chore(deps): bump step-security/harden-runner from 2.20.0 to 2.20.1

[dependabot]

Bumps step-security/harden-runner from 2.20.0 to 2.20.1.

Release notes

Sourced from step-security/harden-runner's releases.

v2.20.1

What's Changed

• AWS CodeBuild-hosted runner support
• Implicitly allow single-labeled (internal) domains in block-mode

Full Changelog: step-security/harden-runner@v2.20.0...v2.20.1

Commits

• b09bb98 Merge pull request #680 from step-security/aws-code-build
• 35cd77b docs: document the Global Block List in the features list
• bb6dbef chore: rebuild dist with clean dependency install
• 98f73c5 chore: update eBPF agent to v1.8.14
• 54193c1 Reapply "feat(runners): detect AWS CodeBuild-hosted runners as third-party pr...
• d22dd48 Revert "fix(self-hosted): flush agent events at job end when deploy-on-self-h...
• 0ff0941 fix(self-hosted): flush agent events at job end when deploy-on-self-hosted-vm...
• a3c333d Revert "feat(runners): detect AWS CodeBuild-hosted runners as third-party pro...
• bf94c00 feat(runners): detect AWS CodeBuild-hosted runners as third-party provider
• 514522c fix(self-hosted): resolve runner user when USER env var is unset
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[opencode-agent]

Pull request overview

OpenCode could not approve from deterministic current-head evidence because GitHub Checks have failed.

Findings

1. HIGH Current-head GitHub Checks - Fix failed required checks before approval

• Problem: Failed same-head checks remain for 8a1133d406d0d15b425644e0dc3910f112ccbb36.
• Root cause: The model-unavailable evidence fallback is allowed only when peer GitHub Checks are complete and clean.
• Fix: Read and fix the failed check logs below, then rerun the current-head checks.
• Regression test: Keep the model-unavailable fallback gated on an empty failed-check rollup.

Failed checks:

• R CMD check/check: FAILURE (https://github.com/ContextualWisdomLab/aFIPC/actions/runs/31328021184/job/93287710850)
• check check run: failure (https://github.com/ContextualWisdomLab/aFIPC/actions/runs/31328021184/job/93287710850)

Changed-File Evidence Map

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Workflow (3 files)"]
  S1 --> I1["GitHub Actions review job"]
  I1 --> R1["Review risk: Workflow (3 files)"]
  R1 --> V1["actionlint plus required checks"]

Loading

[opencode-agent]

OpenCode Review Overview

• Head SHA: 8a1133d406d0d15b425644e0dc3910f112ccbb36
• Workflow run: 31700391417
• Workflow attempt: 1
• Gate result: REQUEST_CHANGES (approval step)

Pull request overview

OpenCode could not approve from deterministic current-head evidence because GitHub Checks have failed.

Findings

1. HIGH Current-head GitHub Checks - Fix failed required checks before approval

• Problem: Failed same-head checks remain for 8a1133d406d0d15b425644e0dc3910f112ccbb36.
• Root cause: The model-unavailable evidence fallback is allowed only when peer GitHub Checks are complete and clean.
• Fix: Read and fix the failed check logs below, then rerun the current-head checks.
• Regression test: Keep the model-unavailable fallback gated on an empty failed-check rollup.

Failed checks:

• R CMD check/check: FAILURE (https://github.com/ContextualWisdomLab/aFIPC/actions/runs/31328021184/job/93287710850)
• check check run: failure (https://github.com/ContextualWisdomLab/aFIPC/actions/runs/31328021184/job/93287710850)

Changed-File Evidence Map

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Workflow (3 files)"]
  S1 --> I1["GitHub Actions review job"]
  I1 --> R1["Review risk: Workflow (3 files)"]
  R1 --> V1["actionlint plus required checks"]

Loading

[seonghobae]

Reviewed the exact-head Dependabot patch. It updates step-security/harden-runner from the fully pinned v2.20.0 commit to the fully pinned v2.20.1 commit consistently across all three repository workflows, with no permission or workflow-logic expansion. The remaining R CMD check failure is the repository-wide RcppParallel/oneTBB ABI issue addressed separately in #212, not a finding in this dependency patch. Approval does not waive current-head required checks.