Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

chore(deps): bump step-security/harden-runner from 2.7.0 to 2.9.0 #810

Merged

Conversation

dependabot[bot]
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Jul 19, 2024

Bumps step-security/harden-runner from 2.7.0 to 2.9.0.

Release notes

Sourced from step-security/harden-runner's releases.

v2.9.0

What's Changed

Release v2.9.0 by @​h0x0er and @​varunsh-coder in step-security/harden-runner#435 This release includes:

  • Enterprise Tier - Telemetry Upload Enhancement: For the enterprise tier, this change helps overcome size constraints, allowing for more reliable telemetry uploads from the Harden-Runner agent to the StepSecurity backend API. No configuration change is needed to enable this.
  • Harden-Runner Agent Authentication: The Harden-Runner agent now uses a per-job key to authenticate to the StepSecurity backend API to submit telemetry. This change prevents the submission of telemetry data anonymously for a given job, improving the integrity of the data collection process. No configuration change is needed to enable this.
  • README Update: A Table of Contents has been added to the README file to improve navigation. This makes it easier for users to find the information they need quickly.
  • Dependency Update: Updated the braces npm package dependency to a non-vulnerable version. The vulnerability in braces did not affect the Harden Runner Action

Full Changelog: step-security/harden-runner@v2...v2.9.0

v2.8.1

What's Changed

  • Bug fix: Update isGitHubHosted implementation by @​varunsh-coder in step-security/harden-runner#425 The previous implementation incorrectly identified large GitHub-hosted runners as self-hosted runners. As a result, harden-runner was not executing on these large GitHub-hosted runners.

Full Changelog: step-security/harden-runner@v2...v2.8.1

v2.8.0

What's Changed

Release v2.8.0 by @​h0x0er and @​varunsh-coder in step-security/harden-runner#416 This release includes:

  • File Monitoring Enhancements: Adds the capability to view the name and path of every file written during the build process.
  • Process Tracking Enhancements: Adds the capability to view process names and arguments of processes run during the build process.

These enhancements are based on insights from the XZ Utils incident, aimed at improving observability and detections during the build process.

Full Changelog: step-security/harden-runner@v2...v2.8.0

v2.7.1

What's Changed

Release v2.7.1 by @​varunsh-coder, @​h0x0er, @​ashishkurmi in step-security/harden-runner#397 This release:

  • Improves the capability to inspect outbound HTTPS traffic on GitHub-hosted and self-hosted VM runners
  • Updates README to add link to case study video on how Harden-Runner detected a supply chain attack on a Google open-source project
  • Addresses minor bugs

Full Changelog: step-security/harden-runner@v2.7.0...v2.7.1

Commits
  • 0d38121 Release v2.9.0 (#435)
  • 29e9ae1 Merge pull request #436 from step-security/dependabot/github_actions/actions/...
  • 9d596cf Bump actions/upload-artifact from 3.1.3 to 4.3.4
  • 6d3c2fe Merge pull request #410 from step-security/dependabot/github_actions/ossf/sco...
  • c2e63d3 Bump ossf/scorecard-action from 2.3.1 to 2.3.3
  • 547a5cc Merge pull request #427 from step-security/dependabot/github_actions/step-sec...
  • a5e1dca Bump step-security/harden-runner from 2.8.0 to 2.8.1
  • 3d32f8d Merge pull request #426 from step-security/varunsh-coder-patch-1
  • 891104c Update README.md
  • 17d0e2b Merge pull request #425 from step-security/rc-9
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot will merge this PR once CI passes on it, as requested by @jeromy-cannon.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps [step-security/harden-runner](https://github.com/step-security/harden-runner) from 2.7.0 to 2.9.0.
- [Release notes](https://github.com/step-security/harden-runner/releases)
- [Commits](step-security/harden-runner@63c24ba...0d38121)

---
updated-dependencies:
- dependency-name: step-security/harden-runner
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot dependabot bot requested review from a team as code owners July 19, 2024 10:22
@dependabot dependabot bot added the dependencies Pull requests that update a dependency file label Jul 19, 2024
@dependabot dependabot bot requested a review from a team as a code owner July 19, 2024 10:22
@dependabot dependabot bot added the github_actions Pull requests that update GitHub Actions code label Jul 19, 2024
@dependabot dependabot bot requested a review from a team as a code owner July 19, 2024 10:22
@jeromy-cannon
Copy link

@dependabot squash and merge

@dependabot dependabot bot merged commit 6aa8a4f into main Jul 30, 2024
4 checks passed
@dependabot dependabot bot deleted the dependabot/github_actions/step-security/harden-runner-2.9.0 branch July 30, 2024 13:11
andrewb1269hg added a commit that referenced this pull request Oct 29, 2024
commit 00dc4d9 refactor(swift): *Transaction.fromProtobufData"
commit 0429555 Update README.md
commit 04daa0d chore(rust): update dependencies
commit 0733a43 chore(deps): bump step-security/harden-runner from 2.9.1 to 2.10.1
commit 0b9ff5e feat(rust): setup JSON (de)serialization of query types
commit 1139b1f chore(swift): change Request from a class to a protocol
commit 143ed31 chore(java): setup Java taskfile, thread example running through taskfiles
commit 16f518f feat(swift): add TokenBurnTransaction, TokenFreezeTransaction, TokenUnfreezeTransaction, TokenPauseTransaction, and TokenUnpauseTransaction
commit 17d6c60 feat(java): setup initial integration to the Rust SDK in Java
commit 18fdf0f feat: connect Swift to Rust core, produce a full Swift example for getAccountBalance
commit 1ac274c chore(ci): Expand cargo check to include examples
commit 1ae6dd9 style(swift): run swift format
commit 1c7020f feat(rust): add TopicMessageQuery, examples for Consensus
commit 200fe71 style(swift): format
commit 20fd8f1 ops: Adjust log level of Error::Transient/EmptyTransient to Level::Warn
commit 22c0aa0 feat(swift): add AccountDeleteTransaction and an example
commit 23c0f61 feat(rust): remove (C) usage of AccountId, add getter for payerAccountId
commit 243a45a docs(rust): improve docs for TokenWipe transaction
commit 2445034 release: 0.25.0-beta.1
commit 2451930 release: v0.29.0
commit 26b04cd feat(kotlin): add kotlin example for comparison and add fluent interface back in
commit 2a507de feat(swift): add FileContentsQuery and GetFileContents example
commit 2adb27a refactor(rust): inline fn typedef to prevent generation in C
commit 30cf70d Update README.md
commit 3588e1d docs(rust): improve TokenCreate transaction docs
commit 36c4247 feat(rust): expand Private and Public key impls, provide complete from/to byte
commit 3b430a0 feat(swift): add TokenMint transaction
commit 3dca253 feat: finalize paid queries and signers for FFI and Swift
commit 400da2f fix: remove some pedantic warning violations
commit 40cc835 feat: parse transaction IDs from mirror api responses
commit 4108b2f feat(rust): impl Serialize and Deserialize for transactions (through AnyTransaction)
commit 46342af chore(dart): enable strict checks
commit 47360e3 feat(rust): add FileCreate, FileUpdate, FileDelete, and FileAppend
commit 48de98f refactor(swift): clean up encoding implementation for queries and transactions
commit 4972388 feat(rust): add FileContentsQuery
commit 49a3424 feat(rust): add ContractInfo query and response
commit 4b27ad3 Handle invalid expiration time in `TokenInfo`
commit 4e8a327 Add core logic for node balancing and request back-off
commit 4ebca58 feat(java): setup initial java project configuration
commit 4ed2b5a chore(deps): Bump h2 from 0.3.24 to 0.3.26 (#767)
commit 4fe3c0c release: 0.25.0
commit 53195f6 feat(kotlin): move the binary artifacts to a separate jar (for use in Dart as well)
commit 5564991 feat(swift): add TopicCreate, TopicUpdate, TopicDelete, and TopicMessageSubmit transactions
commit 55abf78 feat: add From<Transaction<X>> to allow easy casting of transactions
commit 56953d4 feat(swift): consume errors from Rust FFI and produce a Swifty error type
commit 5753542 chore(rust): remove unused import in create_account example
commit 578df8d refactor(swift): collapse entity ID class files into EntityId.swift
commit 58438fb Remove some unused imports
commit 598f829 chore: add intial build configuration
commit 5abcb0a Release: v0.27.0
commit 5e0d496 feat(swift): add ContractCreate and ContractDelete transactions
commit 611df64 refactor: remove Duration, Timestamp, and clean up TokenCreateTransaction optionals
commit 640b0cd docs(rust): improve field docs for TokenCreate transaction
commit 64e2aba chore(rust): update dependencies
commit 680a98b chore: switch to forks of the -dalek libraries with their dependencies updated
commit 69c0885 docs(swift): rename private to public in PublicKey docs
commit 6aa8a4f chore(deps): bump step-security/harden-runner from 2.7.0 to 2.9.0 (#810)
commit 6d897f4 Release/v0.26.0
commit 6fe8938 feat(rust): add auto-retry for receipt status in TransactionReceiptQuery, add support for children/duplicate receipts
commit 7256bbf ci: 769 update ci workflows for best practices and standards
commit 76f5575 fix: proper ordering of transfer transactions
commit 77ee7fd feat(HIP-646/657/765): add metadata examples and tests
commit 78ff358 chore: setup build script to produce multi-platform library artifacts
commit 7bf223c chore(swift): uncomment min iOS SDK version
commit 7c3c33c feat: account allowance delete transaction
commit 7c986ae feat(ffi): handle errors via sidecar tls storage
commit 7e21396 feat(java): remove sdk/java in favor of a pure kotlin SDK
commit 81ffad0 Add initial account module with a working AccountBalanceQuery
commit 8223d38 update readme
commit 8328289 feat(swift): add TokenWipe transaction
commit 861cdc0 feat: add tck stuff
commit 8633087 Update sdk/rust/src/account/account_allowance_delete_transaction.rs
commit 863934d Update README.md
commit 8747a9d refactor(swift): add abstract EntityId; flatten json repr
commit 8aef965 fix(rust): adjust remaining areas after last change to use &self in more trait methods
commit 8bf7a21 feat(swift): add TokenGrantKyc and TokenRevokeKyc transactions
commit 8c5aa93 feat(java): add TransactionReceipt, TransactionReceiptQuery, getReceipt
commit 8daab1e feat(rust): add auto-retry for TransactionReceiptQuery and enhance errors with transaction context
commit 8ff01f2 feat(swift): add FileCreate, FileAppend, FileUpdate, and FileDelete transactions; rename Key::Primitive to Key::Single
commit 9035d98 chore(deps): bump actions/setup-node from 4.0.2 to 4.0.3
commit 9246d5a fix(kotlin): use runBlocking in executeBlocking instead of piggy backing off of executeAsync
commit 924d014 feat(java); add support for keys, payer account ID, and default signers
commit 92da702 refactor(kotlin): rename executeSync to executeBlocking
commit 92f1d8f chore(dart): setup ffi interop code generation for dart
commit 989d2fd chore(deps): bump curve25519-dalek from 4.1.2 to 4.1.3
commit 998359c chore(swift): remove unused newKey from delete account example
commit 9b4f497 HIP-904: Allow max_automatic_token_association to accept -1
commit 9becbfd refactor(rust): flatten json repr; rename AccountIdOrAlias to AccountAddress; rename ContractIdOrEvmAddress to ContractAddress; add 'abstract' EntityId
commit 9d30a85 fix: return correct response in execute() for `TokenRejectFlow`
commit a0c95ad fix(swift): tweak client for rust changes
commit a0d9e83 feat(rust): add basic FromStr impl for PublicKey
commit a357df4 chore: regenerate C header
commit a3901f4 Explore how AccountId will look in other languages
commit a755e58 feat: add #get_cost() to Transaction to estimate transaction fees
commit a800a55 feat: TokenReject
commit a875abf fix: resolve nft update e2e tests
commit a994c8e docs(rust): update field and method docs for GrantKyc and RevokeKyc transactions
commit aab34d7 refactor(swift): rename AccountBalance to AccountBalanceResponse
commit abf54c8 refactor(rust): remove Option<_> around amount in TokenBurn and tweak docs slightly
commit ac3dbb4 Remove Dentons proxy
commit aea7c75 style(swift): turn on more lints and apply them
commit b2011d6 fix(rust): add serde_as decorators for duration and date time in ContractUpdate
commit b2963a9 chore(swift): build ios-universal-simulator to support both m1 and intel macbooks
commit b2c8688 chore(deps): bump actions/checkout from 4.1.7 to 4.2.0
commit b3a0f8c chore: pin nightly rust to build, this is for an incredible 50% size reduction in library artifacts
commit b3a6c01 feat(swift): enforce minimum swift version
commit b63786f feat(kotlin): use suspend functions for Query#execute
commit babbf37 ops: Classify HTTP/2 Go Away and I/O Broken Pipe errors as transient
commit bb3b130 chore(deps): bump actions/checkout from 4.1.6 to 4.1.7
commit bde80a3 feat(rust): unwrap ConsensusTopicResponse to crate::TopicMessage
commit be933a9 chore(swift): build macos-universal instead of separate binaries for arm and x86
commit becba27 docs(rust): expand on documentation for Transaction<_>::execute
commit c165f5d Support automatic query payments
commit c7acd04 feat(go): setup some initial bindings for the v3 Go SDK
commit c82669e feat(rust): extend FFI to handle transactions as well as queries with one `hedera_execute`
commit c906fed chore(deps): bump step-security/harden-runner from 2.9.0 to 2.9.1
commit c9d9202 refactor(rust): make client fields file private
commit caf7afc style(swift): use CodingKeys name for coding keys in Key enum
commit cbb0083 fix(rust): add chrono 0.4 support to hedera-proto and apply rustfmt
commit ce4d743 feat(HIP-540): Change or Remove existing keys from tokens
commit ceef0e9 feat(swift): expand support for more basic types, more IDs, and key types
commit d06a680 docs(rust): add docs to ContractBytecodeQuery
commit d28dbdc fix: do not require &mut for #get_cost
commit d2ae0d4 Add default signer configuration to Client
commit d2ee4f4 Revert "feat: implement 'TopicInfoQuery'"
commit d3ff115 feat(c): add initial C FFI for client and private key
commit d4ac910 Update README.md
commit d6e1876 feat(swift): add TokenAssociateTransaction, TokenDissociateTransaction
commit d7f1667 TokenAirdrop, TokenClaimAirdrop, and TokenCancelAirdrop
commit d9c6185 feat(java): remove jsr305 and make jackson a public dep (required)
commit dac6389 release/0.28.0
commit db2a527 feat(swift): add AccountUpdateTransaction
commit db783e2 refactor: remove Fraction type and use fraction crate
commit dc50433 docs(rust): improve TokenMint transaction docs
commit dc5f358 feat(rust): expose transaction receipt type and query
commit ddcd54b docs: add README and license to swift SDK
commit e4a3078 Remove two Dentons proxies
commit e59a585 feat: support stakedNodeId in addition to stakedAccountId in AccountCreate and AccountUpdate transactions
commit e9ac4fb chore(dart): add initial (not yet working) setup for a hedera_flutter package
commit ea53173 feat(rust): expose hedera_subscribe via ffi
commit ec79c78 feat(kotlin): setup initial kotlin SDK
commit ef45607 chore: continue build setup, 'just build' now produces a XCFramework for Swift
commit f1b4618 feat(tck): Set up server and generate keys
commit f403545 feat(rust): add unit tests for (de)serialization of existing query and transaction types
commit f4325c3 style(swift): add property init to AccountCreateTransaction
commit f4ced92 feat(swift): add AccountCreateTransaction, TransactionReceiptQuery, and example for AccountCreate
commit f660076 refactor(rust): rename AccountBalance to AccountBalanceResponse
commit f7fd9b0 feat(rust): add TopicCreate, TopicUpdate, TopicDelete, and TopicMessageSubmit transactions
commit f812d05 test: TokenInfoQuery
commit f9129ef chore: initialize dart project
commit f9b2ac2 chore(deps): bump actions/checkout from 4.2.1 to 4.2.2
commit fa3fbe3 feat(hip-869): added DAB Node operations
commit faa7af4 refactor(rust): remove "max attempts" from request execution
commit facd64e fix: Restore transient error detection for canceled hyper requests
commit fc4ecaa feat(java): add initial (untested) support for transactions
commit fc5a160 refactor: move from Just to Task
commit fdaee78 feat(rust): add ContractCreate, ContractUpdate, and ContractDelete transactions
commit fdbac48 feat(swift): de-duplicate query/transaction and add an example for transferring HBAR

Signed-off-by: Andrew Brandt <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant