From 776b737cf3a4dd541df86a085b6bad0b3144ff56 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Wed, 14 Oct 2026 11:21:57 +0000 Subject: [PATCH] build(deps): bump the actions-updates group across 1 directory with 10 updates Bumps the actions-updates group with 10 updates in the / directory: | Package | From | To | | --- | --- | --- | | [step-security/harden-runner](https://github.com/step-security/harden-runner) | `2.20.1` | `2.22.1` | | [actions/checkout](https://github.com/actions/checkout) | `4.4.0` | `7.0.1` | | [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action) | `4.2.0` | `4.4.1` | | [actions/upload-artifact](https://github.com/actions/upload-artifact) | `7.0.1` | `7.0.2` | | [actions/download-artifact](https://github.com/actions/download-artifact) | `8.0.1` | `8.0.2` | | [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) | `10.1.0` | `10.3.0` | | [edera-dev/actions/report-disk-space](https://github.com/edera-dev/actions) | `0.0.17` | `0.0.19` | | [edera-dev/actions/reclaim-disk-space](https://github.com/edera-dev/actions) | `0.0.17` | `0.0.19` | | [edera-dev/actions/configure-azure-sccache](https://github.com/edera-dev/actions) | `0.0.17` | `0.0.19` | | [anthropics/claude-code-action](https://github.com/anthropics/claude-code-action) | `1.0.208` | `1.0.248` | Updates `step-security/harden-runner` from 2.20.1 to 2.22.1 - [Release notes](https://github.com/step-security/harden-runner/releases) - [Commits](https://github.com/step-security/harden-runner/compare/v2.20.1...ccd8616d44fd3846e67624a50d5aad6d37bf2d25) Updates `actions/checkout` from 4.4.0 to 7.0.1 - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](https://github.com/actions/checkout/compare/v4.4.0...3d3c42e5aac5ba805825da76410c181273ba90b1) Updates `docker/setup-buildx-action` from 4.2.0 to 4.4.1 - [Release notes](https://github.com/docker/setup-buildx-action/releases) - [Commits](https://github.com/docker/setup-buildx-action/compare/bb05f3f5519dd87d3ba754cc423b652a5edd6d2c...f87e5991a6d7451dcb8d9637bfbc97413f497069) Updates `actions/upload-artifact` from 7.0.1 to 7.0.2 - [Release notes](https://github.com/actions/upload-artifact/releases) - [Commits](https://github.com/actions/upload-artifact/compare/043fb46d1a93c77aae656e7c1c64a875d1fc6a0a...cf430e030ddbb5b0abf93d22962f4752f3646cd9) Updates `actions/download-artifact` from 8.0.1 to 8.0.2 - [Release notes](https://github.com/actions/download-artifact/releases) - [Commits](https://github.com/actions/download-artifact/compare/3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c...9000827ccba6bdab643e8b6fd33ac0654aef8333) Updates `astral-sh/setup-uv` from 10.1.0 to 10.3.0 - [Release notes](https://github.com/astral-sh/setup-uv/releases) - [Commits](https://github.com/astral-sh/setup-uv/compare/bec219d24cd3e171d82865faccec33120bb574f4...1c37ad07a6a961277cf70c0d37d6f313000f5884) Updates `edera-dev/actions/report-disk-space` from 0.0.17 to 0.0.19 - [Release notes](https://github.com/edera-dev/actions/releases) - [Commits](https://github.com/edera-dev/actions/compare/6e6996f6fff5d6016bcdc097e9065da6fb33ac7f...faf60530c573a16a539da282eb6d17198a6d1416) Updates `edera-dev/actions/reclaim-disk-space` from 0.0.17 to 0.0.19 - [Release notes](https://github.com/edera-dev/actions/releases) - [Commits](https://github.com/edera-dev/actions/compare/6e6996f6fff5d6016bcdc097e9065da6fb33ac7f...faf60530c573a16a539da282eb6d17198a6d1416) Updates `edera-dev/actions/configure-azure-sccache` from 0.0.17 to 0.0.19 - [Release notes](https://github.com/edera-dev/actions/releases) - [Commits](https://github.com/edera-dev/actions/compare/6e6996f6fff5d6016bcdc097e9065da6fb33ac7f...faf60530c573a16a539da282eb6d17198a6d1416) Updates `anthropics/claude-code-action` from 1.0.208 to 1.0.248 - [Release notes](https://github.com/anthropics/claude-code-action/releases) - [Commits](https://github.com/anthropics/claude-code-action/compare/e8c2d7c16c018cf1e694711c1c07a5f5db2b5eb1...1d6de8cb0c237e7c15e9e1bdf973826ebae490cc) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 7.0.1 dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions-updates - dependency-name: actions/download-artifact dependency-version: 8.0.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions-updates - dependency-name: actions/upload-artifact dependency-version: 7.0.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions-updates - dependency-name: anthropics/claude-code-action dependency-version: 1.0.248 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions-updates - dependency-name: astral-sh/setup-uv dependency-version: 10.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions-updates - dependency-name: docker/setup-buildx-action dependency-version: 4.4.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions-updates - dependency-name: edera-dev/actions/configure-azure-sccache dependency-version: 0.0.19 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions-updates - dependency-name: edera-dev/actions/reclaim-disk-space dependency-version: 0.0.19 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions-updates - dependency-name: edera-dev/actions/report-disk-space dependency-version: 0.0.19 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions-updates - dependency-name: step-security/harden-runner dependency-version: 2.22.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions-updates ... Signed-off-by: dependabot[bot] --- .github/workflows/buildenv-diff.yml | 2 +- .github/workflows/buildenv.yml | 14 ++++----- .github/workflows/digestabot.yml | 2 +- .github/workflows/lint.yml | 2 +- .github/workflows/matrix.yml | 34 ++++++++++----------- .github/workflows/pr-review-selftest.yml | 4 +-- .github/workflows/pr-review-suggestions.yml | 6 ++-- .github/workflows/pr-test-coverage.yml | 6 ++-- .github/workflows/refresh-nvidia.yml | 2 +- 9 files changed, 36 insertions(+), 36 deletions(-) diff --git a/.github/workflows/buildenv-diff.yml b/.github/workflows/buildenv-diff.yml index 9e417b8..c163557 100644 --- a/.github/workflows/buildenv-diff.yml +++ b/.github/workflows/buildenv-diff.yml @@ -18,7 +18,7 @@ jobs: labels: edera-16 steps: - name: Harden the runner (Audit all outbound calls) - uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1 + uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25 # v2.22.1 with: egress-policy: audit - name: checkout repository diff --git a/.github/workflows/buildenv.yml b/.github/workflows/buildenv.yml index 52378e0..855ca86 100644 --- a/.github/workflows/buildenv.yml +++ b/.github/workflows/buildenv.yml @@ -38,13 +38,13 @@ jobs: runs-on: "${{ matrix.runner }}" steps: - name: Harden the runner (Audit all outbound calls) - uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1 + uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25 # v2.22.1 with: egress-policy: audit - name: checkout repository uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v4 - name: docker setup buildx - uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0 + uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1 - name: docker login ghcr.io uses: Wandalen/wretry.action@e68c23e6309f2871ca8ae4763e7629b9c258e1ea # v3.8.0 with: @@ -67,7 +67,7 @@ jobs: docker run --rm "${IMAGE}@$(cat digest-${{ matrix.arch }})" \ cat /usr/share/buildenv/packages.tsv > "packages-${{ matrix.arch }}.tsv" - name: upload digest - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: "buildenv-digest-${{ matrix.arch }}" path: "digest-${{ matrix.arch }}" @@ -75,7 +75,7 @@ jobs: compression-level: 0 retention-days: 1 - name: upload package manifest - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: "buildenv-packages-${{ matrix.arch }}" path: "packages-${{ matrix.arch }}.tsv" @@ -89,13 +89,13 @@ jobs: labels: edera-16 steps: - name: Harden the runner (Audit all outbound calls) - uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1 + uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25 # v2.22.1 with: egress-policy: audit - name: install cosign uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2 - name: docker setup buildx - uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0 + uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1 - name: docker login ghcr.io uses: Wandalen/wretry.action@e68c23e6309f2871ca8ae4763e7629b9c258e1ea # v3.8.0 with: @@ -105,7 +105,7 @@ jobs: username: "${{github.actor}}" password: "${{secrets.GITHUB_TOKEN}}" - name: download digests - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: pattern: "buildenv-digest-*" merge-multiple: true diff --git a/.github/workflows/digestabot.yml b/.github/workflows/digestabot.yml index 005631e..514c66d 100644 --- a/.github/workflows/digestabot.yml +++ b/.github/workflows/digestabot.yml @@ -28,7 +28,7 @@ jobs: steps: - name: Harden the runner (Audit all outbound calls) - uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1 + uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25 # v2.22.1 with: egress-policy: audit diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml index 9aa3d02..ca03e1b 100644 --- a/.github/workflows/lint.yml +++ b/.github/workflows/lint.yml @@ -31,7 +31,7 @@ jobs: curl -sSfL "https://github.com/koalaman/shellcheck/releases/download/v${SHELLCHECK_VERSION}/shellcheck-v${SHELLCHECK_VERSION}.linux.x86_64.tar.xz" | tar -xJ -C /tmp install -m755 "/tmp/shellcheck-v${SHELLCHECK_VERSION}/shellcheck" "${HOME}/.local/bin/shellcheck" - name: Install the latest version of uv - uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0 + uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0 with: python-version: "3.14" - name: Show versions diff --git a/.github/workflows/matrix.yml b/.github/workflows/matrix.yml index 577c573..d21cba9 100644 --- a/.github/workflows/matrix.yml +++ b/.github/workflows/matrix.yml @@ -24,11 +24,11 @@ jobs: labels: edera-16 steps: - name: Harden the runner (Audit all outbound calls) - uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1 + uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25 # v2.22.1 with: egress-policy: audit - name: Install the latest version of uv - uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0 + uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0 with: python-version: "3.14" - name: Setup Crane @@ -42,7 +42,7 @@ jobs: - name: generate matrix run: './hack/build/generate-matrix.sh "${{ inputs.spec }}"' - name: upload matrix - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: matrix path: "matrix.json" @@ -83,17 +83,17 @@ jobs: KERNEL_ARCH: "${{ matrix.builds.arch }}" steps: - name: Harden the runner (Audit all outbound calls) - uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1 + uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25 # v2.22.1 with: egress-policy: audit - name: report disk space (before) - uses: edera-dev/actions/report-disk-space@6e6996f6fff5d6016bcdc097e9065da6fb33ac7f # v0.0.17 + uses: edera-dev/actions/report-disk-space@faf60530c573a16a539da282eb6d17198a6d1416 # v0.0.19 - name: reclaim runner disk space # Kernel builds never touch Rust or the hosted toolcache, so both # opt-in removals are on. Must stay before cosign-installer, which # installs into the toolcache this deletes. - uses: edera-dev/actions/reclaim-disk-space@6e6996f6fff5d6016bcdc097e9065da6fb33ac7f # v0.0.17 + uses: edera-dev/actions/reclaim-disk-space@faf60530c573a16a539da282eb6d17198a6d1416 # v0.0.19 with: remove-toolcache: 'true' remove-rust: 'true' @@ -132,7 +132,7 @@ jobs: # - name: docker setup linux-kernel-oci # run: sudo uv run ./hack/build/docker-setup.py - name: docker setup buildx - uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0 + uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1 - name: docker login ghcr.io uses: Wandalen/wretry.action@e68c23e6309f2871ca8ae4763e7629b9c258e1ea # v3.8.0 with: @@ -148,19 +148,19 @@ jobs: # list in hack/build/generate-docker-script.py (docker_compile); a # name missing there silently never reaches the build container. id: sccache - uses: edera-dev/actions/configure-azure-sccache@6e6996f6fff5d6016bcdc097e9065da6fb33ac7f # v0.0.17 + uses: edera-dev/actions/configure-azure-sccache@faf60530c573a16a539da282eb6d17198a6d1416 # v0.0.19 with: connection-string-rw: ${{ secrets.SCCACHE_AZURE_CONNECTION_STRING }} connection-string-ro: ${{ secrets.SCCACHE_AZURE_CONNECTION_STRING_RO }} key-prefix: kernel - name: Install the latest version of uv - uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0 + uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0 with: python-version: "3.14" - name: generate docker script run: "./hack/build/generate-docker-script.sh" - name: upload docker script - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: "build-${{ matrix.builds.branch }}-${{ matrix.builds.version }}-${{ matrix.builds.flavor }}-${{ matrix.builds.arch }}.sh" path: "docker.sh" @@ -172,11 +172,11 @@ jobs: - name: report disk space (after) # always() so ENOSPC failures still show where the disk went. if: always() - uses: edera-dev/actions/report-disk-space@6e6996f6fff5d6016bcdc097e9065da6fb33ac7f # v0.0.17 + uses: edera-dev/actions/report-disk-space@faf60530c573a16a539da282eb6d17198a6d1416 # v0.0.19 - name: upload digests # Only produced when publishing — push-by-digest path writes digests.json. if: ${{ inputs.publish }} - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: "digests-${{ matrix.builds.branch }}-${{ matrix.builds.version }}-${{ matrix.builds.flavor }}-${{ matrix.builds.arch }}" path: "digests.json" @@ -208,13 +208,13 @@ jobs: DIGESTS_DIR: digests steps: - name: Harden the runner (Audit all outbound calls) - uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1 + uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25 # v2.22.1 with: egress-policy: audit - name: checkout repository uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v4 - name: Install the latest version of uv - uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4 # v10.1.0 + uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0 with: python-version: '3.14' - name: install python deps @@ -222,7 +222,7 @@ jobs: - name: install cosign uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2 - name: docker setup buildx - uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0 + uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1 - name: docker login ghcr.io uses: Wandalen/wretry.action@e68c23e6309f2871ca8ae4763e7629b9c258e1ea # v3.8.0 with: @@ -232,7 +232,7 @@ jobs: username: "${{github.actor}}" password: "${{secrets.GITHUB_TOKEN}}" - name: download digest artifacts - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: # Each per-arch build uploads its digests under a uniquely-named # artifact; pattern + default merge-multiple=false drops each artifact @@ -242,7 +242,7 @@ jobs: - name: generate merge script run: uv run ./hack/build/generate-merge-script.py - name: upload merge script - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: "merge-${{ matrix.merges.branch }}-${{ matrix.merges.version }}-${{ matrix.merges.flavor }}.sh" path: "merge.sh" diff --git a/.github/workflows/pr-review-selftest.yml b/.github/workflows/pr-review-selftest.yml index b7c7425..f46d925 100644 --- a/.github/workflows/pr-review-selftest.yml +++ b/.github/workflows/pr-review-selftest.yml @@ -39,12 +39,12 @@ jobs: timeout-minutes: 10 steps: - name: Harden runner - uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0 + uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25 # v2.22.1 with: egress-policy: audit - name: Checkout - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false diff --git a/.github/workflows/pr-review-suggestions.yml b/.github/workflows/pr-review-suggestions.yml index 83849d8..c0b2056 100644 --- a/.github/workflows/pr-review-suggestions.yml +++ b/.github/workflows/pr-review-suggestions.yml @@ -40,12 +40,12 @@ jobs: id-token: write steps: - name: Harden runner - uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0 + uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25 # v2.22.1 with: egress-policy: audit - name: Checkout - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 persist-credentials: false @@ -82,7 +82,7 @@ jobs: - name: Suggest id: suggest continue-on-error: true - uses: anthropics/claude-code-action@e8c2d7c16c018cf1e694711c1c07a5f5db2b5eb1 # v1 + uses: anthropics/claude-code-action@1d6de8cb0c237e7c15e9e1bdf973826ebae490cc # v1 env: GH_TOKEN: ${{ github.token }} with: diff --git a/.github/workflows/pr-test-coverage.yml b/.github/workflows/pr-test-coverage.yml index fbe6622..54ae69e 100644 --- a/.github/workflows/pr-test-coverage.yml +++ b/.github/workflows/pr-test-coverage.yml @@ -39,12 +39,12 @@ jobs: id-token: write steps: - name: Harden runner - uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0 + uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25 # v2.22.1 with: egress-policy: audit - name: Checkout - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 persist-credentials: false @@ -87,7 +87,7 @@ jobs: - name: Review id: review continue-on-error: true - uses: anthropics/claude-code-action@e8c2d7c16c018cf1e694711c1c07a5f5db2b5eb1 # v1 + uses: anthropics/claude-code-action@1d6de8cb0c237e7c15e9e1bdf973826ebae490cc # v1 env: GH_TOKEN: ${{ github.token }} with: diff --git a/.github/workflows/refresh-nvidia.yml b/.github/workflows/refresh-nvidia.yml index 83d1cd4..f37bc5a 100644 --- a/.github/workflows/refresh-nvidia.yml +++ b/.github/workflows/refresh-nvidia.yml @@ -15,7 +15,7 @@ jobs: labels: edera-16 steps: - name: Harden the runner (Audit all outbound calls) - uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1 + uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25 # v2.22.1 with: egress-policy: audit - name: checkout repository