From 0ae3c704c97a5b4d778796b6285a81eaf842014d Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Fri, 16 Oct 2026 23:57:05 +0000 Subject: [PATCH] chore(deps): bump the github-actions-dependencies group across 1 directory with 5 updates Bumps the github-actions-dependencies group with 5 updates in the / directory: | Package | From | To | | --- | --- | --- | | [step-security/harden-runner](https://github.com/step-security/harden-runner) | `2.21.1` | `2.22.1` | | [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) | `10.2.0` | `10.3.0` | | [github/codeql-action/upload-sarif](https://github.com/github/codeql-action) | `4.38.2` | `4.38.3` | | [soldevelo/infrascan](https://github.com/soldevelo/infrascan) | `1.2.0` | `1.2.2` | | [actions/upload-artifact](https://github.com/actions/upload-artifact) | `7.0.1` | `7.0.2` | Updates `step-security/harden-runner` from 2.21.1 to 2.22.1 - [Release notes](https://github.com/step-security/harden-runner/releases) - [Commits](https://github.com/step-security/harden-runner/compare/e14015d583714f6e62063499dc959a02595150a1...ccd8616d44fd3846e67624a50d5aad6d37bf2d25) Updates `astral-sh/setup-uv` from 10.2.0 to 10.3.0 - [Release notes](https://github.com/astral-sh/setup-uv/releases) - [Commits](https://github.com/astral-sh/setup-uv/compare/c18668ad3cf93ea998bef934396af7bb5c839dc7...1c37ad07a6a961277cf70c0d37d6f313000f5884) Updates `github/codeql-action/upload-sarif` from 4.38.2 to 4.38.3 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2...24c54180a607b1449ed407dd24f251e4e9147c8d) Updates `soldevelo/infrascan` from 1.2.0 to 1.2.2 - [Release notes](https://github.com/soldevelo/infrascan/releases) - [Changelog](https://github.com/SolDevelo/InfraScan/blob/main/docs/RELEASE_NOTES_1.2.1.md) - [Commits](https://github.com/soldevelo/infrascan/compare/7b56a90270606fa298aec4c82a93d0cd99f5d454...d014b41beb18257680965b5c07d9d53de53bc042) Updates `actions/upload-artifact` from 7.0.1 to 7.0.2 - [Release notes](https://github.com/actions/upload-artifact/releases) - [Commits](https://github.com/actions/upload-artifact/compare/043fb46d1a93c77aae656e7c1c64a875d1fc6a0a...cf430e030ddbb5b0abf93d22962f4752f3646cd9) --- updated-dependencies: - dependency-name: step-security/harden-runner dependency-version: 2.22.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions-dependencies - dependency-name: astral-sh/setup-uv dependency-version: 10.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions-dependencies - dependency-name: github/codeql-action/upload-sarif dependency-version: 4.38.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions-dependencies - dependency-name: soldevelo/infrascan dependency-version: 1.2.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions-dependencies - dependency-name: actions/upload-artifact dependency-version: 7.0.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions-dependencies ... Signed-off-by: dependabot[bot] --- .github/workflows/cflite_build.yml | 2 +- .github/workflows/cflite_pr.yml | 2 +- .github/workflows/dependency-review.yml | 2 +- .github/workflows/docs-pages.yml | 8 ++++---- .github/workflows/iac-policy.yml | 10 +++++----- .github/workflows/infrascan-security-audit.yml | 6 +++--- .github/workflows/lambda-tests.yml | 6 +++--- .github/workflows/ministack-smoke.yml | 4 ++-- .github/workflows/ossf-scorecard.yml | 6 +++--- .github/workflows/pre-commit.yml | 2 +- .github/workflows/quality-gates.yml | 8 ++++---- .github/workflows/release.yml | 2 +- .github/workflows/semantic-check.yml | 2 +- 13 files changed, 30 insertions(+), 30 deletions(-) diff --git a/.github/workflows/cflite_build.yml b/.github/workflows/cflite_build.yml index 8a5316345..5366f02d8 100644 --- a/.github/workflows/cflite_build.yml +++ b/.github/workflows/cflite_build.yml @@ -33,7 +33,7 @@ jobs: - address steps: - name: Harden the runner (Audit all outbound calls) - uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1 + uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25 # v2.22.1 with: egress-policy: audit diff --git a/.github/workflows/cflite_pr.yml b/.github/workflows/cflite_pr.yml index 9191beebc..4424b3fe9 100644 --- a/.github/workflows/cflite_pr.yml +++ b/.github/workflows/cflite_pr.yml @@ -38,7 +38,7 @@ jobs: - address steps: - name: Harden the runner (Audit all outbound calls) - uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1 + uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25 # v2.22.1 with: egress-policy: audit diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml index f8b002e25..d91f0e5ba 100644 --- a/.github/workflows/dependency-review.yml +++ b/.github/workflows/dependency-review.yml @@ -23,7 +23,7 @@ jobs: pull-requests: write # Required to publish the dependency review summary comment. steps: - name: Harden the runner (Audit all outbound calls) - uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1 + uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25 # v2.22.1 with: egress-policy: audit diff --git a/.github/workflows/docs-pages.yml b/.github/workflows/docs-pages.yml index 2a48f466c..cc0ba62e5 100644 --- a/.github/workflows/docs-pages.yml +++ b/.github/workflows/docs-pages.yml @@ -38,7 +38,7 @@ jobs: contents: read # Required to checkout repository content. steps: - name: Harden the runner - uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1 + uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25 # v2.22.1 with: egress-policy: audit @@ -53,7 +53,7 @@ jobs: python-version: '3.12' - name: Set up uv - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0 + uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0 with: version: 0.12.7 @@ -69,7 +69,7 @@ jobs: pages: write # Required to upload the GitHub Pages artifact. steps: - name: Harden the runner - uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1 + uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25 # v2.22.1 with: egress-policy: audit @@ -84,7 +84,7 @@ jobs: python-version: '3.12' - name: Set up uv - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0 + uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0 with: version: 0.12.7 diff --git a/.github/workflows/iac-policy.yml b/.github/workflows/iac-policy.yml index ec9c1569d..6d211008e 100644 --- a/.github/workflows/iac-policy.yml +++ b/.github/workflows/iac-policy.yml @@ -57,7 +57,7 @@ jobs: pull-requests: write # Required to publish summaries back to pull requests. steps: - name: Harden the runner (Audit all outbound calls) - uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1 + uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25 # v2.22.1 with: egress-policy: audit @@ -72,7 +72,7 @@ jobs: python-version: '3.12' - name: Set up uv - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0 + uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0 with: version: 0.12.7 @@ -291,7 +291,7 @@ jobs: pull-requests: write # Required to publish summaries back to pull requests. steps: - name: Harden the runner (Audit all outbound calls) - uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1 + uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25 # v2.22.1 with: egress-policy: audit @@ -351,7 +351,7 @@ jobs: security-events: write # Required to upload Checkov SARIF to code scanning. steps: - name: Harden the runner (Audit all outbound calls) - uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1 + uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25 # v2.22.1 with: egress-policy: audit @@ -384,6 +384,6 @@ jobs: - name: Upload Checkov SARIF if: always() continue-on-error: true - uses: github/codeql-action/upload-sarif@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2 + uses: github/codeql-action/upload-sarif@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3 with: sarif_file: results.sarif diff --git a/.github/workflows/infrascan-security-audit.yml b/.github/workflows/infrascan-security-audit.yml index a93159160..bcba3254b 100644 --- a/.github/workflows/infrascan-security-audit.yml +++ b/.github/workflows/infrascan-security-audit.yml @@ -26,7 +26,7 @@ jobs: contents: read # Required to checkout repository content for scanning. steps: - name: Harden the runner (Audit all outbound calls) - uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1 + uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25 # v2.22.1 with: egress-policy: audit @@ -52,7 +52,7 @@ jobs: ./ .infrascan-src/ - name: Run InfraScan - uses: soldevelo/infrascan@7b56a90270606fa298aec4c82a93d0cd99f5d454 # v1.2.0 + uses: soldevelo/infrascan@d014b41beb18257680965b5c07d9d53de53bc042 # v1.2.2 with: directory: .infrascan-src scanner: comprehensive @@ -61,7 +61,7 @@ jobs: fail-on: high_critical - name: Upload HTML report - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 if: always() with: name: infrascan-report diff --git a/.github/workflows/lambda-tests.yml b/.github/workflows/lambda-tests.yml index 4fa40d39b..1920c98b5 100644 --- a/.github/workflows/lambda-tests.yml +++ b/.github/workflows/lambda-tests.yml @@ -49,7 +49,7 @@ jobs: pull-requests: write # Required to publish summaries back to pull requests. steps: - name: Harden the runner (Audit all outbound calls) - uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1 + uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25 # v2.22.1 with: egress-policy: audit @@ -65,7 +65,7 @@ jobs: python-version: '3.12' - name: Set up uv - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0 + uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0 with: version: 0.12.7 @@ -88,7 +88,7 @@ jobs: - name: Upload coverage if: always() - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: lambda-test-results path: | diff --git a/.github/workflows/ministack-smoke.yml b/.github/workflows/ministack-smoke.yml index 171a1600b..277ab0715 100644 --- a/.github/workflows/ministack-smoke.yml +++ b/.github/workflows/ministack-smoke.yml @@ -50,7 +50,7 @@ jobs: MINISTACK_IMAGE: ministackorg/ministack:1.3.72-full@sha256:fda44c46c4cec06cd6774ce794eb68d5ab7e57a2ecb731fe7e7dda37fc2486be steps: - name: Harden the runner (Audit all outbound calls) - uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1 + uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25 # v2.22.1 with: egress-policy: audit @@ -65,7 +65,7 @@ jobs: python-version: '3.12' - name: Set up uv - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0 + uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0 with: version: 0.12.7 diff --git a/.github/workflows/ossf-scorecard.yml b/.github/workflows/ossf-scorecard.yml index fac59e1da..1e05ae51f 100644 --- a/.github/workflows/ossf-scorecard.yml +++ b/.github/workflows/ossf-scorecard.yml @@ -30,7 +30,7 @@ jobs: security-events: write # Required to upload Scorecard SARIF results to code scanning. steps: - name: Harden the runner (Audit all outbound calls) - uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1 + uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25 # v2.22.1 with: egress-policy: audit @@ -47,13 +47,13 @@ jobs: results_format: sarif - name: Upload artifact - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: SARIF file path: results.sarif retention-days: 5 - name: Upload to code-scanning - uses: github/codeql-action/upload-sarif@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2 + uses: github/codeql-action/upload-sarif@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3 with: sarif_file: results.sarif diff --git a/.github/workflows/pre-commit.yml b/.github/workflows/pre-commit.yml index 0b9f3c299..e9aadc1e0 100644 --- a/.github/workflows/pre-commit.yml +++ b/.github/workflows/pre-commit.yml @@ -67,7 +67,7 @@ jobs: - name: Upload pre-commit log if: failure() - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: pre-commit-log path: pre-commit.log diff --git a/.github/workflows/quality-gates.yml b/.github/workflows/quality-gates.yml index 60e93fa07..212fe7b26 100644 --- a/.github/workflows/quality-gates.yml +++ b/.github/workflows/quality-gates.yml @@ -75,7 +75,7 @@ jobs: pull-requests: write # Required to publish summaries back to pull requests. steps: - name: Harden the runner (Audit all outbound calls) - uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1 + uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25 # v2.22.1 with: egress-policy: audit @@ -90,7 +90,7 @@ jobs: python-version: '3.12' - name: Set up uv - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0 + uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0 with: version: 0.12.7 @@ -123,7 +123,7 @@ jobs: pull-requests: write # Required to publish summaries back to pull requests. steps: - name: Harden the runner (Audit all outbound calls) - uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1 + uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25 # v2.22.1 with: egress-policy: audit @@ -138,7 +138,7 @@ jobs: python-version: '3.12' - name: Set up uv - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0 + uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0 with: version: 0.12.7 diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 380c7e99b..3d7c3b733 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -26,7 +26,7 @@ jobs: environment: release steps: - name: Harden the runner (Audit all outbound calls) - uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1 + uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25 # v2.22.1 with: egress-policy: audit diff --git a/.github/workflows/semantic-check.yml b/.github/workflows/semantic-check.yml index d3c1bf381..93606ce57 100644 --- a/.github/workflows/semantic-check.yml +++ b/.github/workflows/semantic-check.yml @@ -25,7 +25,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Harden the runner (Audit all outbound calls) - uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1 + uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25 # v2.22.1 with: egress-policy: audit