From d092852b8dd489c668e7aeec9b1d8f9becb8e58b Mon Sep 17 00:00:00 2001 From: Matthew Watkins Date: Fri, 31 Jul 2026 11:39:39 +0100 Subject: [PATCH] Chore: Bump harden-runner allow-list to v0.12.2 Bump every live .github allow-list pin to v0.12.2, which adds the download.sonatype.com and nexus-iq.wl.linuxfoundation.org endpoints for the Sonatype IQ/CLM lane, plus nodejs.org for setup-node tool cache misses and Maven frontend-plugin builds. The internal tag-push, release-drafter and clear-action-cache workflows were still pinned to v0.1.1 and move to the same version. These pins are custom string inputs, not 'uses:' references, so Dependabot cannot bump them; they need manual updates. The pin is the commit the annotated tag resolves to, not the tag object. Co-authored-by: Claude Signed-off-by: Matthew Watkins --- .github/workflows/build-test-release.yaml | 2 +- .github/workflows/build-test.yaml | 2 +- .github/workflows/clear-action-cache.yaml | 2 +- .github/workflows/merge.yaml | 2 +- .github/workflows/release-drafter.yaml | 2 +- .github/workflows/tag-push.yaml | 4 ++-- 6 files changed, 7 insertions(+), 7 deletions(-) diff --git a/.github/workflows/build-test-release.yaml b/.github/workflows/build-test-release.yaml index d9dc159..2520531 100644 --- a/.github/workflows/build-test-release.yaml +++ b/.github/workflows/build-test-release.yaml @@ -182,7 +182,7 @@ on: required: false type: string # yamllint disable-line rule:line-length - default: 'lfreleng-actions//.github/harden-runner/lfreleng-actions/allow_list.txt@60d8d71016f31c26775e5ec9380eba4264aa6f9e' # v0.12.1 + default: 'lfreleng-actions//.github/harden-runner/lfreleng-actions/allow_list.txt@bf6642f68d58c1b81bbe993e676d6cc339ac3654' # v0.12.2 # --- Gerrit-aware checkout (empty unless dispatched via Gerrit) --- gerrit_refspec: diff --git a/.github/workflows/build-test.yaml b/.github/workflows/build-test.yaml index 7a0b8aa..83fa52f 100644 --- a/.github/workflows/build-test.yaml +++ b/.github/workflows/build-test.yaml @@ -177,7 +177,7 @@ on: required: false type: string # yamllint disable-line rule:line-length - default: 'lfreleng-actions//.github/harden-runner/lfreleng-actions/allow_list.txt@60d8d71016f31c26775e5ec9380eba4264aa6f9e' # v0.12.1 + default: 'lfreleng-actions//.github/harden-runner/lfreleng-actions/allow_list.txt@bf6642f68d58c1b81bbe993e676d6cc339ac3654' # v0.12.2 # --- Gerrit-aware checkout (empty unless dispatched via Gerrit) --- gerrit_refspec: diff --git a/.github/workflows/clear-action-cache.yaml b/.github/workflows/clear-action-cache.yaml index eba3732..34405d8 100644 --- a/.github/workflows/clear-action-cache.yaml +++ b/.github/workflows/clear-action-cache.yaml @@ -55,7 +55,7 @@ jobs: # yamllint disable-line rule:line-length - uses: lfreleng-actions/harden-runner-block-action@6db537b3e6d060c3287c5a3ce2c28b55b0af330d # v0.2.1 with: - config: '@18d9c4446bea555d0783e850f6d295f844fe8f67' # v0.1.1 + config: '@bf6642f68d58c1b81bbe993e676d6cc339ac3654' # v0.12.2 # Harden the runner with the just-loaded allow-list. - name: 'Harden runner (block)' diff --git a/.github/workflows/merge.yaml b/.github/workflows/merge.yaml index 0b75c79..86c8e38 100644 --- a/.github/workflows/merge.yaml +++ b/.github/workflows/merge.yaml @@ -120,7 +120,7 @@ on: required: false type: string # yamllint disable-line rule:line-length - default: 'lfreleng-actions//.github/harden-runner/lfreleng-actions/allow_list.txt@60d8d71016f31c26775e5ec9380eba4264aa6f9e' # v0.12.1 + default: 'lfreleng-actions//.github/harden-runner/lfreleng-actions/allow_list.txt@bf6642f68d58c1b81bbe993e676d6cc339ac3654' # v0.12.2 # --- Gerrit-aware checkout (empty unless dispatched via Gerrit) --- gerrit_refspec: diff --git a/.github/workflows/release-drafter.yaml b/.github/workflows/release-drafter.yaml index f197101..cc2ed93 100644 --- a/.github/workflows/release-drafter.yaml +++ b/.github/workflows/release-drafter.yaml @@ -30,7 +30,7 @@ jobs: # yamllint disable-line rule:line-length - uses: lfreleng-actions/harden-runner-block-action@6db537b3e6d060c3287c5a3ce2c28b55b0af330d # v0.2.1 with: - config: '@18d9c4446bea555d0783e850f6d295f844fe8f67' # v0.1.1 + config: '@bf6642f68d58c1b81bbe993e676d6cc339ac3654' # v0.12.2 # Harden the runner with the just-loaded allow-list. - name: 'Harden runner (block)' diff --git a/.github/workflows/tag-push.yaml b/.github/workflows/tag-push.yaml index ca8a194..6052dc7 100644 --- a/.github/workflows/tag-push.yaml +++ b/.github/workflows/tag-push.yaml @@ -38,7 +38,7 @@ jobs: # yamllint disable-line rule:line-length - uses: lfreleng-actions/harden-runner-block-action@6db537b3e6d060c3287c5a3ce2c28b55b0af330d # v0.2.1 with: - config: '@18d9c4446bea555d0783e850f6d295f844fe8f67' # v0.1.1 + config: '@bf6642f68d58c1b81bbe993e676d6cc339ac3654' # v0.12.2 # Harden the runner with the just-loaded allow-list. - name: 'Harden runner (block)' @@ -80,7 +80,7 @@ jobs: # yamllint disable-line rule:line-length - uses: lfreleng-actions/harden-runner-block-action@6db537b3e6d060c3287c5a3ce2c28b55b0af330d # v0.2.1 with: - config: '@18d9c4446bea555d0783e850f6d295f844fe8f67' # v0.1.1 + config: '@bf6642f68d58c1b81bbe993e676d6cc339ac3654' # v0.12.2 # Harden the runner with the just-loaded allow-list. - name: 'Harden runner (block)'