Release v2.10.1 by @varunsh-coder in step-security/harden-runner#463
Bug fix: Resolves an issue where DNS resolution of .local domains was failing when using a Kind cluster in a GitHub Actions workflow.
ARM Support: Harden-Runner Enterprise tier now supports GitHub-hosted ARM runners. This includes all the features that apply to previously supported GitHub-hosted x64 Linux runners.
Updated markdown displayed in the job summary by the Harden-Runner Action.
Fixed a bug affecting Enterprise Tier customers where the agent attempted to upload telemetry for jobs with disable-telemetry set to true. No telemetry was uploaded as the endpoint was not in the allowed list.
Add .zip extension to Windows package downloads for Expand-Archive Compatibility by @priyagupta108 in actions/setup-python#916
This addresses compatibility issues on Windows self-hosted runners by ensuring that the filenames for Python and PyPy package downloads explicitly include the .zip extension, allowing the Expand-Archive command to function correctly.
Add arch to cache key by @Zxilly in actions/setup-python#896
This addresses issues with caching by adding the architecture (arch) to the cache key, ensuring that cache keys are accurate to prevent conflicts
We will no longer include hidden files and folders by default in the upload-artifact action of this version. This reduces the risk that credentials are accidentally uploaded into artifacts. Customers who need to continue to upload these files can use a new option, include-hidden-files, to continue to do so.
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
- `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
- `@dependabot ignore minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
- `@dependabot ignore ` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore ` will remove all of the ignore conditions of the specified dependency
- `@dependabot unignore ` will remove the ignore condition of the specified dependency and ignore conditions
Dependabot tried to update this pull request, but something went wrong. We're looking into it, but in the meantime you can retry the update by commenting @dependabot rebase.
Bumps the action-packages group with 4 updates in the / directory: mikefarah/yq, step-security/harden-runner, actions/setup-python and actions/upload-artifact.
Updates
mikefarah/yq
from 4.44.2 to 4.44.3Release notes
Sourced from mikefarah/yq's releases.
Changelog
Sourced from mikefarah/yq's changelog.
Commits
bbdd974
Bumping version9940668
Preparing release95aacce
Add Flox to installation methods (#2117)b9c3ff6
convert file ext to lowercase for format detection (#2121)b80e1cb
Use static bin in snap (#2090)0ff8415
Bump golang.org/x/net from 0.26.0 to 0.27.0 (#2099)e8dcf3f
Bump github.com/goccy/go-yaml from 1.11.3 to 1.12.0 (#2108)208302c
Bump golang from 1.22.4 to 1.22.5 (#2091)ef6fb92
Log printing follow no-colors flag #208228646c7
Skip and warn when interpolating strings and theres a unclosed bracket #2083Updates
step-security/harden-runner
from 2.9.0 to 2.10.1Release notes
Sourced from step-security/harden-runner's releases.
Commits
91182cc
Merge pull request #463 from step-security/rc-1459ec1c6
Update agent1d23703
Merge pull request #461 from step-security/varunsh-coder-patch-1b03bdda
Update README.md3d8dd68
Update README.md446798f
Merge pull request #455 from step-security/rc-12f0d3b1e
Update agentb7880a2
update distdade49e
Merge pull request #456 from h0x0er/arm-supportd6248be
bump enterprise agent versionUpdates
actions/setup-python
from 5.1.1 to 5.2.0Release notes
Sourced from actions/setup-python's releases.
Commits
f677139
Bump pyinstaller from 3.6 to 5.13.1 in /tests/data (#923)2bd53f9
Documentation update for caching poetry dependencies (#908)80b49d3
fix: add arch to cache key (#896)036a523
Fix: Add.zip
extension to Windows package downloads forExpand-Archive
C...04c1311
Fix display of emojis in contributors doc (#899)cb68456
Updated@iarna/toml
version to 3.0.0 (#912)Updates
actions/upload-artifact
from 4.3.4 to 4.4.0Release notes
Sourced from actions/upload-artifact's releases.
Commits
5076954
Merge pull request #598 from actions/joshmgross/exclude-hidden-filesd52396a
Add a warning about enablinginclude-hidden-files
710f362
Remove "merged" frominclude-hidden-files
input description3b315f2
npm run release
again 🙂3be2180
Remove another trailing comma453e8d0
Update glob license0a398c1
npm run release
a0c40cf
Update to latest@actions/glob
and fix testsacb59e4
lint
cb6558b
Exclude hidden files by defaultDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase
.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show