diff --git a/.github/workflows/auto_label_prs.yaml b/.github/workflows/auto_label_prs.yaml index ff2c87618bcd..4f0cb2f10689 100644 --- a/.github/workflows/auto_label_prs.yaml +++ b/.github/workflows/auto_label_prs.yaml @@ -19,7 +19,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Harden Runner - uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1 + uses: step-security/harden-runner@46b06cea07f9e64621fdf066ba77ac6915163d43 # v2.22.3 with: disable-sudo: true egress-policy: block diff --git a/.github/workflows/check_dependent_pr.yaml b/.github/workflows/check_dependent_pr.yaml index 41211408dc94..024e70b9226e 100644 --- a/.github/workflows/check_dependent_pr.yaml +++ b/.github/workflows/check_dependent_pr.yaml @@ -21,7 +21,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Harden Runner - uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1 + uses: step-security/harden-runner@46b06cea07f9e64621fdf066ba77ac6915163d43 # v2.22.3 with: disable-sudo: true egress-policy: block diff --git a/.github/workflows/clangd_tidy.yaml b/.github/workflows/clangd_tidy.yaml index 77a09a3214ab..3b32ebc2d92e 100644 --- a/.github/workflows/clangd_tidy.yaml +++ b/.github/workflows/clangd_tidy.yaml @@ -26,7 +26,7 @@ jobs: steps: - name: Harden Runner - uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1 + uses: step-security/harden-runner@46b06cea07f9e64621fdf066ba77ac6915163d43 # v2.22.3 with: egress-policy: block # When adding endpoints, see README.md. diff --git a/.github/workflows/discord_wiki.yaml b/.github/workflows/discord_wiki.yaml index 533122a168be..5b55ef366f11 100644 --- a/.github/workflows/discord_wiki.yaml +++ b/.github/workflows/discord_wiki.yaml @@ -15,7 +15,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Harden Runner - uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1 + uses: step-security/harden-runner@46b06cea07f9e64621fdf066ba77ac6915163d43 # v2.22.3 with: egress-policy: audit diff --git a/.github/workflows/gh_pages_ci.yaml b/.github/workflows/gh_pages_ci.yaml index 23078d70a9b5..7116da68cd75 100644 --- a/.github/workflows/gh_pages_ci.yaml +++ b/.github/workflows/gh_pages_ci.yaml @@ -22,7 +22,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Harden Runner - uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1 + uses: step-security/harden-runner@46b06cea07f9e64621fdf066ba77ac6915163d43 # v2.22.3 with: egress-policy: audit diff --git a/.github/workflows/gh_pages_deploy.yaml b/.github/workflows/gh_pages_deploy.yaml index 029c89e6995e..2186509ddaf3 100644 --- a/.github/workflows/gh_pages_deploy.yaml +++ b/.github/workflows/gh_pages_deploy.yaml @@ -27,7 +27,7 @@ jobs: contents: read steps: - name: Harden Runner - uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1 + uses: step-security/harden-runner@46b06cea07f9e64621fdf066ba77ac6915163d43 # v2.22.3 with: egress-policy: audit @@ -79,7 +79,7 @@ jobs: id-token: write steps: - name: Harden Runner - uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1 + uses: step-security/harden-runner@46b06cea07f9e64621fdf066ba77ac6915163d43 # v2.22.3 with: egress-policy: audit diff --git a/.github/workflows/nightly_release.yaml b/.github/workflows/nightly_release.yaml index bd13bb3d097d..4b833ccfb0f5 100644 --- a/.github/workflows/nightly_release.yaml +++ b/.github/workflows/nightly_release.yaml @@ -37,7 +37,7 @@ jobs: runs-on: ubuntu-22.04 steps: - name: Harden Runner - uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1 + uses: step-security/harden-runner@46b06cea07f9e64621fdf066ba77ac6915163d43 # v2.22.3 with: egress-policy: block # When adding endpoints, see README.md. diff --git a/.github/workflows/prek.yaml b/.github/workflows/prek.yaml index 38279f66db4a..7030879723b6 100644 --- a/.github/workflows/prek.yaml +++ b/.github/workflows/prek.yaml @@ -18,7 +18,7 @@ jobs: runs-on: ubuntu-22.04 steps: - name: Harden Runner - uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1 + uses: step-security/harden-runner@46b06cea07f9e64621fdf066ba77ac6915163d43 # v2.22.3 with: egress-policy: block # When adding endpoints, see README.md. diff --git a/.github/workflows/prek_suggestions.yaml b/.github/workflows/prek_suggestions.yaml index 164767945ad5..1d9c11ee43da 100644 --- a/.github/workflows/prek_suggestions.yaml +++ b/.github/workflows/prek_suggestions.yaml @@ -32,7 +32,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Harden Runner - uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1 + uses: step-security/harden-runner@46b06cea07f9e64621fdf066ba77ac6915163d43 # v2.22.3 with: disable-sudo: true egress-policy: block @@ -42,6 +42,7 @@ jobs: github.com:443 objects.githubusercontent.com:443 raw.githubusercontent.com:443 + release-assets.githubusercontent.com:443 - uses: reviewdog/action-setup@3f401fe1d58fe77e10d665ab713057375e39b887 # v1.3.0 with: diff --git a/.github/workflows/sync_repos.yaml b/.github/workflows/sync_repos.yaml index f35d80cfb60e..18127b1d7fc3 100644 --- a/.github/workflows/sync_repos.yaml +++ b/.github/workflows/sync_repos.yaml @@ -25,7 +25,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Harden Runner - uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1 + uses: step-security/harden-runner@46b06cea07f9e64621fdf066ba77ac6915163d43 # v2.22.3 with: egress-policy: audit diff --git a/.github/workflows/tests.yaml b/.github/workflows/tests.yaml index c7c5fb6159f2..88f5076642e1 100644 --- a/.github/workflows/tests.yaml +++ b/.github/workflows/tests.yaml @@ -49,7 +49,7 @@ jobs: runs-on: ${{ matrix.runner }} steps: - name: Harden Runner - uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1 + uses: step-security/harden-runner@46b06cea07f9e64621fdf066ba77ac6915163d43 # v2.22.3 with: egress-policy: block # When adding endpoints, see README.md. diff --git a/.github/workflows/triage_inactive.yaml b/.github/workflows/triage_inactive.yaml index bbde7a2e219b..1b0dd56c6aba 100644 --- a/.github/workflows/triage_inactive.yaml +++ b/.github/workflows/triage_inactive.yaml @@ -16,7 +16,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Harden Runner - uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1 + uses: step-security/harden-runner@46b06cea07f9e64621fdf066ba77ac6915163d43 # v2.22.3 with: disable-sudo: true egress-policy: block