Chore: Bump harden-runner allow-list to v0.12.2 - #47
Conversation
Bump every live .github allow-list pin to v0.12.2, which adds the download.sonatype.com and nexus-iq.wl.linuxfoundation.org endpoints for the Sonatype IQ/CLM lane, plus nodejs.org for setup-node tool cache misses and Maven frontend-plugin builds. These pins are custom string inputs, not 'uses:' references, so Dependabot cannot bump them; they need manual updates. The pin is the commit the annotated tag resolves to, not the tag object. Co-authored-by: Claude <noreply@anthropic.com> Signed-off-by: Matthew Watkins <mwatkins@linuxfoundation.org>
There was a problem hiding this comment.
🟢 Ready to approve
The change is a consistent, repository-wide pin bump with no detected YAML/indentation issues or leftover references to the prior allow-list revision.
This review doesn't count toward merge requirements. Sign up for the private preview to control whether Copilot approvals count.
Pull request overview
Updates the pinned harden-runner egress allow-list revision used across this repository’s reusable workflows and example callers, aligning all live pins to the v0.12.2 allow-list commit for consistent runner hardening behavior.
Changes:
- Bumps
HARDEN_RUNNER_ALLOWLISTexample workflow pins from v0.12.1 → v0.12.2 (commitbf6642f...). - Updates harden-runner-block-action
configpins intag-push,release-drafter, andclear-action-cacheworkflows to v0.12.2. - Updates reusable workflow input defaults (
harden_runner_allowlist) to v0.12.2 across build/test variants.
File summaries
| File | Description |
|---|---|
| examples/build-test-release/github.yaml | Updates example HARDEN_RUNNER_ALLOWLIST pin to v0.12.2. |
| examples/build-test-release/gerrit.yaml | Updates example HARDEN_RUNNER_ALLOWLIST pin to v0.12.2. |
| examples/build-test-release-multiarch/github.yaml | Updates example HARDEN_RUNNER_ALLOWLIST pin to v0.12.2. |
| examples/build-test-release-multiarch/gerrit.yaml | Updates example HARDEN_RUNNER_ALLOWLIST pin to v0.12.2. |
| .github/workflows/tag-push.yaml | Updates both tag-push jobs’ allow-list config pin to v0.12.2. |
| .github/workflows/release-drafter.yaml | Updates allow-list config pin to v0.12.2. |
| .github/workflows/clear-action-cache.yaml | Updates allow-list config pin to v0.12.2. |
| .github/workflows/build-test.yaml | Updates reusable workflow input default allow-list pin to v0.12.2. |
| .github/workflows/build-test-release.yaml | Updates reusable workflow input default allow-list pin to v0.12.2. |
| .github/workflows/build-test-release-multiarch.yaml | Updates reusable workflow input default allow-list pin to v0.12.2. |
| .github/workflows/build-test-multiarch.yaml | Updates reusable workflow input default allow-list pin to v0.12.2. |
Review details
- Files reviewed: 11/11 changed files
- Comments generated: 0
- Review effort level: Lite
We're testing this review assessment. Please use 👍 or 👎 to tell us if it's correct.
There was a problem hiding this comment.
🟢 Ready to approve
The changes are limited to SHA/comment pin bumps and the new SHA matches the upstream v0.12.2 annotated tag target commit.
This review doesn't count toward merge requirements. Sign up for the private preview to control whether Copilot approvals count.
Review details
- Files reviewed: 11/11 changed files
- Comments generated: 0 new
- Review effort level: Lite
We're testing this review assessment. Please use 👍 or 👎 to tell us if it's correct.
Chore: Bump harden-runner allow-list to v0.12.2
Bumps every live
.githuballow-list pin (12 sites: 4 reusable-workflow defaults,tag-push×2,release-drafter,clear-action-cache, 4 example callers) from v0.12.1 → v0.12.2 (bf6642f…, the commit the annotated tag resolves to).v0.12.2 adds:
download.sonatype.com+nexus-iq.wl.linuxfoundation.org(Sonatype IQ/CLM lane) andnodejs.org(setup-node tool-cache misses; Maven frontend-plugin builds).Note: these pins are custom string inputs, not
uses:references, so Dependabot cannot bump them — manual updates required.docs/BRIEF.mdhistorical record untouched.actionlintpasses.