Updated markdown displayed in the job summary by the Harden-Runner Action.
Fixed a bug affecting Enterprise Tier customers where the agent attempted to upload telemetry for jobs with disable-telemetry set to true. No telemetry was uploaded as the endpoint was not in the allowed list.
Enterprise Tier - Telemetry Upload Enhancement:
For the enterprise tier, this change helps overcome size constraints, allowing for more reliable telemetry uploads from the Harden-Runner agent to the StepSecurity backend API. No configuration change is needed to enable this.
Harden-Runner Agent Authentication:
The Harden-Runner agent now uses a per-job key to authenticate to the StepSecurity backend API to submit telemetry. This change prevents the submission of telemetry data anonymously for a given job, improving the integrity of the data collection process. No configuration change is needed to enable this.
README Update:
A Table of Contents has been added to the README file to improve navigation. This makes it easier for users to find the information they need quickly.
Dependency Update:
Updated the braces npm package dependency to a non-vulnerable version. The vulnerability in braces did not affect the Harden Runner Action
Bug fix: Update isGitHubHosted implementation by @varunsh-coder in step-security/harden-runner#425
The previous implementation incorrectly identified large GitHub-hosted runners as self-hosted runners. As a result, harden-runner was not executing on these large GitHub-hosted runners.
See the releases page for the relevant changes to the CodeQL CLI and language packs.
Note that the only difference between v2 and v3 of the CodeQL Action is the node version they support, with v3 running on node 20 while we continue to release v2 to support running on node 16. For example 3.22.11 was the first v3 release and is functionally identical to 2.22.11. This approach ensures an easy way to track exactly which features are included in different versions, indicated by the minor and patch version numbers.
[UNRELEASED]
No user facing changes.
3.26.3 - 19 Aug 2024
Fix an issue where the CodeQL Action could not write diagnostic messages on Windows. This issue did not impact analysis quality. #2430
3.26.2 - 14 Aug 2024
Update default CodeQL bundle version to 2.18.2. #2417
3.26.1 - 13 Aug 2024
No user facing changes.
3.26.0 - 06 Aug 2024
Deprecation: Swift analysis on Ubuntu runner images is no longer supported. Please migrate to a macOS runner if this affects you. #2403
Bump the minimum CodeQL bundle version to 2.13.5. #2408
3.25.15 - 26 Jul 2024
Update default CodeQL bundle version to 2.18.1. #2385
3.25.14 - 25 Jul 2024
Experimental: add a new start-proxy action which starts the same HTTP proxy as used by github/dependabot-action. Do not use this in production as it is part of an internal experiment and subject to change at any time. #2376
Add a deprecation warning for customers using CodeQL version 2.13.4 and earlier. These versions of CodeQL were discontinued on 9 July 2024 alongside GitHub Enterprise Server 3.9, and will be unsupported by CodeQL Action versions 3.26.0 and later and versions 2.26.0 and later. #2375
If you are using one of these versions, please update to CodeQL CLI version 2.13.5 or later. For instance, if you have specified a custom version of the CLI using the 'tools' input to the 'init' Action, you can remove this input to use the default version.
Alternatively, if you want to continue using a version of the CodeQL CLI between 2.12.6 and 2.13.4, you can replace github/codeql-action/*@v3 by github/codeql-action/*@v3.25.13 and github/codeql-action/*@v2 by github/codeql-action/*@v2.25.13 in your code scanning workflow to ensure you continue using this version of the CodeQL Action.
3.25.12 - 12 Jul 2024
Improve the reliability and performance of analyzing code when analyzing a compiled language with the autobuildbuild mode on GitHub Enterprise Server. This feature is already available to GitHub.com users. #2353
Update default CodeQL bundle version to 2.18.0. #2364
3.25.11 - 28 Jun 2024
Avoid failing the workflow run if there is an error while uploading debug artifacts. #2349
... (truncated)
Commits
883d858 Merge pull request #2431 from github/update-v3.26.3-b187c86ce
This PR is a significant refactor of SPDX expression parsing that may fix some bugs, but unfortunately there are several related known issues that remain unresolved as of this version.
This update bumps the Scorecard version to the v5 release. For a complete list of changes, please refer to the v5.0.0 release notes. Of special note to Scorecard Action is the Maintainer Annotation feature, which can be used to suppress some Code Scanning false positives. Alerts will not be generated for any Scorecard Check with an annotation.
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
- `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
- `@dependabot ignore minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
- `@dependabot ignore ` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore ` will remove all of the ignore conditions of the specified dependency
- `@dependabot unignore ` will remove the ignore condition of the specified dependency and ignore conditions
Bumps the github-actions-all group with 6 updates in the / directory:
2.8.0
2.9.1
4.1.6
4.1.7
3.25.6
3.26.3
4.3.2
4.3.4
2.3.3
2.4.0
4.3.3
4.3.6
Updates
step-security/harden-runner
from 2.8.0 to 2.9.1Release notes
Sourced from step-security/harden-runner's releases.
Commits
5c7944e
Merge pull request #440 from step-security/rc-11c79be45
Merge branch 'main' into rc-11deb3383
Merge pull request #446 from h0x0er/log-step23c8215
update dist727d06a
logging stepf0db2aa
Merge pull request #441 from step-security/dependabot/github_actions/github/c...1938ffc
Merge branch 'main' into dependabot/github_actions/github/codeql-action-3.25.138e7dd2c
Merge pull request #442 from step-security/dependabot/github_actions/step-sec...f2823ee
Bump step-security/publish-unit-test-result-action from 1 to 25f95e05
Bump github/codeql-action from 2.13.4 to 3.25.13Updates
actions/checkout
from 4.1.6 to 4.1.7Release notes
Sourced from actions/checkout's releases.
Changelog
Sourced from actions/checkout's changelog.
... (truncated)
Commits
692973e
Prepare 4.1.7 release (#1775)6ccd57f
Pin actions/checkout's own workflows to a known, good, stable version. (#1776)b17fe1e
Handle hidden refs (#1774)b80ff79
Bump actions/checkout from 3 to 4 (#1697)b1ec302
Bump the minor-npm-dependencies group across 1 directory with 4 updates (#1739)Updates
github/codeql-action
from 3.25.6 to 3.26.3Changelog
Sourced from github/codeql-action's changelog.
... (truncated)
Commits
883d858
Merge pull request #2431 from github/update-v3.26.3-b187c86cee100ceb
Update changelog for v3.26.3b187c86
Merge pull request #2430 from github/henrymercer/windows-diagnostics-fixe2bb5a2
Add changelog notee5a6587
Fix writing diagnostics on Windows5c681ef
Merge pull request #2426 from github/mergeback/v3.26.2-to-main-429e1977676519a
Update checked-in dependencies25a5b8f
Update changelog and version after v3.26.2429e197
Merge pull request #2425 from github/update-v3.26.2-a93f8c2fd9eec338
Update changelog for v3.26.2Updates
actions/dependency-review-action
from 4.3.2 to 4.3.4Release notes
Sourced from actions/dependency-review-action's releases.
Commits
5a2ce3f
Merge pull request #791 from actions/juxtin/update-versionac6a6ad
Prepare even more for v4.3.43e2b917
Merge pull request #790 from actions/juxtin/update-versiond9ab9c8
Update version in package.json8c152c7
Merge pull request #769 from actions/dependabot/npm_and_yarn/zod-3.23.80085d30
Update dist08b5bf2
Bump zod from 3.22.4 to 3.23.8986fce9
Merge pull request #784 from actions/dependabot/npm_and_yarn/got-14.4.128743f8
Merge pull request #719 from actions/change-spdx-parserd6f34c3
Merge pull request #789 from actions/dependabot/npm_and_yarn/braces-3.0.3Updates
ossf/scorecard-action
from 2.3.3 to 2.4.0Release notes
Sourced from ossf/scorecard-action's releases.
Commits
62b2cac
bump docker tag to v2.4.0 for release (#1414)c09630c
lower license score alert threshold to 9 (#1411)cf8594c
:seedling: Bump github.com/sigstore/cosign/v2 from 2.2.4 to 2.3.0 (#1413)de5fcb9
:seedling: Bump the github-actions group with 2 updates (#1412)a46b90b
bump scorecard to v5.0.0 release (#1410)9fc518d
:seedling: Bump golang in the docker-images group (#1407)a8eaa1b
:seedling: Bump the github-actions group with 2 updates (#1408)873d5fd
:seedling: Bump the github-actions group across 1 directory with 2 updates (#...54cc1fe
:seedling: Bump the docker-images group with 2 updates (#1401)82bcb91
:seedling: Bump golang.org/x/net from 0.26.0 to 0.27.0 (#1400)Updates
actions/upload-artifact
from 4.3.3 to 4.3.6Release notes
Sourced from actions/upload-artifact's releases.
Commits
834a144
Merge pull request #594 from actions/robherley/4.3.6134dcf3
v4.3.673a0b9c
revert back to@actions/artifact
2.1.889ef406
Merge pull request #588 from actions/robherley/4.3.523d796d
license updatese445c64
bump@actions/artifact
to v2.1.90b2256b
Merge pull request #584 from actions/robherley/bump-pkgs488dcef
licensed cache04c51f5
ncc32a9e27
bump@actions/artifact
and npm auditDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase
.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show