From 04720e0e16a265ffe89fd604387d2104759c48a2 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Wed, 9 Sep 2026 18:43:52 +0000 Subject: [PATCH] chore: Bump the actions group across 1 directory with 7 updates Bumps the actions group with 7 updates in the / directory: | Package | From | To | | --- | --- | --- | | [step-security/harden-runner](https://github.com/step-security/harden-runner) | `2.19.4` | `2.21.1` | | [actions/checkout](https://github.com/actions/checkout) | `7.0.0` | `7.0.1` | | [github/codeql-action/init](https://github.com/github/codeql-action) | `4.36.2` | `4.37.9` | | [github/codeql-action/analyze](https://github.com/github/codeql-action) | `4.36.2` | `4.37.9` | | [Azure/setup-azd](https://github.com/azure/setup-azd) | `2.3.0` | `2.4.0` | | [azure/login](https://github.com/azure/login) | `93381592711f247e165c389ebb30b596c84cdc48` | `532459ea530d8321f2fb9bb10d1e0bcf23869a43` | | [github/codeql-action/upload-sarif](https://github.com/github/codeql-action) | `4.36.2` | `4.37.9` | Updates `step-security/harden-runner` from 2.19.4 to 2.21.1 - [Release notes](https://github.com/step-security/harden-runner/releases) - [Commits](https://github.com/step-security/harden-runner/compare/9af89fc71515a100421586dfdb3dc9c984fbf411...e14015d583714f6e62063499dc959a02595150a1) Updates `actions/checkout` from 7.0.0 to 7.0.1 - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](https://github.com/actions/checkout/compare/9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0...3d3c42e5aac5ba805825da76410c181273ba90b1) Updates `github/codeql-action/init` from 4.36.2 to 4.37.9 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/8aad20d150bbac5944a9f9d289da16a4b0d87c1e...cdf488f595d80d6e07e03d4674febd5ab45fa938) Updates `github/codeql-action/analyze` from 4.36.2 to 4.37.9 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/8aad20d150bbac5944a9f9d289da16a4b0d87c1e...cdf488f595d80d6e07e03d4674febd5ab45fa938) Updates `Azure/setup-azd` from 2.3.0 to 2.4.0 - [Release notes](https://github.com/azure/setup-azd/releases) - [Changelog](https://github.com/Azure/setup-azd/blob/main/CHANGELOG.md) - [Commits](https://github.com/azure/setup-azd/compare/634ad924cf8baef2257898ba5663be8d19f15aca...0b7e3a35ab00f2eee7080c845eb39c3f0ebfa553) Updates `azure/login` from 93381592711f247e165c389ebb30b596c84cdc48 to 532459ea530d8321f2fb9bb10d1e0bcf23869a43 - [Release notes](https://github.com/azure/login/releases) - [Commits](https://github.com/azure/login/compare/93381592711f247e165c389ebb30b596c84cdc48...532459ea530d8321f2fb9bb10d1e0bcf23869a43) Updates `github/codeql-action/upload-sarif` from 4.36.2 to 4.37.9 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/8aad20d150bbac5944a9f9d289da16a4b0d87c1e...cdf488f595d80d6e07e03d4674febd5ab45fa938) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 7.0.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions - dependency-name: azure/login dependency-version: 532459ea530d8321f2fb9bb10d1e0bcf23869a43 dependency-type: direct:production dependency-group: actions - dependency-name: Azure/setup-azd dependency-version: 2.4.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions - dependency-name: github/codeql-action/analyze dependency-version: 4.37.6 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions - dependency-name: github/codeql-action/init dependency-version: 4.37.6 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions - dependency-name: github/codeql-action/upload-sarif dependency-version: 4.37.6 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions - dependency-name: step-security/harden-runner dependency-version: 2.20.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions ... Signed-off-by: dependabot[bot] --- .github/workflows/ci.yml | 8 ++++---- .github/workflows/codeql.yml | 8 ++++---- .github/workflows/dependency-review.yml | 4 ++-- .github/workflows/release-deploy.yml | 12 ++++++------ .github/workflows/security.yml | 10 +++++----- .github/workflows/vuln-scan.yml | 4 ++-- 6 files changed, 23 insertions(+), 23 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 2ff824ba..a7e466b5 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -26,11 +26,11 @@ jobs: pull-requests: write # coverage comment/annotation on the PR steps: - name: Harden runner - uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4 + uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1 with: egress-policy: audit - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Setup .NET + NuGet cache uses: ./.github/actions/setup-dotnet-cache @@ -92,11 +92,11 @@ jobs: contents: read steps: - name: Harden runner - uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4 + uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1 with: egress-policy: audit - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Setup .NET + NuGet cache uses: ./.github/actions/setup-dotnet-cache diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 8e74cb33..ba10328c 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -27,17 +27,17 @@ jobs: actions: read steps: - name: Harden runner - uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4 + uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1 with: egress-policy: audit - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Setup .NET + NuGet cache uses: ./.github/actions/setup-dotnet-cache - name: Initialize CodeQL - uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2 + uses: github/codeql-action/init@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9 with: languages: csharp build-mode: manual @@ -46,6 +46,6 @@ jobs: run: dotnet build OrderSphere.slnx --no-restore --configuration Release - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2 + uses: github/codeql-action/analyze@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9 with: category: /language:csharp diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml index 8c70cc3a..64aafc27 100644 --- a/.github/workflows/dependency-review.yml +++ b/.github/workflows/dependency-review.yml @@ -22,11 +22,11 @@ jobs: pull-requests: write # summary as a PR comment steps: - name: Harden runner - uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4 + uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1 with: egress-policy: audit - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Dependency Review uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0 diff --git a/.github/workflows/release-deploy.yml b/.github/workflows/release-deploy.yml index f8c298d9..257a88bc 100644 --- a/.github/workflows/release-deploy.yml +++ b/.github/workflows/release-deploy.yml @@ -34,14 +34,14 @@ jobs: tag: ${{ steps.tag.outputs.tag }} steps: - name: Harden runner - uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4 + uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1 with: egress-policy: audit # RELEASE_PAT is required: master is PR-protected, so the default GITHUB_TOKEN # cannot push the version-bump commit. The PAT owner must be on the branch # protection bypass list. - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: ref: master fetch-depth: 0 @@ -121,12 +121,12 @@ jobs: AZURE_RESOURCE_GROUP: rg-ordersphere-dev steps: - name: Harden runner - uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4 + uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1 with: egress-policy: audit - name: Checkout the released tag - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: ref: ${{ needs.release.outputs.tag }} @@ -136,7 +136,7 @@ jobs: restore: 'false' - name: Install azd - uses: Azure/setup-azd@634ad924cf8baef2257898ba5663be8d19f15aca # v2.3.0 + uses: Azure/setup-azd@0b7e3a35ab00f2eee7080c845eb39c3f0ebfa553 # v2.4.0 - name: Log in to Azure (OIDC federated credentials) run: | @@ -195,7 +195,7 @@ jobs: uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2 - name: Log in to Azure CLI (OIDC federated credentials) - uses: azure/login@93381592711f247e165c389ebb30b596c84cdc48 # v3.0.0 + uses: azure/login@532459ea530d8321f2fb9bb10d1e0bcf23869a43 # v3.0.0 with: client-id: ${{ secrets.AZURE_CLIENT_ID }} tenant-id: ${{ secrets.AZURE_TENANT_ID }} diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml index a66edb3a..221d84f8 100644 --- a/.github/workflows/security.yml +++ b/.github/workflows/security.yml @@ -25,11 +25,11 @@ jobs: timeout-minutes: 15 steps: - name: Harden runner - uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4 + uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1 with: egress-policy: audit - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 # full history for the commit scan @@ -51,11 +51,11 @@ jobs: security-events: write # SARIF upload to the Security tab steps: - name: Harden runner - uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4 + uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1 with: egress-policy: audit - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Trivy (vuln + secret + misconfig) uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0 @@ -73,7 +73,7 @@ jobs: cache: true - name: Upload Trivy SARIF - uses: github/codeql-action/upload-sarif@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2 + uses: github/codeql-action/upload-sarif@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9 if: ${{ !cancelled() && hashFiles('trivy-results.sarif') != '' }} with: sarif_file: trivy-results.sarif diff --git a/.github/workflows/vuln-scan.yml b/.github/workflows/vuln-scan.yml index ab704cee..0fa2ff35 100644 --- a/.github/workflows/vuln-scan.yml +++ b/.github/workflows/vuln-scan.yml @@ -29,11 +29,11 @@ jobs: timeout-minutes: 15 steps: - name: Harden runner - uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4 + uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1 with: egress-policy: audit - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Setup .NET + NuGet cache uses: ./.github/actions/setup-dotnet-cache