TPIP

Bump step-security/harden-runner from 2.16.0 to 2.19.0 #191

	name: TPIP

	on:
	pull_request:
	paths:
	- '.github/workflows/tpip.yml'
	- docs/third-party-licenses.json
	- docs/tpip-header.md
	- scripts/tpip-reporter.ts
	- '!*/.md'
	- '!.github/workflows/markdown.yml'
	- '!.github/markdownlint.json'
	- '!.github/markdownlint.jsonc'
	branches:
	- main
	workflow_dispatch:

	concurrency:
	group: ${{ github.workflow }}-${{ github.ref }}
	cancel-in-progress: true

	permissions:
	contents: read

	jobs:
	report:
	permissions:
	# contents: write # for Git to git push # disabled until resurrecting direct git push
	packages: read

	name: Generate report
	runs-on: ubuntu-latest
	steps:
	- name: Harden the runner (Audit all outbound calls)
	uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
	with:
	egress-policy: audit

	- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
	with:
	ref: ${{ github.head_ref }}

	- uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
	env:
	NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
	with:
	node-version-file: package.json
	registry-url: https://npm.pkg.github.com
	package-manager-cache: false

	- name: Install dependencies
	run: npm ci

	- name: Generate third-party licenses report
	run: npm run tpip:report

	- name: Commit changes
	if: false
	run: \|
	git config --local user.email "git@github.com"
	git config --local user.name "GitHub Action"
	git add TPIP.md
	git commit -m "Update third-party licenses report [skip ci]"
	git push

Provide feedback