Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .github/workflows/clean-branch-cache.yml
Original file line number Diff line number Diff line change
Expand Up @@ -17,7 +17,7 @@ jobs:
permissions:
actions: write
steps:
- uses: step-security/harden-runner@e3f713f2d8f53843e71c69a996d56f51aa9adfb9 # v2.14.1
- uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
with:
disable-sudo-and-containers: ${{ inputs.disable-sudo }}
egress-policy: block
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/docker-build-and-push.yml
Original file line number Diff line number Diff line change
Expand Up @@ -76,7 +76,7 @@ jobs:
run:
working-directory: ${{ inputs.working-directory }}
steps:
- uses: step-security/harden-runner@e3f713f2d8f53843e71c69a996d56f51aa9adfb9 # v2.14.1
- uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
with:
disable-sudo: ${{ inputs.disable-sudo }}
egress-policy: block
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/gitleaks.yml
Original file line number Diff line number Diff line change
Expand Up @@ -25,7 +25,7 @@ jobs:
runs-on: ${{ inputs.runs-on }}
if: (github.actor != 'dependabot[bot]')
steps:
- uses: step-security/harden-runner@e3f713f2d8f53843e71c69a996d56f51aa9adfb9 # v2.14.1
- uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
with:
disable-sudo-and-containers: ${{ inputs.disable-sudo }}
egress-policy: block
Expand Down
6 changes: 3 additions & 3 deletions .github/workflows/go-ci.yml
Original file line number Diff line number Diff line change
Expand Up @@ -34,7 +34,7 @@ jobs:
pull-requests: write
checks: write
steps:
- uses: step-security/harden-runner@e3f713f2d8f53843e71c69a996d56f51aa9adfb9 # v2.14.1
- uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
with:
disable-sudo-and-containers: ${{ inputs.disable-sudo }}
egress-policy: block
Expand Down Expand Up @@ -70,7 +70,7 @@ jobs:
run:
working-directory: ${{ inputs.working-directory }}
steps:
- uses: step-security/harden-runner@e3f713f2d8f53843e71c69a996d56f51aa9adfb9 # v2.14.1
- uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
with:
disable-sudo-and-containers: ${{ inputs.disable-sudo }}
egress-policy: block
Expand Down Expand Up @@ -106,7 +106,7 @@ jobs:
permissions:
contents: write
steps:
- uses: step-security/harden-runner@e3f713f2d8f53843e71c69a996d56f51aa9adfb9 # v2.14.1
- uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
with:
disable-sudo-and-containers: ${{ inputs.disable-sudo }}
egress-policy: block
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/go-security-scan.yml
Original file line number Diff line number Diff line change
Expand Up @@ -33,7 +33,7 @@ jobs:
env:
GO111MODULE: on
steps:
- uses: step-security/harden-runner@e3f713f2d8f53843e71c69a996d56f51aa9adfb9 # v2.14.1
- uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
with:
disable-sudo: ${{ inputs.disable-sudo }}
egress-policy: block
Expand Down
6 changes: 3 additions & 3 deletions .github/workflows/infra-security-scan.yml
Original file line number Diff line number Diff line change
Expand Up @@ -34,7 +34,7 @@ jobs:
run:
working-directory: ${{ inputs.working-directory }}
steps:
- uses: step-security/harden-runner@e3f713f2d8f53843e71c69a996d56f51aa9adfb9 # v2.14.1
- uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
with:
disable-sudo: ${{ inputs.disable-sudo }}
egress-policy: block
Expand Down Expand Up @@ -78,7 +78,7 @@ jobs:
pull-requests: write
security-events: write
steps:
- uses: step-security/harden-runner@e3f713f2d8f53843e71c69a996d56f51aa9adfb9 # v2.14.1
- uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
with:
disable-sudo: ${{ inputs.disable-sudo }}
egress-policy: block
Expand All @@ -100,7 +100,7 @@ jobs:
filter_mode: nofilter
tool_name: actionlint
- name: Install uv
uses: astral-sh/setup-uv@803947b9bd8e9f986429fa0c5a41c367cd732b41 # v7.2.1
uses: astral-sh/setup-uv@eac588ad8def6316056a12d4907a9d4d84ff7a3b # v7.3.0
with:
enable-cache: true
- name: Run zizmor
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/local-auto-tagger.yml
Original file line number Diff line number Diff line change
Expand Up @@ -17,7 +17,7 @@ jobs:
contents: write
runs-on: ubuntu-latest
steps:
- uses: step-security/harden-runner@e3f713f2d8f53843e71c69a996d56f51aa9adfb9 # v2.14.1
- uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
with:
disable-sudo: true
egress-policy: block
Expand Down
4 changes: 2 additions & 2 deletions .github/workflows/pulumi-preview.yml
Original file line number Diff line number Diff line change
Expand Up @@ -51,7 +51,7 @@ jobs:
run:
working-directory: ${{ inputs.working-directory }}
steps:
- uses: step-security/harden-runner@e3f713f2d8f53843e71c69a996d56f51aa9adfb9 # v2.14.1
- uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
with:
disable-sudo-and-containers: ${{ inputs.disable-sudo }}
egress-policy: block
Expand Down Expand Up @@ -88,7 +88,7 @@ jobs:
installer-parallel: true

# ----- UV -----
- uses: astral-sh/setup-uv@803947b9bd8e9f986429fa0c5a41c367cd732b41 # v7.2.1
- uses: astral-sh/setup-uv@eac588ad8def6316056a12d4907a9d4d84ff7a3b # v7.3.0
if: ${{ hashFiles(format('{0}/uv.lock', inputs.working-directory)) != '' }}
with:
enable-cache: true
Expand Down
4 changes: 2 additions & 2 deletions .github/workflows/pulumi-up.yml
Original file line number Diff line number Diff line change
Expand Up @@ -50,7 +50,7 @@ jobs:
run:
working-directory: ${{ inputs.working-directory }}
steps:
- uses: step-security/harden-runner@e3f713f2d8f53843e71c69a996d56f51aa9adfb9 # v2.14.1
- uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
with:
disable-sudo-and-containers: ${{ inputs.disable-sudo }}
egress-policy: block
Expand Down Expand Up @@ -87,7 +87,7 @@ jobs:
installer-parallel: true

# ----- UV -----
- uses: astral-sh/setup-uv@803947b9bd8e9f986429fa0c5a41c367cd732b41 # v7.2.1
- uses: astral-sh/setup-uv@eac588ad8def6316056a12d4907a9d4d84ff7a3b # v7.3.0
if: ${{ hashFiles(format('{0}/uv.lock', inputs.working-directory)) != '' }}
with:
enable-cache: true
Expand Down
4 changes: 2 additions & 2 deletions .github/workflows/python-ci.yml
Original file line number Diff line number Diff line change
Expand Up @@ -31,7 +31,7 @@ jobs:
run:
working-directory: ${{ inputs.working-directory }}
steps:
- uses: step-security/harden-runner@e3f713f2d8f53843e71c69a996d56f51aa9adfb9 # v2.14.1
- uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
with:
disable-sudo-and-containers: ${{ inputs.disable-sudo }}
egress-policy: block
Expand Down Expand Up @@ -66,7 +66,7 @@ jobs:
installer-parallel: true

# ----- UV -----
- uses: astral-sh/setup-uv@803947b9bd8e9f986429fa0c5a41c367cd732b41 # v7.2.1
- uses: astral-sh/setup-uv@eac588ad8def6316056a12d4907a9d4d84ff7a3b # v7.3.0
if: ${{ hashFiles(format('{0}/uv.lock', inputs.working-directory)) != '' }}
with:
enable-cache: true
Expand Down
8 changes: 4 additions & 4 deletions .github/workflows/rust-ci.yml
Original file line number Diff line number Diff line change
Expand Up @@ -52,7 +52,7 @@ jobs:
run:
working-directory: ${{ inputs.working-directory }}
steps:
- uses: step-security/harden-runner@e3f713f2d8f53843e71c69a996d56f51aa9adfb9 # v2.14.1
- uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
with:
disable-sudo-and-containers: ${{ inputs.disable-sudo }}
egress-policy: block
Expand Down Expand Up @@ -85,7 +85,7 @@ jobs:
run:
working-directory: ${{ inputs.working-directory }}
steps:
- uses: step-security/harden-runner@e3f713f2d8f53843e71c69a996d56f51aa9adfb9 # v2.14.1
- uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
with:
disable-sudo-and-containers: ${{ inputs.disable-sudo }}
egress-policy: block
Expand Down Expand Up @@ -116,7 +116,7 @@ jobs:
run:
working-directory: ${{ inputs.working-directory }}
steps:
- uses: step-security/harden-runner@e3f713f2d8f53843e71c69a996d56f51aa9adfb9 # v2.14.1
- uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
with:
disable-sudo-and-containers: ${{ inputs.disable-sudo }}
egress-policy: block
Expand Down Expand Up @@ -170,7 +170,7 @@ jobs:
run:
working-directory: ${{ inputs.working-directory }}
steps:
- uses: step-security/harden-runner@e3f713f2d8f53843e71c69a996d56f51aa9adfb9 # v2.14.1
- uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
with:
disable-sudo-and-containers: ${{ inputs.disable-sudo }}
egress-policy: block
Expand Down
4 changes: 2 additions & 2 deletions .github/workflows/terraform-ci.yml
Original file line number Diff line number Diff line change
Expand Up @@ -47,7 +47,7 @@
run:
working-directory: ${{ inputs.working-directory }}
steps:
- uses: step-security/harden-runner@e3f713f2d8f53843e71c69a996d56f51aa9adfb9 # v2.14.1
- uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
with:
disable-sudo: ${{ inputs.disable-sudo }}
egress-policy: audit
Expand Down Expand Up @@ -135,7 +135,7 @@
run:
working-directory: ${{ inputs.working-directory }}
steps:
- uses: step-security/harden-runner@e3f713f2d8f53843e71c69a996d56f51aa9adfb9 # v2.14.1
- uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
with:
disable-sudo-and-containers: ${{ inputs.disable-sudo }}
egress-policy: audit
Expand Down Expand Up @@ -173,7 +173,7 @@
run: terraform init -input=false
- name: Terraform Plan
id: plan
run: |

Check failure on line 176 in .github/workflows/terraform-ci.yml

View workflow job for this annotation

GitHub Actions / infra-scan / GitHub Actions Security Analysis

[actionlint] reported by reviewdog 🐶 shellcheck reported issue in this script: SC2129:style:2:1: Consider using { cmd1; cmd2; } >> file instead of individual redirects [shellcheck] Raw Output: e:.github/workflows/terraform-ci.yml:176:9: shellcheck reported issue in this script: SC2129:style:2:1: Consider using { cmd1; cmd2; } >> file instead of individual redirects [shellcheck]

Check warning on line 176 in .github/workflows/terraform-ci.yml

View workflow job for this annotation

GitHub Actions / infra-scan / GitHub Actions Security Analysis

[actionlint] reported by reviewdog 🐶 shellcheck reported issue in this script: SC2086:info:4:15: Double quote to prevent globbing and word splitting [shellcheck] Raw Output: i:.github/workflows/terraform-ci.yml:176:9: shellcheck reported issue in this script: SC2086:info:4:15: Double quote to prevent globbing and word splitting [shellcheck]

Check warning on line 176 in .github/workflows/terraform-ci.yml

View workflow job for this annotation

GitHub Actions / infra-scan / GitHub Actions Security Analysis

[actionlint] reported by reviewdog 🐶 shellcheck reported issue in this script: SC2086:info:3:17: Double quote to prevent globbing and word splitting [shellcheck] Raw Output: i:.github/workflows/terraform-ci.yml:176:9: shellcheck reported issue in this script: SC2086:info:3:17: Double quote to prevent globbing and word splitting [shellcheck]

Check warning on line 176 in .github/workflows/terraform-ci.yml

View workflow job for this annotation

GitHub Actions / infra-scan / GitHub Actions Security Analysis

[actionlint] reported by reviewdog 🐶 shellcheck reported issue in this script: SC2086:info:2:21: Double quote to prevent globbing and word splitting [shellcheck] Raw Output: i:.github/workflows/terraform-ci.yml:176:9: shellcheck reported issue in this script: SC2086:info:2:21: Double quote to prevent globbing and word splitting [shellcheck]
terraform plan -no-color -input=false | tee plan.txt
echo "plan<<EOF" >> $GITHUB_OUTPUT
cat plan.txt >> $GITHUB_OUTPUT
Expand Down