chore(deps): update non-major github actions

[renovate-coveooss]

This PR contains the following updates:

Package	Type	Update	Change	Pending
actions/checkout	action	minor	v4.2.2 → v4.4.0
actions/setup-go	action	minor	v5.4.0 → v5.6.0
go	uses-with	minor	1.21 → 1.27
step-security/harden-runner	action	minor	v2.11.1 → v2.21.0	v2.21.1

[skip release]

---

Release Notes

actions/checkout (actions/checkout)

v4.4.0

Compare Source

What's Changed

• [BREAKING] backport allow-unsafe-pr-checkout to v4 by @​aiqiaoy in #​2502
• backport fixes to releases-v4 by @​aiqiaoy in #​2524

https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/ for more details about this breaking change

Full Changelog: actions/checkout@v4.3.1...v4.4.0

v4.3.1

Compare Source

• Port v6 cleanup to v4 by @​ericsciple in #​2305

v4.3.0

Compare Source

• docs: update README.md by @​motss in #​1971
• Add internal repos for checking out multiple repositories by @​mouismail in #​1977
• Documentation update - add recommended permissions to Readme by @​benwells in #​2043
• Adjust positioning of user email note and permissions heading by @​joshmgross in #​2044
• Update README.md by @​nebuk89 in #​2194
• Update CODEOWNERS for actions by @​TingluoHuang in #​2224
• Update package dependencies by @​salmanmkc in #​2236

actions/setup-go (actions/setup-go)

v5.6.0

Compare Source

What's Changed

• Fall back to downloading from go.dev/dl instead of storage.googleapis.com/golang by @​aparnajyothi-y in #​689

Full Changelog: actions/setup-go@v5...v5.6.0

v5.5.0

Compare Source

What's Changed

Bug fixes:

• Update self-hosted environment validation by @​priyagupta108 in #​556
• Add manifest validation and improve error handling by @​priyagupta108 in #​586
• Update template link by @​jsoref in #​527

Dependency updates:

• Upgrade @​action/cache from 4.0.2 to 4.0.3 by @​aparnajyothi-y in #​574
• Upgrade @​actions/glob from 0.4.0 to 0.5.0 by @​dependabot in #​573
• Upgrade ts-jest from 29.1.2 to 29.3.2 by @​dependabot in #​582
• Upgrade eslint-plugin-jest from 27.9.0 to 28.11.0 by @​dependabot in #​537

New Contributors

• @​jsoref made their first contribution in #​527

Full Changelog: actions/setup-go@v5...v5.5.0

actions/go-versions (go)

v1.27.0: 1.27.0

Compare Source

Go 1.27.0

v1.26.7: 1.26.7

Compare Source

Go 1.26.7

v1.26.6: 1.26.6

Compare Source

Go 1.26.6

v1.26.5: 1.26.5

Compare Source

Go 1.26.5

v1.26.4: 1.26.4

Compare Source

Go 1.26.4

v1.26.3: 1.26.3

Compare Source

Go 1.26.3

v1.26.2: 1.26.2

Compare Source

Go 1.26.2

v1.26.1: 1.26.1

Compare Source

Go 1.26.1

v1.26.0: 1.26.0

Compare Source

Go 1.26.0

v1.25.14: 1.25.14

Compare Source

Go 1.25.14

v1.25.13: 1.25.13

Compare Source

Go 1.25.13

v1.25.12: 1.25.12

Compare Source

Go 1.25.12

v1.25.11: 1.25.11

Compare Source

Go 1.25.11

v1.25.10: 1.25.10

Compare Source

Go 1.25.10

v1.25.9: 1.25.9

Compare Source

Go 1.25.9

v1.25.8: 1.25.8

Compare Source

Go 1.25.8

v1.25.7: 1.25.7

Compare Source

Go 1.25.7

v1.25.6: 1.25.6

Compare Source

Go 1.25.6

v1.25.5: 1.25.5

Compare Source

Go 1.25.5

v1.25.4: 1.25.4

Compare Source

Go 1.25.4

v1.25.3: 1.25.3

Compare Source

Go 1.25.3

v1.25.2: 1.25.2

Compare Source

Go 1.25.2

v1.25.1: 1.25.1

Compare Source

Go 1.25.1

v1.25.0: 1.25.0

Compare Source

Go 1.25.0

v1.24.13: 1.24.13

Compare Source

Go 1.24.13

v1.24.12: 1.24.12

Compare Source

Go 1.24.12

v1.24.11: 1.24.11

Compare Source

Go 1.24.11

v1.24.10: 1.24.10

Compare Source

Go 1.24.10

v1.24.9: 1.24.9

Compare Source

Go 1.24.9

v1.24.8: 1.24.8

Compare Source

Go 1.24.8

v1.24.7: 1.24.7

Compare Source

Go 1.24.7

v1.24.6: 1.24.6

Compare Source

Go 1.24.6

v1.24.5: 1.24.5

Compare Source

Go 1.24.5

v1.24.4: 1.24.4

Compare Source

Go 1.24.4

v1.24.3: 1.24.3

Compare Source

Go 1.24.3

v1.24.2: 1.24.2

Compare Source

Go 1.24.2

v1.24.1: 1.24.1

Compare Source

Go 1.24.1

v1.24.0: 1.24.0

Compare Source

Go 1.24.0

v1.23.12: 1.23.12

Compare Source

Go 1.23.12

v1.23.11: 1.23.11

Compare Source

Go 1.23.11

v1.23.10: 1.23.10

Compare Source

Go 1.23.10

v1.23.9: 1.23.9

Compare Source

Go 1.23.9

v1.23.8: 1.23.8

Compare Source

Go 1.23.8

v1.23.7: 1.23.7

Compare Source

Go 1.23.7

v1.23.6: 1.23.6

Compare Source

Go 1.23.6

v1.23.5: 1.23.5

Compare Source

Go 1.23.5

v1.23.4: 1.23.4

Compare Source

Go 1.23.4

v1.23.3: 1.23.3

Compare Source

Go 1.23.3

v1.23.2: 1.23.2

Compare Source

Go 1.23.2

v1.23.1: 1.23.1

Compare Source

Go 1.23.1

v1.23.0: 1.23.0

Compare Source

Go 1.23.0

v1.22.12: 1.22.12

Compare Source

Go 1.22.12

v1.22.11: 1.22.11

Compare Source

Go 1.22.11

v1.22.10: 1.22.10

Compare Source

Go 1.22.10

v1.22.9: 1.22.9

Compare Source

Go 1.22.9

v1.22.8: 1.22.8

Compare Source

Go 1.22.8

v1.22.7: 1.22.7

Compare Source

Go 1.22.7

v1.22.6: 1.22.6

Compare Source

Go 1.22.6

v1.22.5: 1.22.5

Compare Source

Go 1.22.5

v1.22.4: 1.22.4

Compare Source

Go 1.22.4

v1.22.3: 1.22.3

Compare Source

Go 1.22.3

v1.22.2: 1.22.2

Compare Source

Go 1.22.2

v1.22.1: 1.22.1

Compare Source

Go 1.22.1

v1.22.0: 1.22.0

Compare Source

Go 1.22.0

step-security/harden-runner (step-security/harden-runner)

v2.21.0

Compare Source

What's Changed

• Support for denied endpoints in block mode. This is included in the enterprise tier. Customers can deny outbound calls, for example, to public package registries.
• Improved Support for AWS CodeBuild GitHub Actions Runners.
• Bug fixes.

Full Changelog: step-security/harden-runner@v2.20.1...v2.21.0

v2.20.1

Compare Source

What's Changed

• AWS CodeBuild-hosted runner support
• Implicitly allow single-labeled (internal) domains in block-mode

Full Changelog: step-security/harden-runner@v2.20.0...v2.20.1

v2.20.0

Compare Source

What's Changed

• Support for block policy for MacOS and Windows GitHub-hosted runners
• Support for Bitrise MacOS GitHub Actions runners
• HTTPS monitoring support for Bun for Linux runners (enterprise tier)

Full Changelog: step-security/harden-runner@v2.19.4...v2.20.0

v2.19.4

Compare Source

What's Changed

• Improvements for HTTPS Monitoring for the Enterprise tier of Harden Runner

Full Changelog: step-security/harden-runner@v2.19.3...v2.19.4

v2.19.3

Compare Source

What's Changed

• Default to audit mode when api-key missing with use-policy-store by @​varunsh-coder in #​665

Full Changelog: step-security/harden-runner@v2.19.2...v2.19.3

v2.19.2

Compare Source

What's Changed

• Update the Harden Runner agent for enterprise tier to use go 1.26 and fix minor bugs.

Full Changelog: step-security/harden-runner@v2.19.1...v2.19.2

v2.19.1

Compare Source

What's Changed

• fix: detect ubuntu-slim runners early and bail out by @​devantler in #​657

What the fix changes

• Harden-Runner will detect ubuntu-slim runners and exit cleanly with an informational log message, instead of post harden runner step failing on chown: invalid user: 'undefined'.

What the fix does not do

• Jobs running on ubuntu-slim will not be monitored by Harden-Runner. The agent relies on kernel-level features (that require elevated capabilities).
• Per GitHub's docs on single-CPU runners: "The container for ubuntu-slim runners runs in unprivileged mode. This means that some operations requiring elevated privileges such as mounting file systems, using Docker-in-Docker, or accessing low-level kernel features are not supported." Those low-level kernel features are what the agent needs, so monitoring inside the unprivileged container is not feasible today.

For StepSecurity enterprise customers
If your security posture requires that workflows are always monitored, you can block the use of ubuntu-slim via workflow run policies see the Runner Label Policy docs. This lets you enforce that jobs only run on monitored runner types.

New Contributors

• @​devantler made their first contribution in #​657

Full Changelog: step-security/harden-runner@v2.19.0...v2.19.1

v2.19.0

Compare Source

What's Changed

New Runner Support

Harden-Runner now supports Depot, Blacksmith, Namespace, and WarpBuild runners with the same egress monitoring, runtime monitoring, and policy enforcement available on GitHub-hosted runners.

Automated Incident Response for Supply Chain Attacks

• Global block list: Outbound connections to known malicious domains and IPs are now blocked even in audit mode.
• System-defined detection rules: Harden-Runner will trigger lockdown mode when a high risk event is detected during an active supply chain attack (for example, a process reading the memory of the runner worker process, a common technique for stealing GitHub Actions secrets).

Bug Fixes

Windows and macOS: stability and reliability fixes

Full Changelog: step-security/harden-runner@v2.18.0...v2.19.0

v2.18.0

Compare Source

What's Changed

Global Block List: During supply chain incidents like the recent axios and trivy compromises, StepSecurity will add known malicious domains and IP addresses (IOCs) to a global block list. These will be automatically blocked, even in audit mode, providing immediate protection without requiring any workflow changes.

Deploy on Self-Hosted VM: Added deploy-on-self-hosted-vm input that allows the Harden Runner agent to be installed directly on ephemeral self-hosted Linux runner VMs at workflow runtime. This is intended as an alternative when baking the agent into the VM image is not possible.

Full Changelog: step-security/harden-runner@v2.17.0...v2.18.0

v2.17.0

Compare Source

What's Changed

Policy Store Support

Added use-policy-store and api-key inputs to fetch security policies directly from the StepSecurity Policy Store. Policies can be defined and attached at the workflow, repo, org, or cluster (ARC) level, with the most granular policy taking precedence. This is the preferred method over the existing policy input which requires id-token: write permission. If no policy is found in the store, the action defaults to audit mode.

Full Changelog: step-security/harden-runner@v2.16.1...v2.17.0

v2.16.1

Compare Source

What's Changed

Enterprise tier: Added support for direct IP addresses in the allow list
Community tier: Migrated Harden Runner telemetry to a new endpoint

Full Changelog: step-security/harden-runner@v2.16.0...v2.16.1

v2.16.0

Compare Source

What's Changed

• Updated action.yml to use node24
• Security fix: Fixed a medium severity vulnerability where the egress block policy could be bypassed via DNS over HTTPS (DoH) by proxying DNS queries through a permitted resolver, allowing data exfiltration even with a restrictive allowed-endpoints list. This issue only affects the Community Tier; the Enterprise Tier is not affected. See GHSA-46g3-37rh-v698 for details.
• Security fix: Fixed a medium severity vulnerability where the egress block policy could be bypassed via DNS queries over TCP to external resolvers, allowing outbound network communication that evades configured network restrictions. This issue only affects the Community Tier; the Enterprise Tier is not affected. See GHSA-g699-3x6g-wm3g for details.

Full Changelog: step-security/harden-runner@v2.15.1...v2.16.0

v2.15.1

Compare Source

What's Changed

• Fixes #​642 bug due to which post step was failing on Windows ARM runners
• Updates npm packages

Full Changelog: step-security/harden-runner@v2.15.0...v2.15.1

v2.15.0

Compare Source

What's Changed

Windows and macOS runner support

We are excited to announce that Harden Runner now supports Windows and macOS runners, extending runtime security beyond Linux for the first time.

Insights for Windows and macOS runners will be displayed in the same consistent format you are already familiar with from Linux runners, giving you a unified view of runtime activity across all platforms.

Full Changelog: step-security/harden-runner@v2.14.2...v2.15.0

v2.14.2

Compare Source

What's Changed

Security fix: Fixed a medium severity vulnerability where outbound network connections using sendto, sendmsg, and sendmmsg socket system calls could bypass audit logging when using egress-policy: audit. This issue only affects the Community Tier in audit mode; block mode and Enterprise Tier were not affected. See GHSA-cpmj-h4f6-r6pq for details.

Full Changelog: step-security/harden-runner@v2.14.1...v2.14.2

v2.14.1

Compare Source

What's Changed

1. In some self-hosted environments, the agent could briefly fall back to public DNS resolvers during startup if the system DNS was not yet available. This behavior was unintended for GitHub-hosted runners and has now been fixed to prevent any use of public DNS resolvers.

2. Fixed npm audit vulnerabilities

Full Changelog: step-security/harden-runner@v2.14.0...v2.14.1

v2.14.0

Compare Source

What's Changed

• Selective installation: Harden-Runner now skips installation on GitHub-hosted runners when the repository has a custom property skip_harden_runner, allowing organizations to opt out specific repos.
• Avoid double install: The action no longer installs Harden-Runner if it’s already present on a GitHub-hosted runner, which could happen when a composite action also installs it.

Full Changelog: step-security/harden-runner@v2.13.3...v2.14.0

v2.13.3

Compare Source

What's Changed

• Fixed an issue where process events were not uploaded in certain edge cases.

Full Changelog: step-security/harden-runner@v2.13.2...v2.13.3

v2.13.2

Compare Source

What's Changed

• Fixed an issue where there was a limit of 512 allowed endpoints when using block egress policy. This restriction has been removed, allowing for an unlimited number of endpoints to be configured.
• Harden Runner now automatically detects if the agent is already pre-installed on a custom VM image used by a GitHub-hosted runner. When detected, the action will skip reinstallation and use the existing agent.

Full Changelog: step-security/harden-runner@v2.13.1...v2.13.2

v2.13.1

Compare Source

What's Changed

• Graceful handling of HTTP errors: Improved error handling when fetching Harden Runner policies from the StepSecurity Policy Store API, ensuring more reliable execution even in case of temporary network/API issues.

• Security updates for npm dependencies: Updated vulnerable npm package dependencies to the latest secure versions.

• Faster enterprise agent downloads: The enterprise agent is now downloaded from GitHub Releases instead of packages.stepsecurity.io, improving download speed and reliability.

Full Changelog: step-security/harden-runner@v2.13.0...v2.13.1

v2.13.0

Compare Source

What's Changed

• Improved job markdown summary
• Https monitoring for all domains (included with the enterprise tier)

Full Changelog: step-security/harden-runner@v2...v2.13.0

v2.12.2

Compare Source

What's Changed

Added HTTPS Monitoring for additional destinations - *.githubusercontent.com
Bug fixes:

• Implicitly allow local multicast, local unicast and broadcast IP addresses in block mode
• Increased policy map size for block mode

Full Changelog: step-security/harden-runner@v2...v2.12.2

v2.12.1

Compare Source

What's Changed

• Detection capabilities have been upgraded to better recognize attempts at runner tampering. These improvements are informed by real-world incident learnings, including analysis of anomalous behaviors observed in the tj-actions and reviewdog supply chain attack.
• Resolved an issue where the block policy was not enforced correctly when the GitHub Actions job was running inside a container on a self-hosted VM runner.

Full Changelog: step-security/harden-runner@v2...v2.12.1

v2.12.0

Compare Source

What's Changed

1. A new option, disable-sudo-and-containers, is now available to replace the disable-sudo policy, addressing Docker-based privilege escalation (CVE-2025-32955). More details can be found in this blog post.

2. New detections have been added based on insights from the tj-actions and reviewdog actions incidents.

Full Changelog: step-security/harden-runner@v2...v2.12.0

---

Configuration

📅 Schedule: (in timezone America/Toronto)

• Branch creation
  • "before 6:00am on Tuesday"
• Automerge
  • "after 9:00am and before 12:00pm on tuesday, wednesday, thursday"

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.