diff --git a/.github/workflows/automation.yml b/.github/workflows/automation.yml index 15f59445..0aad85eb 100644 --- a/.github/workflows/automation.yml +++ b/.github/workflows/automation.yml @@ -56,7 +56,7 @@ jobs: steps: - name: Harden Runner # step-security/harden-runner v2.20.0; observe egress before enforcing. - uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c + uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 with: egress-policy: audit diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 9829e36d..c8631b6f 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -40,7 +40,7 @@ jobs: steps: - name: Harden Runner # step-security/harden-runner v2.20.0; observe egress before enforcing. - uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c + uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 with: egress-policy: audit @@ -52,12 +52,12 @@ jobs: - name: Initialize CodeQL # github/codeql-action v4.37.6 - uses: github/codeql-action/init@cdf488f595d80d6e07e03d4674febd5ab45fa938 + uses: github/codeql-action/init@b96794f015dfd88f77b49b1c93e0fa7110f94c63 with: languages: "${{ matrix.language }}" - name: Analyze repository # github/codeql-action v4.37.6 - uses: github/codeql-action/analyze@cdf488f595d80d6e07e03d4674febd5ab45fa938 + uses: github/codeql-action/analyze@b96794f015dfd88f77b49b1c93e0fa7110f94c63 with: category: "/language:${{ matrix.language }}" diff --git a/.github/workflows/commitlint.yml b/.github/workflows/commitlint.yml index fc9fadbd..4eea9df7 100644 --- a/.github/workflows/commitlint.yml +++ b/.github/workflows/commitlint.yml @@ -27,7 +27,7 @@ jobs: steps: - name: Harden Runner # step-security/harden-runner v2.20.0; observe egress before enforcing. - uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c + uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 with: egress-policy: audit diff --git a/.github/workflows/contributors.yml b/.github/workflows/contributors.yml index 9a39b827..cba17556 100644 --- a/.github/workflows/contributors.yml +++ b/.github/workflows/contributors.yml @@ -22,7 +22,7 @@ jobs: steps: - name: Harden Runner # step-security/harden-runner v2.20.0; observe egress before enforcing. - uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c + uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 with: egress-policy: audit diff --git a/.github/workflows/copilot-setup-steps.yml b/.github/workflows/copilot-setup-steps.yml index a1a74214..d8cbdead 100644 --- a/.github/workflows/copilot-setup-steps.yml +++ b/.github/workflows/copilot-setup-steps.yml @@ -35,7 +35,7 @@ jobs: steps: - name: Harden Runner # step-security/harden-runner v2.20.0 - uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c + uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 with: egress-policy: audit diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml index 0449b910..5ac37f48 100644 --- a/.github/workflows/dependency-review.yml +++ b/.github/workflows/dependency-review.yml @@ -29,7 +29,7 @@ jobs: steps: - name: Harden Runner # step-security/harden-runner v2.20.0; observe egress before enforcing. - uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c + uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 with: egress-policy: audit diff --git a/.github/workflows/identity.yml b/.github/workflows/identity.yml index 568c1dc4..965e4e74 100644 --- a/.github/workflows/identity.yml +++ b/.github/workflows/identity.yml @@ -45,7 +45,7 @@ jobs: timeout-minutes: 20 steps: - name: Harden Runner - uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c + uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 with: egress-policy: audit - name: Checkout repository and pinned Identity source diff --git a/.github/workflows/lint-architecture.yml b/.github/workflows/lint-architecture.yml index 4907fa0e..50124131 100644 --- a/.github/workflows/lint-architecture.yml +++ b/.github/workflows/lint-architecture.yml @@ -50,7 +50,7 @@ jobs: steps: - name: Harden Runner # step-security/harden-runner v2.20.0; observe egress before enforcing. - uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c + uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 with: egress-policy: audit @@ -88,7 +88,7 @@ jobs: steps: - name: Harden Runner # step-security/harden-runner v2.20.0; observe egress before enforcing. - uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c + uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 with: egress-policy: audit @@ -114,7 +114,7 @@ jobs: path: .reports/egolint/architecture - name: Publish stable architecture snapshot - uses: egohygiene/relay/actions/publish-report-snapshot@55587de4ff322931d401e964f5af0716633dd675 # v1.3.0 + uses: egohygiene/relay/actions/publish-report-snapshot@b71b090406a3a9e4cd9f107e9d14a623bbecb127 # v1.4.0 with: paths: .reports/egolint/architecture default-branch: "${{ github.event.repository.default_branch }}" diff --git a/.github/workflows/mantle.yml b/.github/workflows/mantle.yml index 93c76da9..44a26153 100644 --- a/.github/workflows/mantle.yml +++ b/.github/workflows/mantle.yml @@ -47,7 +47,7 @@ jobs: steps: - name: Harden Runner # step-security/harden-runner v2.20.0; audit mode supports this matrix. - uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c + uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 with: egress-policy: audit diff --git a/.github/workflows/megalinter-fix.yml b/.github/workflows/megalinter-fix.yml index 337a33ca..62cc7243 100644 --- a/.github/workflows/megalinter-fix.yml +++ b/.github/workflows/megalinter-fix.yml @@ -29,7 +29,7 @@ jobs: steps: - name: Harden Runner # step-security/harden-runner v2.20.0; observe egress before enforcing. - uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c + uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 with: egress-policy: audit @@ -45,7 +45,7 @@ jobs: id: megalinter continue-on-error: true # oxsecurity/megalinter v10.0.0 - uses: oxsecurity/megalinter@15e5b45552097e318c93de385779ce3b1084052c + uses: oxsecurity/megalinter@9949bad031045f366be2467e00e8371a7328a2e2 env: APPLY_FIXES: "${{ inputs.apply-fixes }}" GITHUB_TOKEN: "${{ github.token }}" diff --git a/.github/workflows/megalinter.yml b/.github/workflows/megalinter.yml index 27f775d9..9424c550 100644 --- a/.github/workflows/megalinter.yml +++ b/.github/workflows/megalinter.yml @@ -35,7 +35,7 @@ jobs: steps: - name: Harden Runner # step-security/harden-runner v2.20.0; observe egress before enforcing. - uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c + uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 with: egress-policy: audit @@ -49,7 +49,7 @@ jobs: - name: Run MegaLinter id: megalinter # oxsecurity/megalinter v10.0.0 - uses: oxsecurity/megalinter@15e5b45552097e318c93de385779ce3b1084052c + uses: oxsecurity/megalinter@9949bad031045f366be2467e00e8371a7328a2e2 env: APPLY_FIXES: none GITHUB_TOKEN: "${{ github.token }}" @@ -75,7 +75,7 @@ jobs: - name: Normalize repository-intelligence summary if: always() - uses: egohygiene/relay/actions/normalize-repository-report@55587de4ff322931d401e964f5af0716633dd675 # v1.3.0 + uses: egohygiene/relay/actions/normalize-repository-report@b71b090406a3a9e4cd9f107e9d14a623bbecb127 # v1.4.0 with: producer: megalinter input: .reports/megalinter/mega-linter-report.json @@ -117,7 +117,7 @@ jobs: (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) # github/codeql-action v4.37.6 - uses: github/codeql-action/upload-sarif@cdf488f595d80d6e07e03d4674febd5ab45fa938 + uses: github/codeql-action/upload-sarif@b96794f015dfd88f77b49b1c93e0fa7110f94c63 with: sarif_file: .reports/megalinter/megalinter-report.sarif category: megalinter @@ -150,7 +150,7 @@ jobs: steps: - name: Harden Runner # step-security/harden-runner v2.20.0; observe egress before enforcing. - uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c + uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 with: egress-policy: audit @@ -175,7 +175,7 @@ jobs: path: .reports/megalinter - name: Publish stable MegaLinter snapshot - uses: egohygiene/relay/actions/publish-report-snapshot@55587de4ff322931d401e964f5af0716633dd675 # v1.3.0 + uses: egohygiene/relay/actions/publish-report-snapshot@b71b090406a3a9e4cd9f107e9d14a623bbecb127 # v1.4.0 with: paths: .reports/megalinter default-branch: "${{ github.event.repository.default_branch }}" diff --git a/.github/workflows/mindgarden-pages.yml b/.github/workflows/mindgarden-pages.yml index 04685fb0..fd3f593b 100644 --- a/.github/workflows/mindgarden-pages.yml +++ b/.github/workflows/mindgarden-pages.yml @@ -51,7 +51,7 @@ jobs: steps: - name: Harden Runner # step-security/harden-runner v2.20.0; observe egress before enforcing. - uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c + uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 with: egress-policy: audit @@ -81,7 +81,7 @@ jobs: build - name: Generate repository intelligence dashboard - uses: egohygiene/relay/actions/repository-intelligence@55587de4ff322931d401e964f5af0716633dd675 # v1.3.0 + uses: egohygiene/relay/actions/repository-intelligence@b71b090406a3a9e4cd9f107e9d14a623bbecb127 # v1.4.0 with: output-directory: ".cache/mindgarden/site/intelligence" work-directory: ".cache/mindgarden/repository-intelligence" @@ -131,11 +131,11 @@ jobs: steps: - name: Harden Runner # step-security/harden-runner v2.20.0; observe egress before enforcing. - uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c + uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 with: egress-policy: audit - name: Deploy to GitHub Pages id: deployment # actions/deploy-pages v5.0.0 - uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 + uses: actions/deploy-pages@368f82528645a54fb793d4d04e342629a3f51346 diff --git a/.github/workflows/ossf-scorecard.yml b/.github/workflows/ossf-scorecard.yml index 23a17aef..57f5724f 100644 --- a/.github/workflows/ossf-scorecard.yml +++ b/.github/workflows/ossf-scorecard.yml @@ -35,7 +35,7 @@ jobs: steps: - name: Harden Runner # step-security/harden-runner v2.20.0; observe egress before enforcing. - uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c + uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 with: egress-policy: audit @@ -56,7 +56,7 @@ jobs: - name: Upload SARIF to code scanning if: always() # github/codeql-action v4.37.6 - uses: github/codeql-action/upload-sarif@cdf488f595d80d6e07e03d4674febd5ab45fa938 + uses: github/codeql-action/upload-sarif@b96794f015dfd88f77b49b1c93e0fa7110f94c63 with: sarif_file: results.sarif category: ossf-scorecard @@ -88,7 +88,7 @@ jobs: steps: - name: Harden Runner # step-security/harden-runner v2.20.0; observe egress before enforcing. - uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c + uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 with: egress-policy: audit @@ -160,7 +160,7 @@ jobs: fi - name: Normalize repository-intelligence summary - uses: egohygiene/relay/actions/normalize-repository-report@55587de4ff322931d401e964f5af0716633dd675 # v1.3.0 + uses: egohygiene/relay/actions/normalize-repository-report@b71b090406a3a9e4cd9f107e9d14a623bbecb127 # v1.4.0 with: producer: scorecard input: .cache/scorecard/results.sarif @@ -168,7 +168,7 @@ jobs: scorecard-api-input: "${{ steps.scorecard-api.outputs.path }}" - name: Publish stable Scorecard summary - uses: egohygiene/relay/actions/publish-report-snapshot@55587de4ff322931d401e964f5af0716633dd675 # v1.3.0 + uses: egohygiene/relay/actions/publish-report-snapshot@b71b090406a3a9e4cd9f107e9d14a623bbecb127 # v1.4.0 with: paths: .reports/scorecard default-branch: "${{ github.event.repository.default_branch }}" diff --git a/.github/workflows/osv-scan.yml b/.github/workflows/osv-scan.yml index fd28f676..cf8ddaec 100644 --- a/.github/workflows/osv-scan.yml +++ b/.github/workflows/osv-scan.yml @@ -114,7 +114,7 @@ jobs: steps: - name: Harden Runner # step-security/harden-runner v2.20.0; observe egress before enforcing. - uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c + uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 with: egress-policy: audit @@ -666,7 +666,7 @@ jobs: PY - name: "🧭 Normalize repository-intelligence summary" - uses: egohygiene/relay/actions/normalize-repository-report@55587de4ff322931d401e964f5af0716633dd675 # v1.3.0 + uses: egohygiene/relay/actions/normalize-repository-report@b71b090406a3a9e4cd9f107e9d14a623bbecb127 # v1.4.0 with: producer: osv input: .reports/osv/summary.json @@ -678,7 +678,7 @@ jobs: (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) # github/codeql-action v4.37.6; immutable release pin. - uses: github/codeql-action/upload-sarif@cdf488f595d80d6e07e03d4674febd5ab45fa938 + uses: github/codeql-action/upload-sarif@b96794f015dfd88f77b49b1c93e0fa7110f94c63 with: sarif_file: ".reports/osv/latest.sarif" category: "osv-scanner" @@ -749,7 +749,7 @@ jobs: steps: - name: Harden Runner # step-security/harden-runner v2.20.0; observe egress before enforcing. - uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c + uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 with: egress-policy: audit @@ -774,7 +774,7 @@ jobs: path: ".reports/osv/" - name: "💾 Publish stable OSV snapshot" - uses: egohygiene/relay/actions/publish-report-snapshot@55587de4ff322931d401e964f5af0716633dd675 # v1.3.0 + uses: egohygiene/relay/actions/publish-report-snapshot@b71b090406a3a9e4cd9f107e9d14a623bbecb127 # v1.4.0 with: paths: .reports/osv default-branch: "${{ github.event.repository.default_branch }}" diff --git a/.github/workflows/repository-intelligence.yml b/.github/workflows/repository-intelligence.yml index 67e0c951..59eed74a 100644 --- a/.github/workflows/repository-intelligence.yml +++ b/.github/workflows/repository-intelligence.yml @@ -43,7 +43,7 @@ jobs: steps: - name: Harden Runner # step-security/harden-runner v2.20.0; observe egress before enforcing. - uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c + uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 with: egress-policy: audit @@ -55,7 +55,7 @@ jobs: persist-credentials: false - name: Generate intelligence artifacts and dashboard - uses: egohygiene/relay/actions/repository-intelligence@55587de4ff322931d401e964f5af0716633dd675 # v1.3.0 + uses: egohygiene/relay/actions/repository-intelligence@b71b090406a3a9e4cd9f107e9d14a623bbecb127 # v1.4.0 with: output-directory: "${{ inputs.dashboard-output-root }}" work-directory: "${{ inputs.output-root }}" diff --git a/.github/workflows/reusable-autofix.yml b/.github/workflows/reusable-autofix.yml index 034dbc84..2183043d 100644 --- a/.github/workflows/reusable-autofix.yml +++ b/.github/workflows/reusable-autofix.yml @@ -49,7 +49,7 @@ jobs: steps: - name: Harden Runner # step-security/harden-runner v2.20.0 - uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c + uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 with: egress-policy: audit diff --git a/.github/workflows/reusable-flutter-build.yml b/.github/workflows/reusable-flutter-build.yml index 16e342bd..38eba210 100644 --- a/.github/workflows/reusable-flutter-build.yml +++ b/.github/workflows/reusable-flutter-build.yml @@ -53,7 +53,7 @@ jobs: timeout-minutes: 30 steps: - name: Harden Runner - uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c + uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 with: egress-policy: audit - name: Checkout repository @@ -86,7 +86,7 @@ jobs: timeout-minutes: 30 steps: - name: Harden Runner - uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c + uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 with: egress-policy: audit - name: Checkout repository @@ -121,7 +121,7 @@ jobs: timeout-minutes: 30 steps: - name: Harden Runner - uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c + uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 with: egress-policy: audit - name: Checkout repository