.7 diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 380c7e99b..3d7c3b733 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -26,7 +26,7 @@ jobs: environment: release steps: - name: Harden the runner (Audit all outbound calls) - uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1 + uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25 # v2.22.1 with: egress-policy: audit diff --git a/.github/workflows/semantic-check.yml b/.github/workflows/semantic-check.yml index d3c1bf381..93606ce57 100644 --- a/.github/workflows/semantic-check.yml +++ b/.github/workflows/semantic-check.yml @@ -25,7 +25,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Harden the runner (Audit all outbound calls) - uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1 + uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25 # v2.22.1 with: egress-policy: audit diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml index 93f667169..23f1f7a10 100644 --- a/.github/workflows/zizmor.yml +++ b/.github/workflows/zizmor.yml @@ -34,6 +34,6 @@ jobs: persist-credentials: false - name: Run zizmor - uses: zizmorcore/zizmor-action@cc914d7f3750a2d13d75c7f184a1060aa0e9d482 # v0.6.4 + uses: zizmorcore/zizmor-action@85b2b9fb8e3325e7a23d7d0a9d7ba5ae0f999e3e # v0.7.1 with: persona: pedantic