Enterprise Tier - Telemetry Upload Enhancement:
For the enterprise tier, this change helps overcome size constraints, allowing for more reliable telemetry uploads from the Harden-Runner agent to the StepSecurity backend API. No configuration change is needed to enable this.
Harden-Runner Agent Authentication:
The Harden-Runner agent now uses a per-job key to authenticate to the StepSecurity backend API to submit telemetry. This change prevents the submission of telemetry data anonymously for a given job, improving the integrity of the data collection process. No configuration change is needed to enable this.
README Update:
A Table of Contents has been added to the README file to improve navigation. This makes it easier for users to find the information they need quickly.
Dependency Update:
Updated the braces npm package dependency to a non-vulnerable version. The vulnerability in braces did not affect the Harden Runner Action
Bug fix: Update isGitHubHosted implementation by @varunsh-coder in step-security/harden-runner#425
The previous implementation incorrectly identified large GitHub-hosted runners as self-hosted runners. As a result, harden-runner was not executing on these large GitHub-hosted runners.
This PR is a significant refactor of SPDX expression parsing that may fix some bugs, but unfortunately there are several related known issues that remain unresolved as of this version.
fix(ci): update all failing workflows by @mayeut in actions/setup-python#863
This update ensures compatibility and optimal performance of workflows on the latest macOS version.
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
- `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
- `@dependabot ignore minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
- `@dependabot ignore ` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore ` will remove all of the ignore conditions of the specified dependency
- `@dependabot unignore ` will remove the ignore condition of the specified dependency and ignore conditions
Bumps the action-packages group with 8 updates in the / directory:
3
4
5
6
4.44.1
4.44.2
2.8.0
2.9.0
4.3.2
4.3.4
5.1.0
5.1.1
4.3.3
4.3.4
4.4.1
4.5.0
Updates
actions/checkout
from 3 to 4Release notes
Sourced from actions/checkout's releases.
... (truncated)
Commits
692973e
Prepare 4.1.7 release (#1775)6ccd57f
Pin actions/checkout's own workflows to a known, good, stable version. (#1776)b17fe1e
Handle hidden refs (#1774)b80ff79
Bump actions/checkout from 3 to 4 (#1697)b1ec302
Bump the minor-npm-dependencies group across 1 directory with 4 updates (#1739)a5ac7e5
Update for 4.1.6 release (#1733)24ed1a3
Check platform for extension (#1732)44c2b7a
README: Suggestuser.email
to be `41898282+github-actions[bot]@users
.norepl...8459bc0
Bump actions/upload-artifact from 2 to 4 (#1695)3f603f6
Bump actions/setup-node from 1 to 4 (#1696)Updates
docker/build-push-action
from 5 to 6Release notes
Sourced from docker/build-push-action's releases.
Commits
1ca370b
Merge pull request #1183 from crazy-max/revert-gha-cache-to2c95ebe
chore: update generated contentd189d0e
Revert "set repository and ghtoken attributes for gha cache type"a254f8c
Merge pull request #1179 from docker/dependabot/npm_and_yarn/docker/actions-t...94dae62
chore: update generated content267a69d
chore(deps): Bump@docker/actions-toolkit
from 0.31.0 to 0.33.0f23fb2a
Merge pull request #1133 from crazy-max/gha-cache-toef76d10
chore: update generated content522345f
set repository and ghtoken attributes for gha cache type1a16264
Merge pull request #1172 from crazy-max/build-export-disableUpdates
mikefarah/yq
from 4.44.1 to 4.44.2Release notes
Sourced from mikefarah/yq's releases.
Changelog
Sourced from mikefarah/yq's changelog.
Commits
f15500b
Bumping versionb8aec71
Preparing release68aafb6
Handle numbers with underscores #2039d58870b
Adding splat[] short hand to explode,collect,flatten,groupby,path,pivot,selec...f1964de
Adding splat[] short hand to collect,eval,map,omit,path,pick45eda8d
Added support for shorthand splat[] for filter,reverse,sort,shuffled9af2dd
Support env[] expression #20717bad2f4
Adding back in commented tests :facepalm3ea19ad
clean code42120e1
Unique now works on maps and arrays #2068Updates
step-security/harden-runner
from 2.8.0 to 2.9.0Release notes
Sourced from step-security/harden-runner's releases.
Commits
0d38121
Release v2.9.0 (#435)29e9ae1
Merge pull request #436 from step-security/dependabot/github_actions/actions/...9d596cf
Bump actions/upload-artifact from 3.1.3 to 4.3.46d3c2fe
Merge pull request #410 from step-security/dependabot/github_actions/ossf/sco...c2e63d3
Bump ossf/scorecard-action from 2.3.1 to 2.3.3547a5cc
Merge pull request #427 from step-security/dependabot/github_actions/step-sec...a5e1dca
Bump step-security/harden-runner from 2.8.0 to 2.8.13d32f8d
Merge pull request #426 from step-security/varunsh-coder-patch-1891104c
Update README.md17d0e2b
Merge pull request #425 from step-security/rc-9Updates
actions/dependency-review-action
from 4.3.2 to 4.3.4Release notes
Sourced from actions/dependency-review-action's releases.
Commits
5a2ce3f
Merge pull request #791 from actions/juxtin/update-versionac6a6ad
Prepare even more for v4.3.43e2b917
Merge pull request #790 from actions/juxtin/update-versiond9ab9c8
Update version in package.json8c152c7
Merge pull request #769 from actions/dependabot/npm_and_yarn/zod-3.23.80085d30
Update dist08b5bf2
Bump zod from 3.22.4 to 3.23.8986fce9
Merge pull request #784 from actions/dependabot/npm_and_yarn/got-14.4.128743f8
Merge pull request #719 from actions/change-spdx-parserd6f34c3
Merge pull request #789 from actions/dependabot/npm_and_yarn/braces-3.0.3Updates
actions/setup-python
from 5.1.0 to 5.1.1Release notes
Sourced from actions/setup-python's releases.
Commits
39cd149
Documentation update for cache (#873)a0d74c0
fix(ci): update all failing workflows (#863)4eb7dbc
Bump braces from 3.0.2 to 3.0.3 (#893)Updates
actions/upload-artifact
from 4.3.3 to 4.3.4Release notes
Sourced from actions/upload-artifact's releases.
Commits
0b2256b
Merge pull request #584 from actions/robherley/bump-pkgs488dcef
licensed cache04c51f5
ncc32a9e27
bump@actions/artifact
and npm audit552bf37
new version79616d2
Merge pull request #565 from actions/eggyhead/use-artifact-v2.1.6Updates
codecov/codecov-action
from 4.4.1 to 4.5.0Release notes
Sourced from codecov/codecov-action's releases.
Commits
e28ff12
chore(release): bump to 4.5.0 (#1477)7594baa
Use an existing token even if the PR is from a fork (#1471)81c0a51
feat: add support for tokenless v3 (#1410)f5e203f
build(deps-dev): bump@typescript-eslint/eslint-plugin
from 7.12.0 to 7.13.0 ...7c48363
build(deps-dev): bump braces from 3.0.2 to 3.0.3 (#1475)69e5d09
build(deps-dev): bump@typescript-eslint/parser
from 7.12.0 to 7.13.0 (#1474)feaf700
fix: handle trailing commas (#1470)7b6a727
build(deps): bump github/codeql-action from 3.25.7 to 3.25.8 (#1472)ccf7a1f
build(deps-dev): bump@typescript-eslint/eslint-plugin
from 7.11.0 to 7.12.0 ...f03f015
build(deps-dev): bump@typescript-eslint/parser
from 7.11.0 to 7.12.0 (#1467)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase
.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show