From bd96f4a267f4eaed45da63eaf0167c3f06dc9265 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 12 Oct 2026 02:04:03 +0000 Subject: [PATCH] chore(actions): Bump the actions group across 1 directory with 7 updates Bumps the actions group with 7 updates in the / directory: | Package | From | To | | --- | --- | --- | | [step-security/harden-runner](https://github.com/step-security/harden-runner) | `2.20.1` | `2.22.1` | | [github/codeql-action/init](https://github.com/github/codeql-action) | `4.37.6` | `4.38.3` | | [github/codeql-action/analyze](https://github.com/github/codeql-action) | `4.37.6` | `4.38.3` | | [github/codeql-action/upload-sarif](https://github.com/github/codeql-action) | `4.37.6` | `4.38.3` | | [actions/upload-artifact](https://github.com/actions/upload-artifact) | `7.0.1` | `7.0.2` | | [trufflesecurity/trufflehog](https://github.com/trufflesecurity/trufflehog) | `3.96.0` | `3.99.2` | | [Homebrew/actions/setup-homebrew](https://github.com/homebrew/actions) | `2026.08.03.2` | `2026.09.28.1` | Updates `step-security/harden-runner` from 2.20.1 to 2.22.1 - [Release notes](https://github.com/step-security/harden-runner/releases) - [Commits](https://github.com/step-security/harden-runner/compare/b09bb98e06d4d774595224525879c09bc6e98c40...ccd8616d44fd3846e67624a50d5aad6d37bf2d25) Updates `github/codeql-action/init` from 4.37.6 to 4.38.3 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/5595ccaf912efad79be6eef63a5619ff05969be3...24c54180a607b1449ed407dd24f251e4e9147c8d) Updates `github/codeql-action/analyze` from 4.37.6 to 4.38.3 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/5595ccaf912efad79be6eef63a5619ff05969be3...24c54180a607b1449ed407dd24f251e4e9147c8d) Updates `github/codeql-action/upload-sarif` from 4.37.6 to 4.38.3 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/5595ccaf912efad79be6eef63a5619ff05969be3...24c54180a607b1449ed407dd24f251e4e9147c8d) Updates `actions/upload-artifact` from 7.0.1 to 7.0.2 - [Release notes](https://github.com/actions/upload-artifact/releases) - [Commits](https://github.com/actions/upload-artifact/compare/043fb46d1a93c77aae656e7c1c64a875d1fc6a0a...cf430e030ddbb5b0abf93d22962f4752f3646cd9) Updates `trufflesecurity/trufflehog` from 3.96.0 to 3.99.2 - [Release notes](https://github.com/trufflesecurity/trufflehog/releases) - [Commits](https://github.com/trufflesecurity/trufflehog/compare/6f3c981e7b77f235fd2702dd74af25fc4b72bf11...e76dff8a7e57d6df0c60ad8cbf5d5cba505a8fc9) Updates `Homebrew/actions/setup-homebrew` from 2026.08.03.2 to 2026.09.28.1 - [Release notes](https://github.com/homebrew/actions/releases) - [Changelog](https://github.com/Homebrew/actions/blob/main/release.test.mts) - [Commits](https://github.com/homebrew/actions/compare/fd832223f9f99ebf0244dd20658680e5d4aca049...e99025eb970cfa124b8284a35463d87426917478) --- updated-dependencies: - dependency-name: step-security/harden-runner dependency-version: 2.22.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions - dependency-name: github/codeql-action/init dependency-version: 4.38.3 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions - dependency-name: github/codeql-action/analyze dependency-version: 4.38.3 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions - dependency-name: github/codeql-action/upload-sarif dependency-version: 4.38.3 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions - dependency-name: actions/upload-artifact dependency-version: 7.0.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions - dependency-name: trufflesecurity/trufflehog dependency-version: 3.99.2 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions - dependency-name: Homebrew/actions/setup-homebrew dependency-version: 2026.09.28.1 dependency-type: direct:production dependency-group: actions ... Signed-off-by: dependabot[bot] --- .github/workflows/codeql.yml | 6 +++--- .github/workflows/formula-integrity.yml | 2 +- .github/workflows/sast-opengrep.yml | 4 ++-- .github/workflows/scorecard.yml | 6 +++--- .github/workflows/secrets-scan.yml | 6 +++--- .github/workflows/tests.yml | 6 +++--- 6 files changed, 15 insertions(+), 15 deletions(-) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index cad86c8..30bc269 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -33,7 +33,7 @@ jobs: language: ["actions", "ruby"] steps: - name: Harden runner - uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1 + uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25 # v2.22.1 with: egress-policy: audit - name: Checkout @@ -41,10 +41,10 @@ jobs: with: persist-credentials: false - name: Initialize CodeQL - uses: github/codeql-action/init@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6 + uses: github/codeql-action/init@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3 with: languages: ${{ matrix.language }} - name: Analyze - uses: github/codeql-action/analyze@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6 + uses: github/codeql-action/analyze@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3 with: category: "/language:${{ matrix.language }}" diff --git a/.github/workflows/formula-integrity.yml b/.github/workflows/formula-integrity.yml index ef4fe5d..3d23bd1 100644 --- a/.github/workflows/formula-integrity.yml +++ b/.github/workflows/formula-integrity.yml @@ -74,7 +74,7 @@ jobs: timeout-minutes: 30 steps: - name: Harden runner - uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1 + uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25 # v2.22.1 with: egress-policy: audit diff --git a/.github/workflows/sast-opengrep.yml b/.github/workflows/sast-opengrep.yml index e482b2e..6c407a9 100644 --- a/.github/workflows/sast-opengrep.yml +++ b/.github/workflows/sast-opengrep.yml @@ -21,7 +21,7 @@ jobs: security-events: write steps: - name: Harden runner - uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1 + uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25 # v2.22.1 with: egress-policy: audit - name: Checkout @@ -53,6 +53,6 @@ jobs: --sarif-output=opengrep.sarif --error . - name: Upload SARIF if: always() - uses: github/codeql-action/upload-sarif@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6 + uses: github/codeql-action/upload-sarif@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3 with: sarif_file: opengrep.sarif diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index 5506e05..f7ad3cc 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -18,7 +18,7 @@ jobs: id-token: write # publish results (OIDC) steps: - name: Harden runner - uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1 + uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25 # v2.22.1 with: egress-policy: audit - name: Checkout @@ -32,12 +32,12 @@ jobs: results_format: sarif publish_results: true - name: Upload artifact - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: scorecard-sarif path: scorecard.sarif retention-days: 5 - name: Upload to code-scanning - uses: github/codeql-action/upload-sarif@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6 + uses: github/codeql-action/upload-sarif@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3 with: sarif_file: scorecard.sarif diff --git a/.github/workflows/secrets-scan.yml b/.github/workflows/secrets-scan.yml index e759231..cb2134c 100644 --- a/.github/workflows/secrets-scan.yml +++ b/.github/workflows/secrets-scan.yml @@ -15,7 +15,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Harden runner - uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1 + uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25 # v2.22.1 with: egress-policy: audit - name: Checkout (full history for diff scanning) @@ -25,7 +25,7 @@ jobs: persist-credentials: false # Upstream README suggests @main; sscsb pins the release SHA instead (v3.95.9). - name: TruffleHog scan - uses: trufflesecurity/trufflehog@6f3c981e7b77f235fd2702dd74af25fc4b72bf11 # v3.96.0 + uses: trufflesecurity/trufflehog@e76dff8a7e57d6df0c60ad8cbf5d5cba505a8fc9 # v3.99.2 with: extra_args: --results=verified,unknown @@ -33,7 +33,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Harden runner - uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1 + uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25 # v2.22.1 with: egress-policy: audit - name: Checkout diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml index 6934689..9385fc8 100644 --- a/.github/workflows/tests.yml +++ b/.github/workflows/tests.yml @@ -46,13 +46,13 @@ jobs: pull-requests: read steps: - name: Harden runner - uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1 + uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25 # v2.22.1 with: egress-policy: audit - name: Set up Homebrew id: set-up-homebrew - uses: Homebrew/actions/setup-homebrew@fd832223f9f99ebf0244dd20658680e5d4aca049 # 2026.08.03.2 + uses: Homebrew/actions/setup-homebrew@e99025eb970cfa124b8284a35463d87426917478 # 2026.09.28.1 with: token: ${{ secrets.GITHUB_TOKEN }} @@ -76,7 +76,7 @@ jobs: - name: Upload bottles as artifact if: always() && github.event_name == 'pull_request' - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: bottles_${{ matrix.os }} path: "*.bottle.*"