From 8fe59b07335a9c9aa1e05bebc993974463d593fa Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Thu, 5 Nov 2026 08:23:03 +0000 Subject: [PATCH] chore(deps): bump step-security/harden-runner from 2.22.2 to 2.22.3 Bumps [step-security/harden-runner](https://github.com/step-security/harden-runner) from 2.22.2 to 2.22.3. - [Release notes](https://github.com/step-security/harden-runner/releases) - [Commits](https://github.com/step-security/harden-runner/compare/dc2769abcc0fcfbadfc1df54081c1608579ef6b2...46b06cea07f9e64621fdf066ba77ac6915163d43) --- updated-dependencies: - dependency-name: step-security/harden-runner dependency-version: 2.22.3 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] --- .github/workflows/ci.yaml | 4 ++-- .github/workflows/publish-coroot-checkpoint-hotfix.yaml | 4 ++-- .github/workflows/publish-coroot-node-agent-hotfix.yaml | 4 ++-- .github/workflows/publish-kubescape-node-agent-hotfix.yaml | 4 ++-- .github/workflows/publish-kubescape-storage-hotfix.yaml | 4 ++-- .github/workflows/publish-kyverno-background-hotfix.yaml | 4 ++-- .github/workflows/publish-kyverno-migration-runtime.yaml | 4 ++-- .github/workflows/publish-kyverno-reports-hotfix.yaml | 4 ++-- .github/workflows/publish-private-mail-bootstrap.yaml | 4 ++-- .github/workflows/publish-release-recovery.yaml | 4 ++-- .github/workflows/publish-unsigned-probe-image.yaml | 2 +- .../regenerate-publish-workflow-approved-revisions.yaml | 2 +- .github/workflows/validate-coroot-security-progress.yaml | 4 ++-- .github/workflows/verify-arc-runner-group-capability.yaml | 2 +- 14 files changed, 25 insertions(+), 25 deletions(-) diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index c082ab3fc..475b3da01 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -809,7 +809,7 @@ jobs: permissions: {} steps: - name: "\U0001F6E1️ Harden runner" - uses: step-security/harden-runner@dc2769abcc0fcfbadfc1df54081c1608579ef6b2 # v2.22.2 + uses: step-security/harden-runner@46b06cea07f9e64621fdf066ba77ac6915163d43 # v2.22.3 with: egress-policy: audit - name: "\U0001F4D1 Download immutable recovery source" @@ -3719,7 +3719,7 @@ jobs: contents: read # checkout repository steps: - name: 🛡️ Harden runner - uses: step-security/harden-runner@dc2769abcc0fcfbadfc1df54081c1608579ef6b2 # v2.22.2 + uses: step-security/harden-runner@46b06cea07f9e64621fdf066ba77ac6915163d43 # v2.22.3 with: egress-policy: audit diff --git a/.github/workflows/publish-coroot-checkpoint-hotfix.yaml b/.github/workflows/publish-coroot-checkpoint-hotfix.yaml index 534aa8bfe..586d76fe4 100644 --- a/.github/workflows/publish-coroot-checkpoint-hotfix.yaml +++ b/.github/workflows/publish-coroot-checkpoint-hotfix.yaml @@ -55,7 +55,7 @@ jobs: IMAGE_TAG: ${{ matrix.version }}-${{ github.sha }} steps: - name: Harden runner - uses: step-security/harden-runner@dc2769abcc0fcfbadfc1df54081c1608579ef6b2 # v2.22.2 + uses: step-security/harden-runner@46b06cea07f9e64621fdf066ba77ac6915163d43 # v2.22.3 with: egress-policy: audit @@ -139,7 +139,7 @@ jobs: IMAGE_TAG: ${{ matrix.version }}-${{ github.sha }} steps: - name: Harden runner - uses: step-security/harden-runner@dc2769abcc0fcfbadfc1df54081c1608579ef6b2 # v2.22.2 + uses: step-security/harden-runner@46b06cea07f9e64621fdf066ba77ac6915163d43 # v2.22.3 with: egress-policy: audit diff --git a/.github/workflows/publish-coroot-node-agent-hotfix.yaml b/.github/workflows/publish-coroot-node-agent-hotfix.yaml index 3c649d50b..cdda0abdd 100644 --- a/.github/workflows/publish-coroot-node-agent-hotfix.yaml +++ b/.github/workflows/publish-coroot-node-agent-hotfix.yaml @@ -45,7 +45,7 @@ jobs: contents: read steps: - name: Harden runner - uses: step-security/harden-runner@dc2769abcc0fcfbadfc1df54081c1608579ef6b2 # v2.22.2 + uses: step-security/harden-runner@46b06cea07f9e64621fdf066ba77ac6915163d43 # v2.22.3 with: egress-policy: audit @@ -144,7 +144,7 @@ jobs: id-token: write steps: - name: Harden runner - uses: step-security/harden-runner@dc2769abcc0fcfbadfc1df54081c1608579ef6b2 # v2.22.2 + uses: step-security/harden-runner@46b06cea07f9e64621fdf066ba77ac6915163d43 # v2.22.3 with: egress-policy: audit diff --git a/.github/workflows/publish-kubescape-node-agent-hotfix.yaml b/.github/workflows/publish-kubescape-node-agent-hotfix.yaml index e9ff8173c..baa624b3b 100644 --- a/.github/workflows/publish-kubescape-node-agent-hotfix.yaml +++ b/.github/workflows/publish-kubescape-node-agent-hotfix.yaml @@ -37,7 +37,7 @@ jobs: contents: read steps: - name: Harden runner - uses: step-security/harden-runner@dc2769abcc0fcfbadfc1df54081c1608579ef6b2 # v2.22.2 + uses: step-security/harden-runner@46b06cea07f9e64621fdf066ba77ac6915163d43 # v2.22.3 with: egress-policy: audit @@ -104,7 +104,7 @@ jobs: id-token: write steps: - name: Harden runner - uses: step-security/harden-runner@dc2769abcc0fcfbadfc1df54081c1608579ef6b2 # v2.22.2 + uses: step-security/harden-runner@46b06cea07f9e64621fdf066ba77ac6915163d43 # v2.22.3 with: egress-policy: audit diff --git a/.github/workflows/publish-kubescape-storage-hotfix.yaml b/.github/workflows/publish-kubescape-storage-hotfix.yaml index 554f5f619..425673d4f 100644 --- a/.github/workflows/publish-kubescape-storage-hotfix.yaml +++ b/.github/workflows/publish-kubescape-storage-hotfix.yaml @@ -53,7 +53,7 @@ jobs: contents: read steps: - name: Harden runner - uses: step-security/harden-runner@dc2769abcc0fcfbadfc1df54081c1608579ef6b2 # v2.22.2 + uses: step-security/harden-runner@46b06cea07f9e64621fdf066ba77ac6915163d43 # v2.22.3 with: egress-policy: audit @@ -163,7 +163,7 @@ jobs: id-token: write steps: - name: Harden runner - uses: step-security/harden-runner@dc2769abcc0fcfbadfc1df54081c1608579ef6b2 # v2.22.2 + uses: step-security/harden-runner@46b06cea07f9e64621fdf066ba77ac6915163d43 # v2.22.3 with: egress-policy: audit diff --git a/.github/workflows/publish-kyverno-background-hotfix.yaml b/.github/workflows/publish-kyverno-background-hotfix.yaml index 21dcccf35..61faec737 100644 --- a/.github/workflows/publish-kyverno-background-hotfix.yaml +++ b/.github/workflows/publish-kyverno-background-hotfix.yaml @@ -37,7 +37,7 @@ jobs: contents: read steps: - name: Harden runner - uses: step-security/harden-runner@dc2769abcc0fcfbadfc1df54081c1608579ef6b2 # v2.22.2 + uses: step-security/harden-runner@46b06cea07f9e64621fdf066ba77ac6915163d43 # v2.22.3 with: egress-policy: audit @@ -116,7 +116,7 @@ jobs: id-token: write # obtain the keyless cosign signing certificate steps: - name: Harden runner - uses: step-security/harden-runner@dc2769abcc0fcfbadfc1df54081c1608579ef6b2 # v2.22.2 + uses: step-security/harden-runner@46b06cea07f9e64621fdf066ba77ac6915163d43 # v2.22.3 with: egress-policy: audit diff --git a/.github/workflows/publish-kyverno-migration-runtime.yaml b/.github/workflows/publish-kyverno-migration-runtime.yaml index 1b6e9b450..f785e5e53 100644 --- a/.github/workflows/publish-kyverno-migration-runtime.yaml +++ b/.github/workflows/publish-kyverno-migration-runtime.yaml @@ -37,7 +37,7 @@ jobs: contents: read # checkout the reviewed sources steps: - name: Harden runner - uses: step-security/harden-runner@dc2769abcc0fcfbadfc1df54081c1608579ef6b2 # v2.22.2 + uses: step-security/harden-runner@46b06cea07f9e64621fdf066ba77ac6915163d43 # v2.22.3 with: egress-policy: audit @@ -107,7 +107,7 @@ jobs: id-token: write # keyless signing through the protected workflow identity steps: - name: Harden runner - uses: step-security/harden-runner@dc2769abcc0fcfbadfc1df54081c1608579ef6b2 # v2.22.2 + uses: step-security/harden-runner@46b06cea07f9e64621fdf066ba77ac6915163d43 # v2.22.3 with: egress-policy: audit diff --git a/.github/workflows/publish-kyverno-reports-hotfix.yaml b/.github/workflows/publish-kyverno-reports-hotfix.yaml index 88ce2ce35..dd4ff06cf 100644 --- a/.github/workflows/publish-kyverno-reports-hotfix.yaml +++ b/.github/workflows/publish-kyverno-reports-hotfix.yaml @@ -37,7 +37,7 @@ jobs: contents: read steps: - name: Harden runner - uses: step-security/harden-runner@dc2769abcc0fcfbadfc1df54081c1608579ef6b2 # v2.22.2 + uses: step-security/harden-runner@46b06cea07f9e64621fdf066ba77ac6915163d43 # v2.22.3 with: egress-policy: audit @@ -105,7 +105,7 @@ jobs: id-token: write steps: - name: Harden runner - uses: step-security/harden-runner@dc2769abcc0fcfbadfc1df54081c1608579ef6b2 # v2.22.2 + uses: step-security/harden-runner@46b06cea07f9e64621fdf066ba77ac6915163d43 # v2.22.3 with: egress-policy: audit diff --git a/.github/workflows/publish-private-mail-bootstrap.yaml b/.github/workflows/publish-private-mail-bootstrap.yaml index 1426f887b..511dbda83 100644 --- a/.github/workflows/publish-private-mail-bootstrap.yaml +++ b/.github/workflows/publish-private-mail-bootstrap.yaml @@ -35,7 +35,7 @@ jobs: contents: read steps: - name: Harden runner - uses: step-security/harden-runner@dc2769abcc0fcfbadfc1df54081c1608579ef6b2 # v2.22.2 + uses: step-security/harden-runner@46b06cea07f9e64621fdf066ba77ac6915163d43 # v2.22.3 with: egress-policy: audit - name: Check out reviewed source @@ -69,7 +69,7 @@ jobs: id-token: write steps: - name: Harden runner - uses: step-security/harden-runner@dc2769abcc0fcfbadfc1df54081c1608579ef6b2 # v2.22.2 + uses: step-security/harden-runner@46b06cea07f9e64621fdf066ba77ac6915163d43 # v2.22.3 with: egress-policy: audit - name: Check out reviewed source diff --git a/.github/workflows/publish-release-recovery.yaml b/.github/workflows/publish-release-recovery.yaml index 519409427..b6ee0344a 100644 --- a/.github/workflows/publish-release-recovery.yaml +++ b/.github/workflows/publish-release-recovery.yaml @@ -54,7 +54,7 @@ jobs: permissions: {} steps: - name: 🛡️ Harden runner - uses: step-security/harden-runner@dc2769abcc0fcfbadfc1df54081c1608579ef6b2 # v2.22.2 + uses: step-security/harden-runner@46b06cea07f9e64621fdf066ba77ac6915163d43 # v2.22.3 with: egress-policy: audit - name: 🔎 Admit manual, confirmed default-branch invocation @@ -237,7 +237,7 @@ jobs: permissions: {} steps: - name: 🛡️ Harden runner - uses: step-security/harden-runner@dc2769abcc0fcfbadfc1df54081c1608579ef6b2 # v2.22.2 + uses: step-security/harden-runner@46b06cea07f9e64621fdf066ba77ac6915163d43 # v2.22.3 with: egress-policy: audit - name: 📑 Download immutable recovery source diff --git a/.github/workflows/publish-unsigned-probe-image.yaml b/.github/workflows/publish-unsigned-probe-image.yaml index 9cbb10b99..147086e7f 100644 --- a/.github/workflows/publish-unsigned-probe-image.yaml +++ b/.github/workflows/publish-unsigned-probe-image.yaml @@ -90,7 +90,7 @@ jobs: fi - name: 🛡️ Harden runner - uses: step-security/harden-runner@dc2769abcc0fcfbadfc1df54081c1608579ef6b2 # v2.22.2 + uses: step-security/harden-runner@46b06cea07f9e64621fdf066ba77ac6915163d43 # v2.22.3 with: egress-policy: audit diff --git a/.github/workflows/regenerate-publish-workflow-approved-revisions.yaml b/.github/workflows/regenerate-publish-workflow-approved-revisions.yaml index af9f4c331..4123aeefb 100644 --- a/.github/workflows/regenerate-publish-workflow-approved-revisions.yaml +++ b/.github/workflows/regenerate-publish-workflow-approved-revisions.yaml @@ -51,7 +51,7 @@ jobs: contents: read # checkout repository; the App token carries every write steps: - name: 🛡️ Harden runner - uses: step-security/harden-runner@dc2769abcc0fcfbadfc1df54081c1608579ef6b2 # v2.22.2 + uses: step-security/harden-runner@46b06cea07f9e64621fdf066ba77ac6915163d43 # v2.22.3 with: egress-policy: audit diff --git a/.github/workflows/validate-coroot-security-progress.yaml b/.github/workflows/validate-coroot-security-progress.yaml index c8101198f..74b74cf98 100644 --- a/.github/workflows/validate-coroot-security-progress.yaml +++ b/.github/workflows/validate-coroot-security-progress.yaml @@ -41,7 +41,7 @@ jobs: contents: read steps: - name: Harden runner - uses: step-security/harden-runner@dc2769abcc0fcfbadfc1df54081c1608579ef6b2 # v2.22.2 + uses: step-security/harden-runner@46b06cea07f9e64621fdf066ba77ac6915163d43 # v2.22.3 with: egress-policy: audit @@ -153,7 +153,7 @@ jobs: PLAYWRIGHT_VERSION: 1.56.1 steps: - name: Harden runner - uses: step-security/harden-runner@dc2769abcc0fcfbadfc1df54081c1608579ef6b2 # v2.22.2 + uses: step-security/harden-runner@46b06cea07f9e64621fdf066ba77ac6915163d43 # v2.22.3 with: egress-policy: audit diff --git a/.github/workflows/verify-arc-runner-group-capability.yaml b/.github/workflows/verify-arc-runner-group-capability.yaml index f90916f88..57ba9ecd5 100644 --- a/.github/workflows/verify-arc-runner-group-capability.yaml +++ b/.github/workflows/verify-arc-runner-group-capability.yaml @@ -37,7 +37,7 @@ jobs: [[ "${DISPATCH_REF}" == refs/heads/main && "${CONFIRM}" == verify-arc-runner-group-capability && "${GITHUB_RUN_ATTEMPT}" == 1 ]] printf 'KUBECONFIG=%s/arc-group-kubeconfig\n' "${RUNNER_TEMP}" >> "${GITHUB_ENV}" - name: Harden runner - uses: step-security/harden-runner@dc2769abcc0fcfbadfc1df54081c1608579ef6b2 # v2.22.2 + uses: step-security/harden-runner@46b06cea07f9e64621fdf066ba77ac6915163d43 # v2.22.3 with: egress-policy: audit - name: Checkout immutable source