[dependabot]

Bumps the actions group with 2 updates in the / directory: step-security/harden-runner and zizmorcore/zizmor-action.

Updates step-security/harden-runner from 2.22.1 to 2.22.3

Release notes

Sourced from step-security/harden-runner's releases.

v2.22.3

What's Changed

• Added support for Avrea-hosted runners (enterprise tier)
• Fixed unexpected blocking of allowed connections caused by GitHub’s DNS resolver and outbound proxy experiment on GitHub-hosted Linux runners
• Added a feature flag to disable implicit AWS endpoint allowances on self-hosted Linux runners (enterprise tier)

Full Changelog: step-security/harden-runner@v2.22.2...v2.22.3

v2.22.2

What's Changed

• Fixed inbound (ingress) network traffic being incorrectly classified as outbound (egress) traffic on macOS
• Fixed implicit endpoints intended for self-hosted runners being applied to custom VM environments on Linux (enterprise tier)
• Improved network and DNS tracing, enforcement logic, and process information correlation on Linux (enterprise tier)

Full Changelog: step-security/harden-runner@v2.22.1...v2.22.2

Commits

• 46b06ce Merge pull request #711 from step-security/rc-46
• f82eb4b Merge pull request #710 from h0x0er/jatin/tp-avrea
• 665b85a update agent-self-hosted, agent-bravo to v1.9.5 and agent to v0.18.0
• 80fffe1 detect avrea runners
• dc2769a Merge pull request #707 from step-security/rc-45
• ab0b273 Merge pull request #706 from h0x0er/rc-45
• 03ccff8 Remove agent-preinstalled skip for third-party runners
• 815e48d Skip agent install and post-step cleanup when agent is already installed
• See full diff in compare view

Updates zizmorcore/zizmor-action from 0.6.4 to 0.8.0

Release notes

Sourced from zizmorcore/zizmor-action's releases.

v0.8.0

The action now supports prereleases.

The default has not changed, but you can pass a prerelease version of zizmor or version: prerelease to get whatever latest prerelease the action knows about.

What's Changed

• Support prereleases by @​woodruffw in zizmorcore/zizmor-action#182
• Sync zizmor versions by @​github-actions[bot] in zizmorcore/zizmor-action#184

Full Changelog: zizmorcore/zizmor-action@v0.7.1...v0.8.0

v0.7.1

zizmor changes

Bug Fixes 🐛🔗

• Fixed a regression in 1.31.0 where some ignore comments/configurations would no longer apply to the dangerous-triggers audit

action changes

The default version of zizmor is now 1.31.1.

What's Changed

• Sync zizmor versions by @​github-actions[bot] in zizmorcore/zizmor-action#178

Full Changelog: zizmorcore/zizmor-action@v0.7.0...v0.7.1

v0.7.0

Sponsorship is appreciated!

zizmor notes

Enhancements 🌱🔗

• The typosquat-uses audit now supports pre-commit config inputs (#2437)

• The self-hosted-runner audit is now significantly more precise (#2350)

  Many thanks to @​ubiratansoares for proposing and implementing this enhancement!

• The dangerous-triggers audit now considers the issue_comment trigger fundamentally dangerous (#2396)

• zizmor is now aware of the image_version workflow trigger (#2397)

• The dangerous-triggers audit now produces more precise finding/diagnostic spans (#2402)

... (truncated)

Commits

• 53290ba Sync zizmor versions (#184)
• 76da2ee Support prereleases (#182)
• fb1d87b chore(deps): bump the github-actions group with 2 updates (#180)
• be36601 README: bump pins (#179)
• 85b2b9f Sync zizmor versions (#178)
• 38c745a README: bump pins (#177)
• f9597c8 Sync zizmor versions (#175)
• 2181e51 Bump sync-zizmor-versions.py to Python 3.11 for locking (#174)
• 27d989b chore(deps): bump the github-actions group with 2 updates (#173)
• a91218c Bootstrap zizmor without Docker (#169)
• Additional commits viewable in compare view

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.