Skip to content

dep(workflows): bump step-security/harden-runner from 2.16.1 to 2.19.0#439

Merged
JakobJingleheimer merged 2 commits into
mainfrom
dependabot/github_actions/step-security/harden-runner-2.19.0
Apr 26, 2026
Merged

dep(workflows): bump step-security/harden-runner from 2.16.1 to 2.19.0#439
JakobJingleheimer merged 2 commits into
mainfrom
dependabot/github_actions/step-security/harden-runner-2.19.0

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Apr 26, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps step-security/harden-runner from 2.16.1 to 2.19.0.

Release notes

Sourced from step-security/harden-runner's releases.

v2.19.0

What's Changed

New Runner Support

Harden-Runner now supports Depot, Blacksmith, Namespace, and WarpBuild runners with the same egress monitoring, runtime monitoring, and policy enforcement available on GitHub-hosted runners.

Automated Incident Response for Supply Chain Attacks

  • Global block list: Outbound connections to known malicious domains and IPs are now blocked even in audit mode.
  • System-defined detection rules: Harden-Runner will trigger lockdown mode when a high risk event is detected during an active supply chain attack (for example, a process reading the memory of the runner worker process, a common technique for stealing GitHub Actions secrets).

Bug Fixes

Windows and macOS: stability and reliability fixes

Full Changelog: step-security/harden-runner@v2.18.0...v2.19.0

v2.18.0

What's Changed

Global Block List: During supply chain incidents like the recent axios and trivy compromises, StepSecurity will add known malicious domains and IP addresses (IOCs) to a global block list. These will be automatically blocked, even in audit mode, providing immediate protection without requiring any workflow changes.

Deploy on Self-Hosted VM: Added deploy-on-self-hosted-vm input that allows the Harden Runner agent to be installed directly on ephemeral self-hosted Linux runner VMs at workflow runtime. This is intended as an alternative when baking the agent into the VM image is not possible.

Full Changelog: step-security/harden-runner@v2.17.0...v2.18.0

v2.17.0

What's Changed

Policy Store Support

Added use-policy-store and api-key inputs to fetch security policies directly from the StepSecurity Policy Store. Policies can be defined and attached at the workflow, repo, org, or cluster (ARC) level, with the most granular policy taking precedence. This is the preferred method over the existing policy input which requires id-token: write permission. If no policy is found in the store, the action defaults to audit mode.

Full Changelog: step-security/harden-runner@v2.16.1...v2.17.0

Commits

@dependabot dependabot Bot added the gh actions Pull requests that update GitHub Actions code label Apr 26, 2026
@JakobJingleheimer JakobJingleheimer added the dependencies Pull requests that update a dependency file label Apr 26, 2026
@JakobJingleheimer JakobJingleheimer changed the title ci: bump step-security/harden-runner from 2.16.1 to 2.19.0 deps(ci): bump step-security/harden-runner from 2.16.1 to 2.19.0 Apr 26, 2026
AugustinMauroy
AugustinMauroy approved these changes Apr 26, 2026
View reviewed changes

@AugustinMauroy AugustinMauroy left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

WTF it's also catch hash in comment

@JakobJingleheimer

JakobJingleheimer commented Apr 26, 2026

Copy link
Copy Markdown
Member

WTF it's also catch hash in comment

huh?

AugustinMauroy
AugustinMauroy reviewed Apr 26, 2026
View reviewed changes
Comment thread .github/workflows/ci.yml
@dependabot dependabot Bot changed the title deps(ci): bump step-security/harden-runner from 2.16.1 to 2.19.0 dep: bump step-security/harden-runner from 2.16.1 to 2.19.0 Apr 26, 2026
@dependabot dependabot Bot force-pushed the dependabot/github_actions/step-security/harden-runner-2.19.0 branch from 8881a38 to 7d391ad Compare April 26, 2026 21:15
@JakobJingleheimer

JakobJingleheimer commented Apr 26, 2026

Copy link
Copy Markdown
Member

@dependabot recreate

(it didn't catch the new dir-organisation workflow)

@JakobJingleheimer JakobJingleheimer changed the title dep: bump step-security/harden-runner from 2.16.1 to 2.19.0 dep(workflows): bump step-security/harden-runner from 2.16.1 to 2.19.0 Apr 26, 2026
@dependabot dependabot Bot changed the title dep(workflows): bump step-security/harden-runner from 2.16.1 to 2.19.0 dep: bump step-security/harden-runner from 2.16.1 to 2.19.0 Apr 26, 2026
@dependabot
dep: bump step-security/harden-runner from 2.16.1 to 2.19.0
0b6dce1 
Bumps [step-security/harden-runner](https://github.com/step-security/harden-runner) from 2.16.1 to 2.19.0.
- [Release notes](https://github.com/step-security/harden-runner/releases)
- [Commits](step-security/harden-runner@fe10465...8d3c67d)

---
updated-dependencies:
- dependency-name: step-security/harden-runner
  dependency-version: 2.19.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot force-pushed the dependabot/github_actions/step-security/harden-runner-2.19.0 branch from 7d391ad to 0b6dce1 Compare April 26, 2026 21:16
@JakobJingleheimer JakobJingleheimer changed the title dep: bump step-security/harden-runner from 2.16.1 to 2.19.0 dep(workflows): bump step-security/harden-runner from 2.16.1 to 2.19.0 Apr 26, 2026
@JakobJingleheimer JakobJingleheimer merged commit 27b0850 into main Apr 26, 2026
9 checks passed
@JakobJingleheimer JakobJingleheimer deleted the dependabot/github_actions/step-security/harden-runner-2.19.0 branch April 26, 2026 21:33
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@JakobJingleheimer JakobJingleheimer JakobJingleheimer approved these changes
@AugustinMauroy AugustinMauroy AugustinMauroy approved these changes

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file gh actions Pull requests that update GitHub Actions code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@JakobJingleheimer @AugustinMauroy