Skip to content

chore(deps): bump the actions group across 1 directory with 3 updates - #4311

Merged
matthewhelmke merged 2 commits into
mainfrom
dependabot/github_actions/actions-a4c34c34ff
Oct 23, 2026
Merged

chore(deps): bump the actions group across 1 directory with 3 updates#4311
matthewhelmke merged 2 commits into
mainfrom
dependabot/github_actions/actions-a4c34c34ff

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 22, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the actions group with 3 updates in the / directory: step-security/harden-runner, chainguard-dev/actions/setup-gitsign and zizmorcore/zizmor-action.

Updates step-security/harden-runner from 2.22.1 to 2.22.2

Release notes

Sourced from step-security/harden-runner's releases.

v2.22.2

What's Changed

  • Fixed inbound (ingress) network traffic being incorrectly classified as outbound (egress) traffic on macOS
  • Fixed implicit endpoints intended for self-hosted runners being applied to custom VM environments on Linux (enterprise tier)
  • Improved network and DNS tracing, enforcement logic, and process information correlation on Linux (enterprise tier)

Full Changelog: step-security/harden-runner@v2.22.1...v2.22.2

Commits
  • dc2769a Merge pull request #707 from step-security/rc-45
  • ab0b273 Merge pull request #706 from h0x0er/rc-45
  • 03ccff8 Remove agent-preinstalled skip for third-party runners
  • 815e48d Skip agent install and post-step cleanup when agent is already installed
  • See full diff in compare view

Updates chainguard-dev/actions/setup-gitsign from 1.6.41 to 1.6.42

Release notes

Sourced from chainguard-dev/actions/setup-gitsign's releases.

v1.6.42

What's Changed

Full Changelog: chainguard-dev/actions@v1.6.41...v1.6.42

Commits
  • 5366865 build(deps): bump the actions group across 8 directories with 8 updates (#1087)
  • bd64c75 build(deps): bump reviewdog/action-actionlint from 1.78.1 to 1.80.0 (#1080)
  • 64e5398 build(deps): bump the actions group across 4 directories with 1 update (#1077)
  • e31a743 build(deps): bump actions/setup-node from 7.0.0 to 7.1.0 (#1078)
  • 904f226 build(deps): bump actions/setup-node in /githubapp-token (#1082)
  • See full diff in compare view

Updates zizmorcore/zizmor-action from 0.6.4 to 0.7.1

Release notes

Sourced from zizmorcore/zizmor-action's releases.

v0.7.1

zizmor changes

Bug Fixes 🐛🔗

  • Fixed a regression in 1.31.0 where some ignore comments/configurations would no longer apply to the dangerous-triggers audit

action changes

The default version of zizmor is now 1.31.1.

What's Changed

Full Changelog: zizmorcore/zizmor-action@v0.7.0...v0.7.1

v0.7.0

Sponsorship is appreciated!

zizmor notes

Enhancements 🌱🔗

  • The typosquat-uses audit now supports pre-commit config inputs (#2437)

  • The self-hosted-runner audit is now significantly more precise (#2350)

    Many thanks to @​ubiratansoares for proposing and implementing this enhancement!

  • The dangerous-triggers audit now considers the issue_comment trigger fundamentally dangerous (#2396)

  • zizmor is now aware of the image_version workflow trigger (#2397)

  • The dangerous-triggers audit now produces more precise finding/diagnostic spans (#2402)

  • The cache-poisoning audit is now aware of pnpm/setup (#2409)

  • The unpinned-images audit now produces more precise findings when the user's workflow contains an indirect matrix (#2395)

    Many thanks to @​ubiratansoares for proposing and implementing this enhancement!

  • The cache-poisoning audit is now aware of GitHub's new cache-mode: setting, and will skip any findings that would occur when a job has an effective cache-mode: none (#2418)

  • The cache-poisoning audit now flags usages of cache-mode: write and cache-mode: write-only with dangerous triggers, i.e. triggers that give an attacker privileged code execution (#2426)

  • zizmor now uses a tree-sitter grammar for PowerShell that's more precise/capable of capturing more non-trivial PowerShell expressions (#2444)

Bug Fixes 🐛🔗

... (truncated)

Commits

@dependabot
dependabot Bot requested review from a team as code owners October 22, 2026 22:46
@vercel

vercel Bot commented Oct 22, 2026 •
edited
Loading

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated
chainguard-docs-preview Ready Ready Preview Oct 23, 2026 12:22pm UTC
1 Skipped Deployment
Project Deployment Actions Updated
chainguard-docs Ignored Ignored Oct 23, 2026 12:22pm UTC

Request Review

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file github-actions security labels Oct 22, 2026
@matthewhelmke

matthewhelmke commented Oct 23, 2026

Copy link
Copy Markdown
Collaborator

@dependabot update

@dependabot
chore(deps): bump the actions group across 1 directory with 3 updates
5527ade 
Bumps the actions group with 3 updates in the / directory: [step-security/harden-runner](https://github.com/step-security/harden-runner), [chainguard-dev/actions/setup-gitsign](https://github.com/chainguard-dev/actions) and [zizmorcore/zizmor-action](https://github.com/zizmorcore/zizmor-action).


Updates `step-security/harden-runner` from 2.22.1 to 2.22.2
- [Release notes](https://github.com/step-security/harden-runner/releases)
- [Commits](step-security/harden-runner@ccd8616...dc2769a)

Updates `chainguard-dev/actions/setup-gitsign` from 1.6.41 to 1.6.42
- [Release notes](https://github.com/chainguard-dev/actions/releases)
- [Commits](chainguard-dev/actions@3403a57...5366865)

Updates `zizmorcore/zizmor-action` from 0.6.4 to 0.7.1
- [Release notes](https://github.com/zizmorcore/zizmor-action/releases)
- [Commits](zizmorcore/zizmor-action@cc914d7...85b2b9f)

---
updated-dependencies:
- dependency-name: chainguard-dev/actions/setup-gitsign
  dependency-version: 1.6.42
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions
- dependency-name: step-security/harden-runner
  dependency-version: 2.22.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions
- dependency-name: zizmorcore/zizmor-action
  dependency-version: 0.7.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot changed the title chore(deps): bump the actions group with 3 updates chore(deps): bump the actions group across 1 directory with 3 updates Oct 23, 2026
@dependabot
dependabot Bot force-pushed the dependabot/github_actions/actions-a4c34c34ff branch from b648036 to 5527ade Compare October 23, 2026 12:11
@matthewhelmke @claude
ci(zizmor): allow PyPI egress for zizmor-action 0.7
c586c96 
zizmor-action 0.7 installs zizmor from PyPI with pip instead of pulling
a container image from ghcr.io. The job's harden-runner blocks hosts not
on its allowlist, so the install failed and zizmor never ran.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@matthewhelmke
matthewhelmke merged commit e8247e4 into main Oct 23, 2026
17 checks passed
@matthewhelmke
matthewhelmke deleted the dependabot/github_actions/actions-a4c34c34ff branch October 23, 2026 12:24

This branch was successfully deployed

1 active deployment
Preview – chainguard-docs-preview — c586c965 Deployed Oct 23, 2026 by vercel[bot]
View deployment
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@matthewhelmke matthewhelmke matthewhelmke approved these changes

Assignees

@matthewhelmke matthewhelmke

Labels

dependencies Pull requests that update a dependency file github-actions security

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@matthewhelmke