Fix: Apply one harden-runner step per job

[ModeSevenIndustrialSolutions]

Fix: Apply one harden-runner step per job

This template instantiation inherited the broken dual-step harden-runner pattern from before the fix propagated through the workflow family.

The bug

Each job selected between a block-configured and an audit-configured step-security/harden-runner step via a step-level if:. harden-runner declares a pre entry point and no pre-if, so its pre-phase (where the network policy engages) runs regardless of the condition — both steps engaged, block ran first and won, and harden_runner_egress: 'audit' silently did nothing.

The fix

Single harden-runner step per job with the policy computed inline:

egress-policy: ${{ inputs.harden_runner_egress == 'audit' && 'audit' || 'block' }}

Matching java-workflows, node-workflows#24, python-workflows#37 and go-workflows#25. No build-variant blocks exist here yet — the build_permit_egress_traffic hatch arrives with the Docker verify-lane implementation.

Allow-list pin bump → .github v0.12.2 (latest)

All 7 live pins: reusable-workflow defaults (3, from v0.4.1) and tag-push ×2 / release-drafter / clear-action-cache (from v0.1.1). Relative to the old pins, v0.12.2 brings the Gerrit SSH, JVM/Gradle, Nexus 3 Docker registry ports (10001–10004), Yarn, nodejs.org and Sonatype IQ endpoints — the Docker registry endpoints matter directly for this repository's build lanes. Pinned to the commit the annotated tag resolves to (bf6642f…), not the tag object.

Validation

• Post-transform: no residual Harden runner (block)/(audit) or literal egress-policy: 'block'|'audit'; computed policy counts 6 / 9 / 6
• actionlint passes on all workflows

Groundwork for the Docker verify lane (design brief: #6, tracking: lfreleng-actions/.github#142).

[Copilot]

Pull request overview

Updates this repository’s GitHub Actions workflows to fix a runner-hardening bug caused by the “dual harden-runner step” pattern (where both steps’ pre phases can run even when a step is conditionally skipped). The change ensures each affected job uses a single step-security/harden-runner step with the egress policy computed inline, and bumps the shared allow-list pins to .github v0.12.1.

Changes:

• Replace per-job dual harden-runner (block/audit) steps with a single harden-runner step using a computed egress-policy.
• Ensure the allow-list load step is unconditional in affected reusable workflows.
• Bump allow-list pins to commit 60d8d710... (annotated tag v0.12.1) across live workflow references.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
.github/workflows/build-test.yaml	Switch to a single harden-runner step per job and bump default allow-list pin to v0.12.1 commit.
.github/workflows/build-test-release.yaml	Same harden-runner single-step fix across release workflow jobs; bump allow-list pin.
.github/workflows/merge.yaml	Same harden-runner single-step fix across merge workflow jobs; bump allow-list pin.
.github/workflows/tag-push.yaml	Bump harden-runner allow-list config pin to v0.12.1 commit for both jobs.
.github/workflows/release-drafter.yaml	Bump harden-runner allow-list config pin to v0.12.1 commit.
.github/workflows/clear-action-cache.yaml	Bump harden-runner allow-list config pin to v0.12.1 commit.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 6 out of 6 changed files in this pull request and generated no new comments.