From 5527ade162d3a14ff408cbb6956b5d42e99c5550 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Fri, 23 Oct 2026 12:11:49 +0000 Subject: [PATCH 1/2] chore(deps): bump the actions group across 1 directory with 3 updates Bumps the actions group with 3 updates in the / directory: [step-security/harden-runner](https://github.com/step-security/harden-runner), [chainguard-dev/actions/setup-gitsign](https://github.com/chainguard-dev/actions) and [zizmorcore/zizmor-action](https://github.com/zizmorcore/zizmor-action). Updates `step-security/harden-runner` from 2.22.1 to 2.22.2 - [Release notes](https://github.com/step-security/harden-runner/releases) - [Commits](https://github.com/step-security/harden-runner/compare/ccd8616d44fd3846e67624a50d5aad6d37bf2d25...dc2769abcc0fcfbadfc1df54081c1608579ef6b2) Updates `chainguard-dev/actions/setup-gitsign` from 1.6.41 to 1.6.42 - [Release notes](https://github.com/chainguard-dev/actions/releases) - [Commits](https://github.com/chainguard-dev/actions/compare/3403a578b543fd3f0debdaef9dd989ae54e3fcef...53668650c25af6e8864f1d1ddaa69ed4db4cdf09) Updates `zizmorcore/zizmor-action` from 0.6.4 to 0.7.1 - [Release notes](https://github.com/zizmorcore/zizmor-action/releases) - [Commits](https://github.com/zizmorcore/zizmor-action/compare/cc914d7f3750a2d13d75c7f184a1060aa0e9d482...85b2b9fb8e3325e7a23d7d0a9d7ba5ae0f999e3e) --- updated-dependencies: - dependency-name: chainguard-dev/actions/setup-gitsign dependency-version: 1.6.42 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions - dependency-name: step-security/harden-runner dependency-version: 2.22.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions - dependency-name: zizmorcore/zizmor-action dependency-version: 0.7.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions ... Signed-off-by: dependabot[bot] --- .github/workflows/actionlint.yaml | 2 +- .github/workflows/autodocs-platform.yaml | 4 ++-- .github/workflows/build-terminal-images.yaml | 2 +- .github/workflows/changelog-rotation.yaml | 2 +- .github/workflows/check-links.yaml | 2 +- .github/workflows/cloud-run.yaml | 2 +- .github/workflows/compile-ai-docs-from-gcs.yaml | 4 ++-- .github/workflows/digestabot.yaml | 4 ++-- .github/workflows/export-edu-docs-to-gcs.yaml | 2 +- .github/workflows/mcp-image-smoke-test.yaml | 4 ++-- .github/workflows/pre-commit-autoupdate.yaml | 2 +- .github/workflows/pre-commit.yaml | 2 +- .github/workflows/validate-nginx-config.yaml | 2 +- .github/workflows/zizmor.yaml | 4 ++-- 14 files changed, 19 insertions(+), 19 deletions(-) diff --git a/.github/workflows/actionlint.yaml b/.github/workflows/actionlint.yaml index b94f236d0c..42ff0f94c6 100644 --- a/.github/workflows/actionlint.yaml +++ b/.github/workflows/actionlint.yaml @@ -24,7 +24,7 @@ jobs: name: Action lint runs-on: ubuntu-latest steps: - - uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25 # v2.22.1 + - uses: step-security/harden-runner@dc2769abcc0fcfbadfc1df54081c1608579ef6b2 # v2.22.2 with: egress-policy: block allowed-endpoints: > diff --git a/.github/workflows/autodocs-platform.yaml b/.github/workflows/autodocs-platform.yaml index 513d7b0e7f..01be1ca8b3 100644 --- a/.github/workflows/autodocs-platform.yaml +++ b/.github/workflows/autodocs-platform.yaml @@ -22,7 +22,7 @@ jobs: steps: - name: 'Github Actions Runner' - uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25 # v2.22.1 + uses: step-security/harden-runner@dc2769abcc0fcfbadfc1df54081c1608579ef6b2 # v2.22.2 with: egress-policy: audit @@ -32,7 +32,7 @@ jobs: persist-credentials: false - name: 'Setup gitsign' - uses: chainguard-dev/actions/setup-gitsign@3403a578b543fd3f0debdaef9dd989ae54e3fcef # v1.6.41 + uses: chainguard-dev/actions/setup-gitsign@53668650c25af6e8864f1d1ddaa69ed4db4cdf09 # v1.6.42 - name: Authenticate to Google Cloud id: auth diff --git a/.github/workflows/build-terminal-images.yaml b/.github/workflows/build-terminal-images.yaml index 3eaf1f738f..bc3cefb2da 100644 --- a/.github/workflows/build-terminal-images.yaml +++ b/.github/workflows/build-terminal-images.yaml @@ -34,7 +34,7 @@ jobs: steps: - name: 'Github Actions Runner' - uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25 # v2.22.1 + uses: step-security/harden-runner@dc2769abcc0fcfbadfc1df54081c1608579ef6b2 # v2.22.2 with: egress-policy: audit diff --git a/.github/workflows/changelog-rotation.yaml b/.github/workflows/changelog-rotation.yaml index 0f89fcbd4d..2f1cc5c62f 100644 --- a/.github/workflows/changelog-rotation.yaml +++ b/.github/workflows/changelog-rotation.yaml @@ -34,7 +34,7 @@ jobs: steps: - name: Github Actions Runner - uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25 # v2.22.1 + uses: step-security/harden-runner@dc2769abcc0fcfbadfc1df54081c1608579ef6b2 # v2.22.2 with: egress-policy: block allowed-endpoints: > diff --git a/.github/workflows/check-links.yaml b/.github/workflows/check-links.yaml index bca25c1509..2f4ee6ea70 100644 --- a/.github/workflows/check-links.yaml +++ b/.github/workflows/check-links.yaml @@ -23,7 +23,7 @@ jobs: steps: - name: 'Github Actions Runner' - uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25 # v2.22.1 + uses: step-security/harden-runner@dc2769abcc0fcfbadfc1df54081c1608579ef6b2 # v2.22.2 with: egress-policy: audit diff --git a/.github/workflows/cloud-run.yaml b/.github/workflows/cloud-run.yaml index e913ab49cd..c6cd5099a1 100644 --- a/.github/workflows/cloud-run.yaml +++ b/.github/workflows/cloud-run.yaml @@ -23,7 +23,7 @@ jobs: steps: - name: 'Github Actions Runner' - uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25 # v2.22.1 + uses: step-security/harden-runner@dc2769abcc0fcfbadfc1df54081c1608579ef6b2 # v2.22.2 with: egress-policy: audit diff --git a/.github/workflows/compile-ai-docs-from-gcs.yaml b/.github/workflows/compile-ai-docs-from-gcs.yaml index e909a1140c..6d2924ae01 100644 --- a/.github/workflows/compile-ai-docs-from-gcs.yaml +++ b/.github/workflows/compile-ai-docs-from-gcs.yaml @@ -44,7 +44,7 @@ jobs: steps: - name: Harden Runner - uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25 # v2.22.1 + uses: step-security/harden-runner@dc2769abcc0fcfbadfc1df54081c1608579ef6b2 # v2.22.2 with: egress-policy: block allowed-endpoints: > @@ -376,7 +376,7 @@ jobs: steps: - name: Harden Runner - uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25 # v2.22.1 + uses: step-security/harden-runner@dc2769abcc0fcfbadfc1df54081c1608579ef6b2 # v2.22.2 with: egress-policy: block allowed-endpoints: > diff --git a/.github/workflows/digestabot.yaml b/.github/workflows/digestabot.yaml index 9efcfa9953..318d147178 100644 --- a/.github/workflows/digestabot.yaml +++ b/.github/workflows/digestabot.yaml @@ -21,7 +21,7 @@ jobs: id-token: write steps: - - uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25 # v2.22.1 + - uses: step-security/harden-runner@dc2769abcc0fcfbadfc1df54081c1608579ef6b2 # v2.22.2 with: egress-policy: block allowed-endpoints: > @@ -36,7 +36,7 @@ jobs: release-assets.githubusercontent.com:443 tuf-repo-cdn.sigstore.dev:443 - - uses: chainguard-dev/actions/setup-gitsign@3403a578b543fd3f0debdaef9dd989ae54e3fcef # v1.6.41 + - uses: chainguard-dev/actions/setup-gitsign@53668650c25af6e8864f1d1ddaa69ed4db4cdf09 # v1.6.42 - uses: octo-sts/action@f603d3be9d8dd9871a265776e625a27b00effe05 # v1.1.1 id: octo-sts diff --git a/.github/workflows/export-edu-docs-to-gcs.yaml b/.github/workflows/export-edu-docs-to-gcs.yaml index cbe6fdb773..7cae42319c 100644 --- a/.github/workflows/export-edu-docs-to-gcs.yaml +++ b/.github/workflows/export-edu-docs-to-gcs.yaml @@ -27,7 +27,7 @@ jobs: steps: - name: Harden Runner - uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25 # v2.22.1 + uses: step-security/harden-runner@dc2769abcc0fcfbadfc1df54081c1608579ef6b2 # v2.22.2 with: egress-policy: audit diff --git a/.github/workflows/mcp-image-smoke-test.yaml b/.github/workflows/mcp-image-smoke-test.yaml index 888ff6d6c7..ec33530263 100644 --- a/.github/workflows/mcp-image-smoke-test.yaml +++ b/.github/workflows/mcp-image-smoke-test.yaml @@ -31,7 +31,7 @@ jobs: contents: read steps: - name: Harden Runner - uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25 # v2.22.1 + uses: step-security/harden-runner@dc2769abcc0fcfbadfc1df54081c1608579ef6b2 # v2.22.2 with: egress-policy: block allowed-endpoints: > @@ -64,7 +64,7 @@ jobs: contents: read steps: - name: Harden Runner - uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25 # v2.22.1 + uses: step-security/harden-runner@dc2769abcc0fcfbadfc1df54081c1608579ef6b2 # v2.22.2 with: egress-policy: block allowed-endpoints: > diff --git a/.github/workflows/pre-commit-autoupdate.yaml b/.github/workflows/pre-commit-autoupdate.yaml index b4324aef1c..e2f2a67dc7 100644 --- a/.github/workflows/pre-commit-autoupdate.yaml +++ b/.github/workflows/pre-commit-autoupdate.yaml @@ -21,7 +21,7 @@ jobs: id-token: write # Federate a token via octo-sts steps: - - uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25 # v2.22.1 + - uses: step-security/harden-runner@dc2769abcc0fcfbadfc1df54081c1608579ef6b2 # v2.22.2 with: egress-policy: block allowed-endpoints: > diff --git a/.github/workflows/pre-commit.yaml b/.github/workflows/pre-commit.yaml index d871058b78..ebdacd7099 100644 --- a/.github/workflows/pre-commit.yaml +++ b/.github/workflows/pre-commit.yaml @@ -25,7 +25,7 @@ jobs: # audit (not block): pre-commit downloads hook environments from GitHub, # PyPI, nodejs.org and the npm registry, which is a wide and changing # egress footprint that a static allowlist would break on. - - uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25 # v2.22.1 + - uses: step-security/harden-runner@dc2769abcc0fcfbadfc1df54081c1608579ef6b2 # v2.22.2 with: egress-policy: audit diff --git a/.github/workflows/validate-nginx-config.yaml b/.github/workflows/validate-nginx-config.yaml index e578c1e394..5e86dd997c 100644 --- a/.github/workflows/validate-nginx-config.yaml +++ b/.github/workflows/validate-nginx-config.yaml @@ -18,7 +18,7 @@ jobs: steps: - name: 'Github Actions Runner' - uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25 # v2.22.1 + uses: step-security/harden-runner@dc2769abcc0fcfbadfc1df54081c1608579ef6b2 # v2.22.2 with: egress-policy: audit diff --git a/.github/workflows/zizmor.yaml b/.github/workflows/zizmor.yaml index 1a6fd1d6ea..65402473aa 100644 --- a/.github/workflows/zizmor.yaml +++ b/.github/workflows/zizmor.yaml @@ -30,7 +30,7 @@ jobs: contents: read # Clone the repository security-events: write # Upload SARIF results to Code Scanning steps: - - uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25 # v2.22.1 + - uses: step-security/harden-runner@dc2769abcc0fcfbadfc1df54081c1608579ef6b2 # v2.22.2 with: egress-policy: block allowed-endpoints: > @@ -45,4 +45,4 @@ jobs: persist-credentials: false - name: Run zizmor - uses: zizmorcore/zizmor-action@cc914d7f3750a2d13d75c7f184a1060aa0e9d482 # v0.6.4 + uses: zizmorcore/zizmor-action@85b2b9fb8e3325e7a23d7d0a9d7ba5ae0f999e3e # v0.7.1 From c586c96513fba743872f64059ef25c72698e4ee3 Mon Sep 17 00:00:00 2001 From: Matthew Helmke Date: Fri, 23 Oct 2026 07:21:26 -0500 Subject: [PATCH 2/2] ci(zizmor): allow PyPI egress for zizmor-action 0.7 zizmor-action 0.7 installs zizmor from PyPI with pip instead of pulling a container image from ghcr.io. The job's harden-runner blocks hosts not on its allowlist, so the install failed and zizmor never ran. Co-Authored-By: Claude Opus 5.5 --- .github/workflows/zizmor.yaml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.github/workflows/zizmor.yaml b/.github/workflows/zizmor.yaml index 65402473aa..2c428b9518 100644 --- a/.github/workflows/zizmor.yaml +++ b/.github/workflows/zizmor.yaml @@ -38,6 +38,8 @@ jobs: github.com:443 pkg-containers.githubusercontent.com:443 ghcr.io + pypi.org:443 + files.pythonhosted.org:443 - name: Check out code uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1