diff --git a/.github/workflows/actionlint.yaml b/.github/workflows/actionlint.yaml index 21b0de42..09f3c80e 100644 --- a/.github/workflows/actionlint.yaml +++ b/.github/workflows/actionlint.yaml @@ -19,7 +19,7 @@ jobs: contents: read steps: - - uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4 + - uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 with: egress-policy: block allowed-endpoints: > diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml index 49d52e47..79de53ed 100644 --- a/.github/workflows/release.yaml +++ b/.github/workflows/release.yaml @@ -43,7 +43,7 @@ jobs: steps: - name: Harden Runner - uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4 + uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 with: egress-policy: block allowed-endpoints: > diff --git a/.github/workflows/test-apt-faster.yaml b/.github/workflows/test-apt-faster.yaml index 71aca26b..5089ee33 100644 --- a/.github/workflows/test-apt-faster.yaml +++ b/.github/workflows/test-apt-faster.yaml @@ -20,7 +20,7 @@ jobs: steps: - name: Harden the runner (Audit all outbound calls) - uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4 + uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 with: egress-policy: block allowed-endpoints: > diff --git a/.github/workflows/test-argo-workflows.yaml b/.github/workflows/test-argo-workflows.yaml index 06380151..0a19d046 100644 --- a/.github/workflows/test-argo-workflows.yaml +++ b/.github/workflows/test-argo-workflows.yaml @@ -18,7 +18,7 @@ jobs: name: Install Argo Workflows and test presence in path steps: - name: Harden the runner (Audit all outbound calls) - uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4 + uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 with: egress-policy: audit # TODO(harden-runner): switch to block once IPv6 multicast (ff02::1) is supported (kind uses Docker container networking) allowed-endpoints: > @@ -58,7 +58,7 @@ jobs: name: Install Argo CLI only and test presence in path steps: - name: Harden the runner (Audit all outbound calls) - uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4 + uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 with: egress-policy: block allowed-endpoints: > diff --git a/.github/workflows/test-bump-go-version.yaml b/.github/workflows/test-bump-go-version.yaml index e032b8bc..b6a46379 100644 --- a/.github/workflows/test-bump-go-version.yaml +++ b/.github/workflows/test-bump-go-version.yaml @@ -16,7 +16,7 @@ jobs: contents: read steps: - - uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4 + - uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 with: egress-policy: block allowed-endpoints: > @@ -80,7 +80,7 @@ jobs: contents: read steps: - - uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4 + - uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 with: egress-policy: block allowed-endpoints: > @@ -136,7 +136,7 @@ jobs: contents: read steps: - - uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4 + - uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 with: egress-policy: block allowed-endpoints: > @@ -184,7 +184,7 @@ jobs: contents: read steps: - - uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4 + - uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 with: egress-policy: block allowed-endpoints: > diff --git a/.github/workflows/test-git-tag.yaml b/.github/workflows/test-git-tag.yaml index d3b4adb3..61628f1f 100644 --- a/.github/workflows/test-git-tag.yaml +++ b/.github/workflows/test-git-tag.yaml @@ -18,7 +18,7 @@ jobs: name: Test Git Tag steps: - - uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4 + - uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 with: egress-policy: block allowed-endpoints: > diff --git a/.github/workflows/test-gitsign.yaml b/.github/workflows/test-gitsign.yaml index 2b90b3c6..52c45d46 100644 --- a/.github/workflows/test-gitsign.yaml +++ b/.github/workflows/test-gitsign.yaml @@ -30,7 +30,7 @@ jobs: name: Install Gitsign and test presence in path steps: - name: Harden the runner (Audit all outbound calls) - uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4 + uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 with: egress-policy: block allowed-endpoints: > diff --git a/.github/workflows/test-matrix-extra-inputs.yaml b/.github/workflows/test-matrix-extra-inputs.yaml index 570cba05..ab733952 100644 --- a/.github/workflows/test-matrix-extra-inputs.yaml +++ b/.github/workflows/test-matrix-extra-inputs.yaml @@ -13,7 +13,7 @@ jobs: contents: read steps: - - uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4 + - uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 with: egress-policy: block allowed-endpoints: > diff --git a/.github/workflows/test-otel-export.yaml b/.github/workflows/test-otel-export.yaml index 74b39657..46ab5550 100644 --- a/.github/workflows/test-otel-export.yaml +++ b/.github/workflows/test-otel-export.yaml @@ -17,7 +17,7 @@ jobs: steps: - name: Harden the runner (Audit all outbound calls) - uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4 + uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 with: egress-policy: block allowed-endpoints: > diff --git a/.github/workflows/test-setup-eksctl.yaml b/.github/workflows/test-setup-eksctl.yaml index 80149feb..f92f0531 100644 --- a/.github/workflows/test-setup-eksctl.yaml +++ b/.github/workflows/test-setup-eksctl.yaml @@ -20,7 +20,7 @@ jobs: steps: - name: Harden the runner (Audit all outbound calls) - uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4 + uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 with: egress-policy: block allowed-endpoints: > diff --git a/.github/workflows/test-setup-hakn.yaml b/.github/workflows/test-setup-hakn.yaml index 553f7eb2..062e8783 100644 --- a/.github/workflows/test-setup-hakn.yaml +++ b/.github/workflows/test-setup-hakn.yaml @@ -24,7 +24,7 @@ jobs: name: Install hakn (Knative + Istio) and verify it comes up steps: - name: Harden the runner (Audit all outbound calls) - uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4 + uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 with: egress-policy: audit # TODO(harden-runner): switch to block once IPv6 multicast (ff02::1) is supported (kind uses Docker container networking) diff --git a/.github/workflows/test-setup-kind.yaml b/.github/workflows/test-setup-kind.yaml index f9774bb1..a9063715 100644 --- a/.github/workflows/test-setup-kind.yaml +++ b/.github/workflows/test-setup-kind.yaml @@ -58,7 +58,7 @@ jobs: contents: read steps: - - uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4 + - uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 with: egress-policy: audit # TODO(harden-runner): switch to block once IPv6 multicast (ff02::1) is supported allowed-endpoints: > @@ -163,7 +163,7 @@ jobs: contents: read steps: - - uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4 + - uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 with: egress-policy: audit allowed-endpoints: > @@ -232,7 +232,7 @@ jobs: contents: read steps: - - uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4 + - uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 with: egress-policy: audit allowed-endpoints: > diff --git a/.github/workflows/test-setup-knative-eventing.yaml b/.github/workflows/test-setup-knative-eventing.yaml index 9806a06f..f80788c5 100644 --- a/.github/workflows/test-setup-knative-eventing.yaml +++ b/.github/workflows/test-setup-knative-eventing.yaml @@ -24,7 +24,7 @@ jobs: name: Install Knative Eventing and verify it comes up steps: - name: Harden the runner (Audit all outbound calls) - uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4 + uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 with: egress-policy: audit # TODO(harden-runner): switch to block once IPv6 multicast (ff02::1) is supported (kind uses Docker container networking) diff --git a/.github/workflows/test-setup-melange.yaml b/.github/workflows/test-setup-melange.yaml index 15dea32c..d9cc02df 100644 --- a/.github/workflows/test-setup-melange.yaml +++ b/.github/workflows/test-setup-melange.yaml @@ -26,7 +26,7 @@ jobs: fail-fast: false steps: - - uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4 + - uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 with: egress-policy: block allowed-endpoints: > @@ -63,7 +63,7 @@ jobs: contents: read steps: - - uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4 + - uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 with: egress-policy: block allowed-endpoints: > diff --git a/.github/workflows/test-setup-monitoring.yaml b/.github/workflows/test-setup-monitoring.yaml index 771dc150..27740cf7 100644 --- a/.github/workflows/test-setup-monitoring.yaml +++ b/.github/workflows/test-setup-monitoring.yaml @@ -25,7 +25,7 @@ jobs: name: Install monitoring stack and verify it comes up steps: - name: Harden the runner (Audit all outbound calls) - uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4 + uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 with: egress-policy: audit # TODO(harden-runner): switch to block once IPv6 multicast (ff02::1) is supported (kind uses Docker container networking) diff --git a/.github/workflows/test-setup-registry.yaml b/.github/workflows/test-setup-registry.yaml index 827c2df1..183ac745 100644 --- a/.github/workflows/test-setup-registry.yaml +++ b/.github/workflows/test-setup-registry.yaml @@ -16,7 +16,7 @@ jobs: contents: read steps: - - uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4 + - uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 with: egress-policy: block allowed-endpoints: > @@ -53,7 +53,7 @@ jobs: contents: read steps: - - uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4 + - uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 with: egress-policy: block allowed-endpoints: > diff --git a/.github/workflows/test-setup-terraform.yaml b/.github/workflows/test-setup-terraform.yaml index 5efd2bca..44bcd3a9 100644 --- a/.github/workflows/test-setup-terraform.yaml +++ b/.github/workflows/test-setup-terraform.yaml @@ -19,7 +19,7 @@ jobs: name: Install terraform with a custom path of .terraform-version file steps: - name: Harden the runner (Audit all outbound calls) - uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4 + uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 with: egress-policy: block allowed-endpoints: > @@ -69,7 +69,7 @@ jobs: name: Install terraform with a default action version as there is no .terraform-version file steps: - name: Harden the runner (Audit all outbound calls) - uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4 + uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 with: egress-policy: block allowed-endpoints: > diff --git a/.github/workflows/test-shellcheck.yaml b/.github/workflows/test-shellcheck.yaml index 2bbc7d20..89c3f0f4 100644 --- a/.github/workflows/test-shellcheck.yaml +++ b/.github/workflows/test-shellcheck.yaml @@ -20,7 +20,7 @@ jobs: steps: - name: Harden the runner (Audit all outbound calls) - uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4 + uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 with: egress-policy: block allowed-endpoints: > diff --git a/.github/workflows/test-terraform-docs.yaml b/.github/workflows/test-terraform-docs.yaml index 254fb4dd..43acc1d7 100644 --- a/.github/workflows/test-terraform-docs.yaml +++ b/.github/workflows/test-terraform-docs.yaml @@ -29,7 +29,7 @@ jobs: name: Install Terraform Docs and test presence in path steps: - name: Harden the runner (Audit all outbound calls) - uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4 + uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 with: egress-policy: block allowed-endpoints: > diff --git a/.github/workflows/zizmor.yaml b/.github/workflows/zizmor.yaml index e046c1ca..d96a0733 100644 --- a/.github/workflows/zizmor.yaml +++ b/.github/workflows/zizmor.yaml @@ -20,7 +20,7 @@ jobs: contents: read # Clone the repository security-events: write # Upload SARIF results to Code Scanning steps: - - uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4 + - uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 with: egress-policy: block allowed-endpoints: >