build(deps): bump the actions group across 1 directory with 5 updates (#1023)

dependabot[bot] · web-flow · commit bed8050123ff · 2026-08-07T00:38:46.000-07:00
Bumps the actions group with 5 updates in the / directory: | Package | From | To | | --- | --- | --- | | [step-security/harden-runner](https://github.com/step-security/harden-runner) | `2.20.0` | `2.20.1` | | [chainguard-dev/actions/git-tag](https://github.com/chainguard-dev/actions) | `1.6.29` | `1.6.30` | | [chainguard-dev/actions/setup-kind](https://github.com/chainguard-dev/actions) | `1.6.29` | `1.6.30` | | [chainguard-dev/actions/kind-diag](https://github.com/chainguard-dev/actions) | `1.6.29` | `1.6.30` | | [zizmorcore/zizmor-action](https://github.com/zizmorcore/zizmor-action) | `0.6.1` | `0.6.2` | Updates `step-security/harden-runner` from 2.20.0 to 2.20.1 - [Release notes](https://github.com/step-security/harden-runner/releases) - [Commits](step-security/harden-runner@bf7454d...b09bb98) Updates `chainguard-dev/actions/git-tag` from 1.6.29 to 1.6.30 - [Release notes](https://github.com/chainguard-dev/actions/releases) - [Commits](b2555de...9d63165) Updates `chainguard-dev/actions/setup-kind` from 1.6.29 to 1.6.30 - [Release notes](https://github.com/chainguard-dev/actions/releases) - [Commits](b2555de...9d63165) Updates `chainguard-dev/actions/kind-diag` from 1.6.29 to 1.6.30 - [Release notes](https://github.com/chainguard-dev/actions/releases) - [Commits](b2555de...9d63165) Updates `zizmorcore/zizmor-action` from 0.6.1 to 0.6.2 - [Release notes](https://github.com/zizmorcore/zizmor-action/releases) - [Commits](zizmorcore/zizmor-action@6fc4b00...3dc1ecc) --- updated-dependencies: - dependency-name: step-security/harden-runner dependency-version: 2.20.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions - dependency-name: chainguard-dev/actions/git-tag dependency-version: 1.6.30 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions - dependency-name: chainguard-dev/actions/setup-kind dependency-version: 1.6.30 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions - dependency-name: chainguard-dev/actions/kind-diag dependency-version: 1.6.30 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions - dependency-name: zizmorcore/zizmor-action dependency-version: 0.6.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
diff --git a/.github/workflows/actionlint.yaml b/.github/workflows/actionlint.yaml
@@ -19,7 +19,7 @@ jobs:
       contents: read
 
     steps:
-      - uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+      - uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
         with:
           egress-policy: block
           allowed-endpoints: >
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
@@ -43,7 +43,7 @@ jobs:
 
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
         with:
           egress-policy: block
           allowed-endpoints: >
@@ -85,7 +85,7 @@ jobs:
 
       - name: Bump and push Git tag
         id: tag
-        uses: chainguard-dev/actions/git-tag@b2555de0cf9724fb9b49d050ff18bd1f49562ba7 # v1.6.29
+        uses: chainguard-dev/actions/git-tag@9d631658f55713e5f63ca0cc21ee168f81301fd9 # v1.6.30
         if: steps.check.outputs.bump == 'yes'
         with:
           token: ${{ steps.octo-sts.outputs.token }}
diff --git a/.github/workflows/test-apt-faster.yaml b/.github/workflows/test-apt-faster.yaml
@@ -20,7 +20,7 @@ jobs:
 
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
         with:
           egress-policy: block
           allowed-endpoints: >
diff --git a/.github/workflows/test-argo-workflows.yaml b/.github/workflows/test-argo-workflows.yaml
@@ -18,7 +18,7 @@ jobs:
     name: Install Argo Workflows and test presence in path
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
         with:
           egress-policy: audit # TODO(harden-runner): switch to block once IPv6 multicast (ff02::1) is supported (kind uses Docker container networking)
           allowed-endpoints: >
@@ -41,7 +41,7 @@ jobs:
           persist-credentials: false
 
       - name: Install Kind
-        uses: chainguard-dev/actions/setup-kind@b2555de0cf9724fb9b49d050ff18bd1f49562ba7 # v1.6.29
+        uses: chainguard-dev/actions/setup-kind@9d631658f55713e5f63ca0cc21ee168f81301fd9 # v1.6.30
 
       - name: Install Argo Workflows
         uses: ./setup-argo-workflows
@@ -58,7 +58,7 @@ jobs:
     name: Install Argo CLI only and test presence in path
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
         with:
           egress-policy: block
           allowed-endpoints: >
diff --git a/.github/workflows/test-bump-go-version.yaml b/.github/workflows/test-bump-go-version.yaml
@@ -16,7 +16,7 @@ jobs:
       contents: read
 
     steps:
-      - uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+      - uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
         with:
           egress-policy: block
           allowed-endpoints: >
@@ -80,7 +80,7 @@ jobs:
       contents: read
 
     steps:
-      - uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+      - uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
         with:
           egress-policy: block
           allowed-endpoints: >
@@ -136,7 +136,7 @@ jobs:
       contents: read
 
     steps:
-      - uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+      - uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
         with:
           egress-policy: block
           allowed-endpoints: >
@@ -184,7 +184,7 @@ jobs:
       contents: read
 
     steps:
-      - uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+      - uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
         with:
           egress-policy: block
           allowed-endpoints: >
diff --git a/.github/workflows/test-git-tag.yaml b/.github/workflows/test-git-tag.yaml
@@ -18,7 +18,7 @@ jobs:
 
     name: Test Git Tag
     steps:
-      - uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+      - uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
         with:
           egress-policy: block
           allowed-endpoints: >
diff --git a/.github/workflows/test-gitsign.yaml b/.github/workflows/test-gitsign.yaml
@@ -30,7 +30,7 @@ jobs:
     name: Install Gitsign and test presence in path
     steps:
     - name: Harden the runner (Audit all outbound calls)
-      uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+      uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
       with:
         egress-policy: block
         # The sectigo.com/lencr.org entries are the OCSP, CRL and AIA endpoints
diff --git a/.github/workflows/test-matrix-extra-inputs.yaml b/.github/workflows/test-matrix-extra-inputs.yaml
@@ -13,7 +13,7 @@ jobs:
       contents: read
 
     steps:
-    - uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+    - uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
       with:
         egress-policy: block
         allowed-endpoints: >
diff --git a/.github/workflows/test-otel-export.yaml b/.github/workflows/test-otel-export.yaml
@@ -17,7 +17,7 @@ jobs:
 
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
         with:
           egress-policy: block
           allowed-endpoints: >
diff --git a/.github/workflows/test-setup-eksctl.yaml b/.github/workflows/test-setup-eksctl.yaml
@@ -20,7 +20,7 @@ jobs:
 
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
         with:
           egress-policy: block
           allowed-endpoints: >
diff --git a/.github/workflows/test-setup-hakn.yaml b/.github/workflows/test-setup-hakn.yaml
@@ -24,7 +24,7 @@ jobs:
     name: Install hakn (Knative + Istio) and verify it comes up
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
         with:
           egress-policy: audit # TODO(harden-runner): switch to block once IPv6 multicast (ff02::1) is supported (kind uses Docker container networking)
 
@@ -46,4 +46,4 @@ jobs:
 
       - name: Collect diagnostics
         if: ${{ failure() }}
-        uses: chainguard-dev/actions/kind-diag@b2555de0cf9724fb9b49d050ff18bd1f49562ba7 # v1.6.29
+        uses: chainguard-dev/actions/kind-diag@9d631658f55713e5f63ca0cc21ee168f81301fd9 # v1.6.30
diff --git a/.github/workflows/test-setup-kind.yaml b/.github/workflows/test-setup-kind.yaml
@@ -58,7 +58,7 @@ jobs:
       contents: read
 
     steps:
-    - uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+    - uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
       with:
         egress-policy: audit # TODO(harden-runner): switch to block once IPv6 multicast (ff02::1) is supported
         allowed-endpoints: >
@@ -144,7 +144,7 @@ jobs:
 
     - name: Collect diagnostics
       if: ${{ failure() }}
-      uses: chainguard-dev/actions/kind-diag@b2555de0cf9724fb9b49d050ff18bd1f49562ba7 # v1.6.29
+      uses: chainguard-dev/actions/kind-diag@9d631658f55713e5f63ca0cc21ee168f81301fd9 # v1.6.30
       with:
         artifact-name: logs.${{ matrix.k8s-version }}
 
@@ -163,7 +163,7 @@ jobs:
       contents: read
 
     steps:
-    - uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+    - uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
       with:
         egress-policy: audit
         allowed-endpoints: >
@@ -216,7 +216,7 @@ jobs:
 
     - name: Collect diagnostics
       if: ${{ failure() }}
-      uses: chainguard-dev/actions/kind-diag@b2555de0cf9724fb9b49d050ff18bd1f49562ba7 # v1.6.29
+      uses: chainguard-dev/actions/kind-diag@9d631658f55713e5f63ca0cc21ee168f81301fd9 # v1.6.30
       with:
         artifact-name: logs.kvm-available
 
@@ -232,7 +232,7 @@ jobs:
       contents: read
 
     steps:
-    - uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+    - uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
       with:
         egress-policy: audit
         allowed-endpoints: >
@@ -279,6 +279,6 @@ jobs:
 
     - name: Collect diagnostics
       if: ${{ failure() }}
-      uses: chainguard-dev/actions/kind-diag@b2555de0cf9724fb9b49d050ff18bd1f49562ba7 # v1.6.29
+      uses: chainguard-dev/actions/kind-diag@9d631658f55713e5f63ca0cc21ee168f81301fd9 # v1.6.30
       with:
         artifact-name: logs.kvm-unavailable
diff --git a/.github/workflows/test-setup-knative-eventing.yaml b/.github/workflows/test-setup-knative-eventing.yaml
@@ -24,7 +24,7 @@ jobs:
     name: Install Knative Eventing and verify it comes up
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
         with:
           egress-policy: audit # TODO(harden-runner): switch to block once IPv6 multicast (ff02::1) is supported (kind uses Docker container networking)
 
@@ -50,4 +50,4 @@ jobs:
 
       - name: Collect diagnostics
         if: ${{ failure() }}
-        uses: chainguard-dev/actions/kind-diag@b2555de0cf9724fb9b49d050ff18bd1f49562ba7 # v1.6.29
+        uses: chainguard-dev/actions/kind-diag@9d631658f55713e5f63ca0cc21ee168f81301fd9 # v1.6.30
diff --git a/.github/workflows/test-setup-melange.yaml b/.github/workflows/test-setup-melange.yaml
@@ -26,7 +26,7 @@ jobs:
 
       fail-fast: false
     steps:
-    - uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+    - uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
       with:
         egress-policy: block
         allowed-endpoints: >
@@ -63,7 +63,7 @@ jobs:
       contents: read
 
     steps:
-      - uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+      - uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
         with:
           egress-policy: block
           allowed-endpoints: >
diff --git a/.github/workflows/test-setup-monitoring.yaml b/.github/workflows/test-setup-monitoring.yaml
@@ -25,7 +25,7 @@ jobs:
     name: Install monitoring stack and verify it comes up
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
         with:
           egress-policy: audit # TODO(harden-runner): switch to block once IPv6 multicast (ff02::1) is supported (kind uses Docker container networking)
 
@@ -63,4 +63,4 @@ jobs:
 
       - name: Collect diagnostics
         if: ${{ failure() }}
-        uses: chainguard-dev/actions/kind-diag@b2555de0cf9724fb9b49d050ff18bd1f49562ba7 # v1.6.29
+        uses: chainguard-dev/actions/kind-diag@9d631658f55713e5f63ca0cc21ee168f81301fd9 # v1.6.30
diff --git a/.github/workflows/test-setup-registry.yaml b/.github/workflows/test-setup-registry.yaml
@@ -16,7 +16,7 @@ jobs:
       contents: read
 
     steps:
-    - uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+    - uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
       with:
         egress-policy: block
         allowed-endpoints: >
@@ -53,7 +53,7 @@ jobs:
       contents: read
 
     steps:
-    - uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+    - uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
       with:
         egress-policy: block
         allowed-endpoints: >
diff --git a/.github/workflows/test-setup-terraform.yaml b/.github/workflows/test-setup-terraform.yaml
@@ -19,7 +19,7 @@ jobs:
     name: Install terraform with a custom path of .terraform-version file
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
         with:
           egress-policy: block
           allowed-endpoints: >
@@ -69,7 +69,7 @@ jobs:
     name: Install terraform with a default action version as there is no .terraform-version file
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
         with:
           egress-policy: block
           allowed-endpoints: >
diff --git a/.github/workflows/test-shellcheck.yaml b/.github/workflows/test-shellcheck.yaml
@@ -20,7 +20,7 @@ jobs:
 
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
         with:
           egress-policy: block
           allowed-endpoints: >
diff --git a/.github/workflows/test-terraform-docs.yaml b/.github/workflows/test-terraform-docs.yaml
@@ -29,7 +29,7 @@ jobs:
     name: Install Terraform Docs and test presence in path
     steps:
     - name: Harden the runner (Audit all outbound calls)
-      uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+      uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
       with:
         egress-policy: block
         # The sectigo.com/lencr.org entries are the OCSP, CRL and AIA endpoints
diff --git a/.github/workflows/zizmor.yaml b/.github/workflows/zizmor.yaml
@@ -20,7 +20,7 @@ jobs:
       contents: read # Clone the repository
       security-events: write # Upload SARIF results to Code Scanning
     steps:
-      - uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+      - uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
         with:
           egress-policy: block
           allowed-endpoints: >
@@ -35,6 +35,6 @@ jobs:
           persist-credentials: false
 
       - name: Run zizmor
-        uses: zizmorcore/zizmor-action@6fc4b006235f201fdab3722e17240ab420d580e5 # v0.6.1
+        uses: zizmorcore/zizmor-action@3dc1ecc9bcb9e94e9b2c709687979e1298497054 # v0.6.2
         with:
           persona: pedantic
