diff --git a/.github/workflows/apm-package.yml b/.github/workflows/apm-package.yml index 0de58e2c..4f3a9217 100644 --- a/.github/workflows/apm-package.yml +++ b/.github/workflows/apm-package.yml @@ -46,7 +46,7 @@ jobs: relevant: ${{ steps.diff.outputs.relevant }} steps: - name: Harden the runner - uses: step-security/harden-runner@dc2769abcc0fcfbadfc1df54081c1608579ef6b2 # v2.22.2 + uses: step-security/harden-runner@46b06cea07f9e64621fdf066ba77ac6915163d43 # v2.22.3 with: egress-policy: audit @@ -110,7 +110,7 @@ jobs: steps: - name: Harden the runner if: ${{ needs.changes.result != 'success' || needs.changes.outputs.relevant == 'true' }} - uses: step-security/harden-runner@dc2769abcc0fcfbadfc1df54081c1608579ef6b2 # v2.22.2 + uses: step-security/harden-runner@46b06cea07f9e64621fdf066ba77ac6915163d43 # v2.22.3 with: egress-policy: audit @@ -127,10 +127,10 @@ jobs: # its shims reach PATH, so the steps below call apm directly. - name: Set up mise if: ${{ needs.changes.result != 'success' || needs.changes.outputs.relevant == 'true' }} - uses: jdx/mise-action@82a612c5ab8bcda7cc5db6b7e81a8e7584c3dc6e # v5.2.3 + uses: jdx/mise-action@6be3c7ed4c21d4f76b208d351d95aac273ebb76d # v5.2.4 with: # renovate: datasource=github-releases depName=jdx/mise - version: 2026.10.19 + version: 2026.10.21 install_args: apm # The frozen install comes first because the root manifest carries @@ -171,7 +171,7 @@ jobs: actions: read security-events: write # yamllint disable-line rule:line-length - uses: cisco-ai-defense/skill-scanner/.github/workflows/scan-skills.yml@c615acb70994cdf3f4ba54d955fef2e92ac84437 # 2.3.1 + uses: cisco-ai-defense/skill-scanner/.github/workflows/scan-skills.yml@f7824651ffeb9b89f7682ddd97d6fba8fe9c10b1 # 2.3.2 with: # scan-skills' default scan_mode is scan-all, which always adds # --recursive --check-overlap, and its own docs say skill_path diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index a73b3eaa..3e08ac29 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -50,7 +50,7 @@ jobs: runs-on: ubuntu-24.04 steps: - name: Harden the runner - uses: step-security/harden-runner@dc2769abcc0fcfbadfc1df54081c1608579ef6b2 # v2.22.2 + uses: step-security/harden-runner@46b06cea07f9e64621fdf066ba77ac6915163d43 # v2.22.3 with: egress-policy: audit @@ -65,10 +65,10 @@ jobs: fetch-depth: 0 - name: Set up mise - uses: jdx/mise-action@82a612c5ab8bcda7cc5db6b7e81a8e7584c3dc6e # v5.2.3 + uses: jdx/mise-action@6be3c7ed4c21d4f76b208d351d95aac273ebb76d # v5.2.4 with: # renovate: datasource=github-releases depName=jdx/mise - version: 2026.10.19 + version: 2026.10.21 # mise installs the vale binary but does not fetch the style # packages .vale.ini declares, and the Python linters run from the @@ -97,7 +97,7 @@ jobs: runs-on: ubuntu-24.04 steps: - name: Harden the runner - uses: step-security/harden-runner@dc2769abcc0fcfbadfc1df54081c1608579ef6b2 # v2.22.2 + uses: step-security/harden-runner@46b06cea07f9e64621fdf066ba77ac6915163d43 # v2.22.3 with: egress-policy: audit @@ -110,10 +110,10 @@ jobs: # named in .python-version and restores the locked dependency # closure from uv.lock. - name: Set up mise - uses: jdx/mise-action@82a612c5ab8bcda7cc5db6b7e81a8e7584c3dc6e # v5.2.3 + uses: jdx/mise-action@6be3c7ed4c21d4f76b208d351d95aac273ebb76d # v5.2.4 with: # renovate: datasource=github-releases depName=jdx/mise - version: 2026.10.19 + version: 2026.10.21 install_args: uv - name: Check that uv.lock matches pyproject.toml @@ -145,7 +145,7 @@ jobs: steps: - name: Harden the runner if: runner.os == 'Linux' - uses: step-security/harden-runner@dc2769abcc0fcfbadfc1df54081c1608579ef6b2 # v2.22.2 + uses: step-security/harden-runner@46b06cea07f9e64621fdf066ba77ac6915163d43 # v2.22.3 with: egress-policy: audit @@ -168,10 +168,10 @@ jobs: # Turning the auto-install off leaves install_args as the single # place naming what this job needs. - name: Set up mise - uses: jdx/mise-action@82a612c5ab8bcda7cc5db6b7e81a8e7584c3dc6e # v5.2.3 + uses: jdx/mise-action@6be3c7ed4c21d4f76b208d351d95aac273ebb76d # v5.2.4 with: # renovate: datasource=github-releases depName=jdx/mise - version: 2026.10.19 + version: 2026.10.21 install_args: go aqua:boyter/scc - name: Run tests with coverage @@ -220,7 +220,7 @@ jobs: pull-requests: read steps: - name: Harden the runner - uses: step-security/harden-runner@dc2769abcc0fcfbadfc1df54081c1608579ef6b2 # v2.22.2 + uses: step-security/harden-runner@46b06cea07f9e64621fdf066ba77ac6915163d43 # v2.22.3 with: egress-policy: audit @@ -230,10 +230,10 @@ jobs: persist-credentials: false - name: Set up mise - uses: jdx/mise-action@82a612c5ab8bcda7cc5db6b7e81a8e7584c3dc6e # v5.2.3 + uses: jdx/mise-action@6be3c7ed4c21d4f76b208d351d95aac273ebb76d # v5.2.4 with: # renovate: datasource=github-releases depName=jdx/mise - version: 2026.10.19 + version: 2026.10.21 install_args: go - name: Download per-slot coverage data @@ -260,7 +260,7 @@ jobs: runs-on: ubuntu-24.04 steps: - name: Harden the runner - uses: step-security/harden-runner@dc2769abcc0fcfbadfc1df54081c1608579ef6b2 # v2.22.2 + uses: step-security/harden-runner@46b06cea07f9e64621fdf066ba77ac6915163d43 # v2.22.3 with: egress-policy: audit @@ -270,10 +270,10 @@ jobs: persist-credentials: false - name: Set up mise - uses: jdx/mise-action@82a612c5ab8bcda7cc5db6b7e81a8e7584c3dc6e # v5.2.3 + uses: jdx/mise-action@6be3c7ed4c21d4f76b208d351d95aac273ebb76d # v5.2.4 with: # renovate: datasource=github-releases depName=jdx/mise - version: 2026.10.19 + version: 2026.10.21 install_args: go - name: Run govulncheck @@ -284,7 +284,7 @@ jobs: runs-on: ubuntu-24.04 steps: - name: Harden the runner - uses: step-security/harden-runner@dc2769abcc0fcfbadfc1df54081c1608579ef6b2 # v2.22.2 + uses: step-security/harden-runner@46b06cea07f9e64621fdf066ba77ac6915163d43 # v2.22.3 with: egress-policy: audit @@ -294,10 +294,10 @@ jobs: persist-credentials: false - name: Set up mise - uses: jdx/mise-action@82a612c5ab8bcda7cc5db6b7e81a8e7584c3dc6e # v5.2.3 + uses: jdx/mise-action@6be3c7ed4c21d4f76b208d351d95aac273ebb76d # v5.2.4 with: # renovate: datasource=github-releases depName=jdx/mise - version: 2026.10.19 + version: 2026.10.21 install_args: go - name: Check vendor drift diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index ddb90343..0329f999 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -51,7 +51,7 @@ jobs: build-mode: none steps: - name: Harden the runner - uses: step-security/harden-runner@dc2769abcc0fcfbadfc1df54081c1608579ef6b2 # v2.22.2 + uses: step-security/harden-runner@46b06cea07f9e64621fdf066ba77ac6915163d43 # v2.22.3 with: egress-policy: audit diff --git a/.github/workflows/consumer-lint.yml b/.github/workflows/consumer-lint.yml index 8e8bd9bd..f0d57945 100644 --- a/.github/workflows/consumer-lint.yml +++ b/.github/workflows/consumer-lint.yml @@ -16,7 +16,7 @@ jobs: runs-on: ubuntu-24.04 steps: - name: Harden the runner - uses: step-security/harden-runner@dc2769abcc0fcfbadfc1df54081c1608579ef6b2 # v2.22.2 + uses: step-security/harden-runner@46b06cea07f9e64621fdf066ba77ac6915163d43 # v2.22.3 with: egress-policy: audit @@ -27,10 +27,10 @@ jobs: persist-credentials: false - name: Set up mise - uses: jdx/mise-action@82a612c5ab8bcda7cc5db6b7e81a8e7584c3dc6e # v5.2.3 + uses: jdx/mise-action@6be3c7ed4c21d4f76b208d351d95aac273ebb76d # v5.2.4 with: # renovate: datasource=github-releases depName=jdx/mise - version: 2026.10.19 + version: 2026.10.21 - name: Check vendored tooling run: mise run devtools:check-vendored diff --git a/.github/workflows/fuzz-nightly.yml b/.github/workflows/fuzz-nightly.yml index ce5e04ae..b0cf6814 100644 --- a/.github/workflows/fuzz-nightly.yml +++ b/.github/workflows/fuzz-nightly.yml @@ -49,7 +49,7 @@ jobs: timeout-minutes: 20 steps: - name: Harden the runner - uses: step-security/harden-runner@dc2769abcc0fcfbadfc1df54081c1608579ef6b2 # v2.22.2 + uses: step-security/harden-runner@46b06cea07f9e64621fdf066ba77ac6915163d43 # v2.22.3 with: egress-policy: audit @@ -59,10 +59,10 @@ jobs: persist-credentials: false - name: Set up mise - uses: jdx/mise-action@82a612c5ab8bcda7cc5db6b7e81a8e7584c3dc6e # v5.2.3 + uses: jdx/mise-action@6be3c7ed4c21d4f76b208d351d95aac273ebb76d # v5.2.4 with: # renovate: datasource=github-releases depName=jdx/mise - version: 2026.10.19 + version: 2026.10.21 install_args: go - name: Run fuzz sweep diff --git a/.github/workflows/lint-codeowners.yml b/.github/workflows/lint-codeowners.yml index 3c9dc75b..9021f406 100644 --- a/.github/workflows/lint-codeowners.yml +++ b/.github/workflows/lint-codeowners.yml @@ -51,7 +51,7 @@ jobs: timeout-minutes: 5 steps: - name: Harden the runner - uses: step-security/harden-runner@dc2769abcc0fcfbadfc1df54081c1608579ef6b2 # v2.22.2 + uses: step-security/harden-runner@46b06cea07f9e64621fdf066ba77ac6915163d43 # v2.22.3 with: egress-policy: audit diff --git a/.github/workflows/lint-workflows.yml b/.github/workflows/lint-workflows.yml index 825869e0..1b899ee5 100644 --- a/.github/workflows/lint-workflows.yml +++ b/.github/workflows/lint-workflows.yml @@ -43,7 +43,7 @@ jobs: runs-on: ubuntu-24.04 steps: - name: Harden the runner - uses: step-security/harden-runner@dc2769abcc0fcfbadfc1df54081c1608579ef6b2 # v2.22.2 + uses: step-security/harden-runner@46b06cea07f9e64621fdf066ba77ac6915163d43 # v2.22.3 with: egress-policy: audit diff --git a/.github/workflows/mutation-nightly.yml b/.github/workflows/mutation-nightly.yml index 5789c7bc..0e627e35 100644 --- a/.github/workflows/mutation-nightly.yml +++ b/.github/workflows/mutation-nightly.yml @@ -54,7 +54,7 @@ jobs: timeout-minutes: 60 steps: - name: Harden the runner - uses: step-security/harden-runner@dc2769abcc0fcfbadfc1df54081c1608579ef6b2 # v2.22.2 + uses: step-security/harden-runner@46b06cea07f9e64621fdf066ba77ac6915163d43 # v2.22.3 with: egress-policy: audit @@ -64,10 +64,10 @@ jobs: persist-credentials: false - name: Set up mise - uses: jdx/mise-action@82a612c5ab8bcda7cc5db6b7e81a8e7584c3dc6e # v5.2.3 + uses: jdx/mise-action@6be3c7ed4c21d4f76b208d351d95aac273ebb76d # v5.2.4 with: # renovate: datasource=github-releases depName=jdx/mise - version: 2026.10.19 + version: 2026.10.21 install_args: go - name: Run mutation sweep diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 6603e161..57bd9bc2 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -53,7 +53,7 @@ jobs: runs-on: ubuntu-24.04 steps: - name: Harden the runner - uses: step-security/harden-runner@dc2769abcc0fcfbadfc1df54081c1608579ef6b2 # v2.22.2 + uses: step-security/harden-runner@46b06cea07f9e64621fdf066ba77ac6915163d43 # v2.22.3 with: egress-policy: audit @@ -115,10 +115,10 @@ jobs: # The final pre-bump hook refreshes the APM lockfile inside cog's # commit, so the API replay includes it in its changed-path list. - name: Set up APM - uses: jdx/mise-action@82a612c5ab8bcda7cc5db6b7e81a8e7584c3dc6e # v5.2.3 + uses: jdx/mise-action@6be3c7ed4c21d4f76b208d351d95aac273ebb76d # v5.2.4 with: # renovate: datasource=github-releases depName=jdx/mise - version: 2026.10.19 + version: 2026.10.21 install_args: apm # This commit stays on the runner. The next step reads it and diff --git a/.github/workflows/scan-cargo-deny.yml b/.github/workflows/scan-cargo-deny.yml index 7340a7ef..43de4329 100644 --- a/.github/workflows/scan-cargo-deny.yml +++ b/.github/workflows/scan-cargo-deny.yml @@ -18,7 +18,7 @@ jobs: contents: read steps: - name: Harden the runner - uses: step-security/harden-runner@dc2769abcc0fcfbadfc1df54081c1608579ef6b2 # v2.22.2 + uses: step-security/harden-runner@46b06cea07f9e64621fdf066ba77ac6915163d43 # v2.22.3 with: egress-policy: audit @@ -28,10 +28,10 @@ jobs: persist-credentials: false - name: Set up mise - uses: jdx/mise-action@82a612c5ab8bcda7cc5db6b7e81a8e7584c3dc6e # v5.2.3 + uses: jdx/mise-action@6be3c7ed4c21d4f76b208d351d95aac273ebb76d # v5.2.4 with: # renovate: datasource=github-releases depName=jdx/mise - version: 2026.10.19 + version: 2026.10.21 install_args: rust github:EmbarkStudios/cargo-deny - name: Check RustSec advisories diff --git a/.github/workflows/scan-gitleaks.yml b/.github/workflows/scan-gitleaks.yml index e7c5483e..9b163975 100644 --- a/.github/workflows/scan-gitleaks.yml +++ b/.github/workflows/scan-gitleaks.yml @@ -16,7 +16,7 @@ jobs: runs-on: ubuntu-24.04 steps: - name: Harden the runner - uses: step-security/harden-runner@dc2769abcc0fcfbadfc1df54081c1608579ef6b2 # v2.22.2 + uses: step-security/harden-runner@46b06cea07f9e64621fdf066ba77ac6915163d43 # v2.22.3 with: egress-policy: audit @@ -27,10 +27,10 @@ jobs: persist-credentials: false - name: Set up mise - uses: jdx/mise-action@82a612c5ab8bcda7cc5db6b7e81a8e7584c3dc6e # v5.2.3 + uses: jdx/mise-action@6be3c7ed4c21d4f76b208d351d95aac273ebb76d # v5.2.4 with: # renovate: datasource=github-releases depName=jdx/mise - version: 2026.10.19 + version: 2026.10.21 install_args: gitleaks - name: Run gitleaks diff --git a/.github/workflows/scan-gomodscan.yml b/.github/workflows/scan-gomodscan.yml index 6c6d2fce..281a44e0 100644 --- a/.github/workflows/scan-gomodscan.yml +++ b/.github/workflows/scan-gomodscan.yml @@ -20,7 +20,7 @@ jobs: security-events: write steps: - name: Harden the runner - uses: step-security/harden-runner@dc2769abcc0fcfbadfc1df54081c1608579ef6b2 # v2.22.2 + uses: step-security/harden-runner@46b06cea07f9e64621fdf066ba77ac6915163d43 # v2.22.3 with: egress-policy: audit @@ -30,10 +30,10 @@ jobs: persist-credentials: false - name: Set up mise - uses: jdx/mise-action@82a612c5ab8bcda7cc5db6b7e81a8e7584c3dc6e # v5.2.3 + uses: jdx/mise-action@6be3c7ed4c21d4f76b208d351d95aac273ebb76d # v5.2.4 with: # renovate: datasource=github-releases depName=jdx/mise - version: 2026.10.19 + version: 2026.10.21 install_args: go - name: Run gomodscan (SARIF) diff --git a/.github/workflows/scan-govulncheck.yml b/.github/workflows/scan-govulncheck.yml index b2fb14e9..5329282d 100644 --- a/.github/workflows/scan-govulncheck.yml +++ b/.github/workflows/scan-govulncheck.yml @@ -20,7 +20,7 @@ jobs: security-events: write steps: - name: Harden the runner - uses: step-security/harden-runner@dc2769abcc0fcfbadfc1df54081c1608579ef6b2 # v2.22.2 + uses: step-security/harden-runner@46b06cea07f9e64621fdf066ba77ac6915163d43 # v2.22.3 with: egress-policy: audit @@ -30,10 +30,10 @@ jobs: persist-credentials: false - name: Set up mise - uses: jdx/mise-action@82a612c5ab8bcda7cc5db6b7e81a8e7584c3dc6e # v5.2.3 + uses: jdx/mise-action@6be3c7ed4c21d4f76b208d351d95aac273ebb76d # v5.2.4 with: # renovate: datasource=github-releases depName=jdx/mise - version: 2026.10.19 + version: 2026.10.21 install_args: go - name: Run govulncheck (SARIF) diff --git a/.github/workflows/shell-allowlist.yml b/.github/workflows/shell-allowlist.yml index 37c0f37d..c74f8437 100644 --- a/.github/workflows/shell-allowlist.yml +++ b/.github/workflows/shell-allowlist.yml @@ -17,7 +17,7 @@ jobs: runs-on: ubuntu-24.04 steps: - name: Harden the runner - uses: step-security/harden-runner@dc2769abcc0fcfbadfc1df54081c1608579ef6b2 # v2.22.2 + uses: step-security/harden-runner@46b06cea07f9e64621fdf066ba77ac6915163d43 # v2.22.3 with: egress-policy: audit @@ -28,10 +28,10 @@ jobs: fetch-depth: 0 - name: Set up mise - uses: jdx/mise-action@82a612c5ab8bcda7cc5db6b7e81a8e7584c3dc6e # v5.2.3 + uses: jdx/mise-action@6be3c7ed4c21d4f76b208d351d95aac273ebb76d # v5.2.4 with: # renovate: datasource=github-releases depName=jdx/mise - version: 2026.10.19 + version: 2026.10.21 install_args: go - name: Check changed shell scripts