From de4656dc4fcc9259f94b275b1abbcd255ef561e6 Mon Sep 17 00:00:00 2001 From: Nikolai Emil Damm Date: Fri, 10 Jul 2026 10:20:05 +0200 Subject: [PATCH 1/5] chore(deps): bump step-security/harden-runner to v2.20.0 in bootstrap.yaml --- .github/workflows/bootstrap.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/bootstrap.yaml b/.github/workflows/bootstrap.yaml index e0cf1e9..094a1e2 100644 --- a/.github/workflows/bootstrap.yaml +++ b/.github/workflows/bootstrap.yaml @@ -61,7 +61,7 @@ jobs: packages: write # push the OCI manifest artifact to GHCR steps: - name: 🛡️ Harden runner - uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4 + uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 with: egress-policy: audit From c077f2344ec823ef680849a7f2394820d224c988 Mon Sep 17 00:00:00 2001 From: Nikolai Emil Damm Date: Fri, 10 Jul 2026 10:20:08 +0200 Subject: [PATCH 2/5] chore(deps): bump step-security/harden-runner to v2.20.0 in cd.yaml --- .github/workflows/cd.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/cd.yaml b/.github/workflows/cd.yaml index 2bce133..ad5f6e8 100644 --- a/.github/workflows/cd.yaml +++ b/.github/workflows/cd.yaml @@ -29,7 +29,7 @@ jobs: attestations: write # write SBOM + SLSA provenance attestations steps: - name: 🛡️ Harden runner - uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4 + uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 with: egress-policy: audit From 45b678c62cacfcb810b0ec73085d2f436da31a6a Mon Sep 17 00:00:00 2001 From: Nikolai Emil Damm Date: Fri, 10 Jul 2026 10:20:10 +0200 Subject: [PATCH 3/5] chore(deps): bump step-security/harden-runner to v2.20.0 in ci.yaml --- .github/workflows/ci.yaml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index 071efcd..db0cf66 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -21,7 +21,7 @@ jobs: k8s: ${{ steps.filter.outputs.k8s }} steps: - name: 🛡️ Harden runner - uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4 + uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 with: egress-policy: audit @@ -58,7 +58,7 @@ jobs: contents: read # checkout repository steps: - name: 🛡️ Harden runner - uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4 + uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 with: egress-policy: audit @@ -127,7 +127,7 @@ jobs: id-token: write # mint OIDC token for cosign keyless signing (Fulcio + Rekor) steps: - name: 🛡️ Harden runner - uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4 + uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 with: egress-policy: audit From 77e9e768d53a8026c534df319ebed31437b4ca30 Mon Sep 17 00:00:00 2001 From: Nikolai Emil Damm Date: Fri, 10 Jul 2026 10:20:12 +0200 Subject: [PATCH 4/5] chore(deps): bump step-security/harden-runner to v2.20.0 in copilot-setup-steps.yml --- .github/workflows/copilot-setup-steps.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/copilot-setup-steps.yml b/.github/workflows/copilot-setup-steps.yml index af3dcc6..66810fc 100644 --- a/.github/workflows/copilot-setup-steps.yml +++ b/.github/workflows/copilot-setup-steps.yml @@ -20,7 +20,7 @@ jobs: steps: - name: 🛡️ Harden runner - uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4 + uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 with: egress-policy: audit From a57454861dc2a46d1c0833df4436dc12e15e4066 Mon Sep 17 00:00:00 2001 From: Nikolai Emil Damm Date: Fri, 10 Jul 2026 10:20:19 +0200 Subject: [PATCH 5/5] chore(deps): bump step-security/harden-runner to v2.20.0 in validate-scaffold.yaml --- .github/workflows/validate-scaffold.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/validate-scaffold.yaml b/.github/workflows/validate-scaffold.yaml index 88dc298..d8522c1 100644 --- a/.github/workflows/validate-scaffold.yaml +++ b/.github/workflows/validate-scaffold.yaml @@ -31,7 +31,7 @@ jobs: contents: read # checkout steps: - name: 🛡️ Harden runner - uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4 + uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 with: egress-policy: audit