From 4c231c5c143c8f4f7de22ae8b2bed62ede72cfb3 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Fri, 26 Jun 2026 09:24:06 +0000 Subject: [PATCH] chore(deps): bump step-security/harden-runner Bumps the minor-and-patch group with 1 update: [step-security/harden-runner](https://github.com/step-security/harden-runner). Updates `step-security/harden-runner` from 2.10.2 to 2.19.4 - [Release notes](https://github.com/step-security/harden-runner/releases) - [Commits](https://github.com/step-security/harden-runner/compare/0080882f6c36860b6ba35c610c98ce87d4e2f26f...9af89fc71515a100421586dfdb3dc9c984fbf411) --- updated-dependencies: - dependency-name: step-security/harden-runner dependency-version: 2.19.4 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch ... Signed-off-by: dependabot[bot] --- .github/workflows/agent-team-apply-verify.yml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/workflows/agent-team-apply-verify.yml b/.github/workflows/agent-team-apply-verify.yml index 9caaea0..a54f651 100644 --- a/.github/workflows/agent-team-apply-verify.yml +++ b/.github/workflows/agent-team-apply-verify.yml @@ -136,7 +136,7 @@ jobs: permissions: {} steps: - name: Harden runner (block egress; no secrets present) - uses: step-security/harden-runner@0080882f6c36860b6ba35c610c98ce87d4e2f26f # v2.10.2 + uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4 with: egress-policy: block allowed-endpoints: > @@ -195,7 +195,7 @@ jobs: diff_hash: ${{ steps.verify.outputs.diff_hash }} steps: - name: Harden runner (egress audit; no secrets present anyway) - uses: step-security/harden-runner@0080882f6c36860b6ba35c610c98ce87d4e2f26f # v2.10.2 + uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4 with: egress-policy: block # Only what fetching the artifact + GitHub API needs. The job holds @@ -605,7 +605,7 @@ jobs: contents: read steps: - name: Harden runner (block egress — untrusted code runs here) - uses: step-security/harden-runner@0080882f6c36860b6ba35c610c98ce87d4e2f26f # v2.10.2 + uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4 with: # Block, not audit: this is where untrusted patch code executes. A # narrow allowlist for dependency resolution only; everything else is @@ -1102,7 +1102,7 @@ jobs: # workflow uses a GitHub App installation token only, no cloud provider. steps: - name: Harden runner (privileged job; block egress) - uses: step-security/harden-runner@0080882f6c36860b6ba35c610c98ce87d4e2f26f # v2.10.2 + uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4 with: # DEPLOY: this allowlist is GitHub API only (App-token mint + gh pr # create). Trim/confirm per target repo at provisioning — an