Chore: Bump harden-runner allow-list to v0.12.2 - #33
Conversation
Bump every live .github allow-list pin to v0.12.2, which adds the download.sonatype.com and nexus-iq.wl.linuxfoundation.org endpoints for the Sonatype IQ/CLM lane, plus nodejs.org for setup-node tool cache misses and Maven frontend-plugin builds. The internal tag-push, release-drafter and clear-action-cache workflows were still pinned to v0.1.1 and move to the same version. These pins are custom string inputs, not 'uses:' references, so Dependabot cannot bump them; they need manual updates. The pin is the commit the annotated tag resolves to, not the tag object. Co-authored-by: Claude <noreply@anthropic.com> Signed-off-by: Matthew Watkins <mwatkins@linuxfoundation.org>
There was a problem hiding this comment.
🟢 Ready to approve
The change is a straightforward, consistent SHA pin update across workflows with no remaining references to the prior allow-list SHAs under .github.
This review doesn't count toward merge requirements. Sign up for the private preview to control whether Copilot approvals count.
Pull request overview
This PR updates the pinned harden-runner allow-list commit across the repository’s GitHub Actions workflows to keep runner egress hardening aligned with the latest allow-list contents.
Changes:
- Bump harden-runner allow-list pins from older SHAs (including v0.12.1 and v0.1.1) to v0.12.2 (
bf6642f68d58c1b81bbe993e676d6cc339ac3654). - Apply the updated pin consistently across both reusable-workflow input defaults and per-workflow
configinputs.
File summaries
| File | Description |
|---|---|
| .github/workflows/tag-push.yaml | Updates both jobs’ harden-runner allow-list config pin to v0.12.2. |
| .github/workflows/release-drafter.yaml | Updates harden-runner allow-list config pin to v0.12.2. |
| .github/workflows/merge.yaml | Updates reusable workflow input default allow-list pin to v0.12.2. |
| .github/workflows/clear-action-cache.yaml | Updates harden-runner allow-list config pin to v0.12.2. |
| .github/workflows/build-test.yaml | Updates reusable workflow input default allow-list pin to v0.12.2. |
| .github/workflows/build-test-release.yaml | Updates reusable workflow input default allow-list pin to v0.12.2. |
Review details
- Files reviewed: 6/6 changed files
- Comments generated: 0
- Review effort level: Lite
We're testing this review assessment. Please use 👍 or 👎 to tell us if it's correct.
There was a problem hiding this comment.
🟢 Ready to approve
The changes are limited to updating pinned allow-list references and the resulting workflow YAML remains consistent and well-formed in the modified regions.
This review doesn't count toward merge requirements. Sign up for the private preview to control whether Copilot approvals count.
Review details
- Files reviewed: 6/6 changed files
- Comments generated: 0 new
- Review effort level: Lite
We're testing this review assessment. Please use 👍 or 👎 to tell us if it's correct.
Chore: Bump harden-runner allow-list to v0.12.2
Bumps every live
.githuballow-list pin (7 sites: 3 reusable-workflow defaults from v0.12.1, plustag-push×2,release-drafterandclear-action-cachewhich were still at v0.1.1) to v0.12.2 (bf6642f…, the commit the annotated tag resolves to).v0.12.2 adds:
download.sonatype.com+nexus-iq.wl.linuxfoundation.org(Sonatype IQ/CLM lane) andnodejs.org(setup-node tool-cache misses; Maven frontend-plugin builds — the latter directly relevant to the ONAP sdc-workflow-designer style consumers of these workflows).Note: these pins are custom string inputs, not
uses:references, so Dependabot cannot bump them — manual updates required.actionlintpasses.