Bug fix: Update isGitHubHosted implementation by @varunsh-coder in step-security/harden-runner#425
The previous implementation incorrectly identified large GitHub-hosted runners as self-hosted runners. As a result, harden-runner was not executing on these large GitHub-hosted runners.
This PR is a significant refactor of SPDX expression parsing that may fix some bugs, but unfortunately there are several related known issues that remain unresolved as of this version.
fix(ci): update all failing workflows by @mayeut in actions/setup-python#863
This update ensures compatibility and optimal performance of workflows on the latest macOS version.
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
- `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
- `@dependabot ignore minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
- `@dependabot ignore ` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore ` will remove all of the ignore conditions of the specified dependency
- `@dependabot unignore ` will remove the ignore condition of the specified dependency and ignore conditions
Bumps the action-packages group with 7 updates in the / directory:
5
6
4.44.1
4.44.2
2.8.0
2.8.1
4.3.2
4.3.4
5.1.0
5.1.1
4.3.3
4.3.4
4.4.1
4.5.0
Updates
docker/build-push-action
from 5 to 6Release notes
Sourced from docker/build-push-action's releases.
Commits
1a16264
Merge pull request #1172 from crazy-max/build-export-disable9eea548
chore: update generated content11c2faa
rename DOCKER_BUILD_EXPORT_RETENTION_DAYS to DOCKER_BUILD_RECORD_RETENTION_DAYSde2365a
opt to disable build record uploadbca5082
Merge pull request #1173 from crazy-max/build-summary-env-changee7aab40
chore: update generated content63eb759
switch DOCKER_BUILD_SUMMARY_DISABLE to DOCKER_BUILD_SUMMARY53ec486
Merge pull request #1171 from docker/dependabot/npm_and_yarn/docker/actions-t...fe9d9f1
chore: update generated contentad37ba1
chore(deps): Bump@docker/actions-toolkit
from 0.30.0 to 0.31.0Updates
mikefarah/yq
from 4.44.1 to 4.44.2Release notes
Sourced from mikefarah/yq's releases.
Changelog
Sourced from mikefarah/yq's changelog.
Commits
f15500b
Bumping versionb8aec71
Preparing release68aafb6
Handle numbers with underscores #2039d58870b
Adding splat[] short hand to explode,collect,flatten,groupby,path,pivot,selec...f1964de
Adding splat[] short hand to collect,eval,map,omit,path,pick45eda8d
Added support for shorthand splat[] for filter,reverse,sort,shuffled9af2dd
Support env[] expression #20717bad2f4
Adding back in commented tests :facepalm3ea19ad
clean code42120e1
Unique now works on maps and arrays #2068Updates
step-security/harden-runner
from 2.8.0 to 2.8.1Release notes
Sourced from step-security/harden-runner's releases.
Commits
17d0e2b
Merge pull request #425 from step-security/rc-9bb112d0
Update isGitHubHosted implementationf4f3f44
Merge pull request #407 from step-security/dependabot/github_actions/actions/...7a946b5
Bump actions/dependency-review-action from 3.1.3 to 4.3.275a01c2
Merge pull request #417 from step-security/dependabot/github_actions/step-sec...53413f1
Bump step-security/harden-runner from 2.7.1 to 2.8.0Updates
actions/dependency-review-action
from 4.3.2 to 4.3.4Release notes
Sourced from actions/dependency-review-action's releases.
Commits
5a2ce3f
Merge pull request #791 from actions/juxtin/update-versionac6a6ad
Prepare even more for v4.3.43e2b917
Merge pull request #790 from actions/juxtin/update-versiond9ab9c8
Update version in package.json8c152c7
Merge pull request #769 from actions/dependabot/npm_and_yarn/zod-3.23.80085d30
Update dist08b5bf2
Bump zod from 3.22.4 to 3.23.8986fce9
Merge pull request #784 from actions/dependabot/npm_and_yarn/got-14.4.128743f8
Merge pull request #719 from actions/change-spdx-parserd6f34c3
Merge pull request #789 from actions/dependabot/npm_and_yarn/braces-3.0.3Updates
actions/setup-python
from 5.1.0 to 5.1.1Release notes
Sourced from actions/setup-python's releases.
Commits
39cd149
Documentation update for cache (#873)a0d74c0
fix(ci): update all failing workflows (#863)4eb7dbc
Bump braces from 3.0.2 to 3.0.3 (#893)Updates
actions/upload-artifact
from 4.3.3 to 4.3.4Release notes
Sourced from actions/upload-artifact's releases.
Commits
0b2256b
Merge pull request #584 from actions/robherley/bump-pkgs488dcef
licensed cache04c51f5
ncc32a9e27
bump@actions/artifact
and npm audit552bf37
new version79616d2
Merge pull request #565 from actions/eggyhead/use-artifact-v2.1.6Updates
codecov/codecov-action
from 4.4.1 to 4.5.0Release notes
Sourced from codecov/codecov-action's releases.
Commits
e28ff12
chore(release): bump to 4.5.0 (#1477)7594baa
Use an existing token even if the PR is from a fork (#1471)81c0a51
feat: add support for tokenless v3 (#1410)f5e203f
build(deps-dev): bump@typescript-eslint/eslint-plugin
from 7.12.0 to 7.13.0 ...7c48363
build(deps-dev): bump braces from 3.0.2 to 3.0.3 (#1475)69e5d09
build(deps-dev): bump@typescript-eslint/parser
from 7.12.0 to 7.13.0 (#1474)feaf700
fix: handle trailing commas (#1470)7b6a727
build(deps): bump github/codeql-action from 3.25.7 to 3.25.8 (#1472)ccf7a1f
build(deps-dev): bump@typescript-eslint/eslint-plugin
from 7.11.0 to 7.12.0 ...f03f015
build(deps-dev): bump@typescript-eslint/parser
from 7.11.0 to 7.12.0 (#1467)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase
.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show