Skip to content

build(deps): bump the github-actions group with 5 updates - #570

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/github-actions-fff6ce20be
Open

build(deps): bump the github-actions group with 5 updates#570
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/github-actions-fff6ce20be

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 19, 2026

Copy link
Copy Markdown
Contributor

Bumps the github-actions group with 5 updates:

Package From To
step-security/harden-runner 2.10.2 2.20.1
actions/checkout 4.2.2 7.0.1
actions/setup-dotnet 4.3.1 6.0.0
astral-sh/setup-uv 6.8.0 10.0.0
astral-sh/ruff-action 1.1.1 4.1.0

Updates step-security/harden-runner from 2.10.2 to 2.20.1

Release notes

Sourced from step-security/harden-runner's releases.

v2.20.1

What's Changed

  • AWS CodeBuild-hosted runner support
  • Implicitly allow single-labeled (internal) domains in block-mode

Full Changelog: step-security/harden-runner@v2.20.0...v2.20.1

v2.20.0

What's Changed

  • Support for block policy for MacOS and Windows GitHub-hosted runners
  • Support for Bitrise MacOS GitHub Actions runners
  • HTTPS monitoring support for Bun for Linux runners (enterprise tier)

Full Changelog: step-security/harden-runner@v2.19.4...v2.20.0

v2.19.4

What's Changed

  • Improvements for HTTPS Monitoring for the Enterprise tier of Harden Runner

Full Changelog: step-security/harden-runner@v2.19.3...v2.19.4

v2.19.3

What's Changed

Full Changelog: step-security/harden-runner@v2.19.2...v2.19.3

v2.19.2

What's Changed

  • Update the Harden Runner agent for enterprise tier to use go 1.26 and fix minor bugs.

Full Changelog: step-security/harden-runner@v2.19.1...v2.19.2

v2.19.1

What's Changed

What the fix changes

  • Harden-Runner will detect ubuntu-slim runners and exit cleanly with an informational log message, instead of post harden runner step failing on chown: invalid user: 'undefined'.

What the fix does not do

  • Jobs running on ubuntu-slim will not be monitored by Harden-Runner. The agent relies on kernel-level features (that require elevated capabilities).
  • Per GitHub's docs on single-CPU runners: "The container for ubuntu-slim runners runs in unprivileged mode. This means that some operations requiring elevated privileges such as mounting file systems, using Docker-in-Docker, or accessing low-level kernel features are not supported." Those low-level kernel features are what the agent needs, so monitoring inside the unprivileged container is not feasible today.

For StepSecurity enterprise customers If your security posture requires that workflows are always monitored, you can block the use of ubuntu-slim via workflow run policies see the Runner Label Policy docs. This lets you enforce that jobs only run on monitored runner types.

New Contributors

... (truncated)

Commits
  • b09bb98 Merge pull request #680 from step-security/aws-code-build
  • 35cd77b docs: document the Global Block List in the features list
  • bb6dbef chore: rebuild dist with clean dependency install
  • 98f73c5 chore: update eBPF agent to v1.8.14
  • 54193c1 Reapply "feat(runners): detect AWS CodeBuild-hosted runners as third-party pr...
  • d22dd48 Revert "fix(self-hosted): flush agent events at job end when deploy-on-self-h...
  • 0ff0941 fix(self-hosted): flush agent events at job end when deploy-on-self-hosted-vm...
  • a3c333d Revert "feat(runners): detect AWS CodeBuild-hosted runners as third-party pro...
  • bf94c00 feat(runners): detect AWS CodeBuild-hosted runners as third-party provider
  • 514522c fix(self-hosted): resolve runner user when USER env var is unset
  • Additional commits viewable in compare view

Updates actions/checkout from 4.2.2 to 7.0.1

Release notes

Sourced from actions/checkout's releases.

v7.0.1

What's Changed

Full Changelog: actions/checkout@v7...v7.0.1

v7.0.0

What's Changed

New Contributors

Full Changelog: actions/checkout@v6.0.3...v7.0.0

v6.1.0

What's Changed

https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/ for more details about this breaking change

Full Changelog: actions/checkout@v6.0.3...v6.1.0

v6.0.3

What's Changed

New Contributors

Full Changelog: actions/checkout@v6...v6.0.3

v6.0.2

What's Changed

... (truncated)

Changelog

Sourced from actions/checkout's changelog.

Changelog

v7.0.1

v7.0.0

v6.0.3

v6.0.2

v6.0.1

v6.0.0

v5.0.1

v5.0.0

v4.3.1

v4.3.0

v4.2.2

v4.2.1

... (truncated)

Commits

Updates actions/setup-dotnet from 4.3.1 to 6.0.0

Release notes

Sourced from actions/setup-dotnet's releases.

v6.0.0

What's Changed

New Contributors

Full Changelog: actions/setup-dotnet@v5...v6.0.0

v5.4.0

What's Changed

Enhancements

The action now validates the sdk.version field in global.json when rollForward is specified. The version must be a fully-qualified SDK version (e.g., 8.0.100, 10.0.100). Wildcard versions (e.g., 10.0.*) and runtime-style versions (e.g., 8.0.0) will now fail. See the .NET SDK version specification for details.

Documentation

Bug Fixes

Dependency Updates

New Contributors

Full Changelog: actions/setup-dotnet@v5.3.0...v5.4.0

v5.3.0

What's Changed

Enhancements

Dependency Updates

... (truncated)

Commits
  • a98b568 chore(deps): bump @​actions/cache to 6.2.0 (#756)
  • afb2931 Bump actions/checkout from 6.0.3 to 7.0.0 (#751)
  • 6df8cef Migrate to ESM and upgrade dependencies (#752)
  • 26b0ec1 Expand the CSC problem matcher to light up more errors on GitHub. (#717)
  • da5e548 docs(action): explicitly mark all optional inputs with required: false (#737)
  • 9bd3b44 Improve readability of global.json creation command (#694)
  • 4406a63 Bump @​actions/cache to 5.1.0, log cache write denied (#746)
  • dc3262d pin actions to commit SHAs in workflows (#744)
  • 95a3f8b Validate global.json SDK version before rollForward optimization (#742)
  • 9a946fd Add rollForward note in README, improve proxy health check in e2e tests and b...
  • Additional commits viewable in compare view

Updates astral-sh/setup-uv from 6.8.0 to 10.0.0

Release notes

Sourced from astral-sh/setup-uv's releases.

v10.0.0 🌈 Disable automatic caching for sensitive events and new QOL features

Changes

Another breaking release, directly after v9.0.0 but we think the added security justifies that.

Extra security by default

If you use the default enable-cache: auto this will now DISABLE THE CACHE to protect against cache poisoning for the following events:

  • pull_request_target
  • workflow_run
  • release

You can read the full reasoning in astral-sh/setup-uv#984

version: latest-known

- name: Install the latest version of uv known to setup-uv
  uses: astral-sh/setup-uv@v10.0.0
  with:
    version: "latest-known"

This will now install the latest version with a checksum that is known by this action. The known uv checksums are automatically updated but will take a release of this action to take effect. You won't be always using the latest & greatest but you will have an extra level of security.

Read python version from .tool-versions

- name: Install uv based on the version defined in .tool-versions and also set python
  uses: astral-sh/setup-uv@v10.0.0
  with:
    version-file: "pyproject.toml"

Will now also set the python version if it is defined in .tool-versions. You can read the details in the docs

🚨 Breaking changes

🐛 Bug fixes

🚀 Enhancements

... (truncated)

Commits

Updates astral-sh/ruff-action from 1.1.1 to 4.1.0

Release notes

Sourced from astral-sh/ruff-action's releases.

v4.1.0 🌈 Skip Astral mirror and support uv.lock

Changes

Among some minor bugfixes this release adds the option to skip the astral-sh mirror and download directly from GitHub releases. Useful if the Astral mirror can't or shouldn't be used.

Also big thanks to @​somaz94 for adding support for reading the desired ruff version from uv.lock. This works automatically if you haven't overridden the version discovery by using the inputs version or version-file

🐛 Bug fixes

🚀 Enhancements

🧰 Maintenance

📚 Documentation

⬆️ Dependency updates

v4.0.0 🌈 Immutable releases, node24 and manifest-file

This is the first immutable release of ruff-action 🥳

All future releases are also immutable, if you want to know more about what this means checkout the docs.

This action now also supports the mainfest-file input which lets you define custom ruff versions and custom download locations.

Last but not least this action now runs on node24. This might be a breaking change on very old self-hosted runners.

... (truncated)

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
build(deps): bump the github-actions group with 5 updates
9a732dd 
Bumps the github-actions group with 5 updates:

| Package | From | To |
| --- | --- | --- |
| [step-security/harden-runner](https://github.com/step-security/harden-runner) | `2.10.2` | `2.20.1` |
| [actions/checkout](https://github.com/actions/checkout) | `4.2.2` | `7.0.1` |
| [actions/setup-dotnet](https://github.com/actions/setup-dotnet) | `4.3.1` | `6.0.0` |
| [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) | `6.8.0` | `10.0.0` |
| [astral-sh/ruff-action](https://github.com/astral-sh/ruff-action) | `1.1.1` | `4.1.0` |


Updates `step-security/harden-runner` from 2.10.2 to 2.20.1
- [Release notes](https://github.com/step-security/harden-runner/releases)
- [Commits](step-security/harden-runner@0080882...b09bb98)

Updates `actions/checkout` from 4.2.2 to 7.0.1
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@11bd719...3d3c42e)

Updates `actions/setup-dotnet` from 4.3.1 to 6.0.0
- [Release notes](https://github.com/actions/setup-dotnet/releases)
- [Commits](actions/setup-dotnet@67a3573...a98b568)

Updates `astral-sh/setup-uv` from 6.8.0 to 10.0.0
- [Release notes](https://github.com/astral-sh/setup-uv/releases)
- [Commits](astral-sh/setup-uv@d0cc045...ae62891)

Updates `astral-sh/ruff-action` from 1.1.1 to 4.1.0
- [Release notes](https://github.com/astral-sh/ruff-action/releases)
- [Commits](astral-sh/ruff-action@d0a0e81...278981a)

---
updated-dependencies:
- dependency-name: step-security/harden-runner
  dependency-version: 2.20.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
- dependency-name: actions/checkout
  dependency-version: 7.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: actions/setup-dotnet
  dependency-version: 6.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: astral-sh/setup-uv
  dependency-version: 10.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: astral-sh/ruff-action
  dependency-version: 4.1.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
...

Signed-off-by: dependabot[bot] <support@github.com>
Copilot AI lite review requested due to automatic review settings August 19, 2026 22:42
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Aug 19, 2026
Copilot AI reviewed Aug 19, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR updates pinned GitHub Actions dependencies (by commit SHA) in the repository’s workflows, keeping CI and automation aligned with newer action releases while retaining supply-chain hardening via immutable references.

Changes:

  • Bump step-security/harden-runner to v2.20.1 in CI and issue automation workflows.
  • Bump actions/checkout to v7.0.1 and actions/setup-dotnet to v6.0.0 in CI.
  • Bump Astral actions: setup-uv to v10.0.0 and ruff-action to v4.1.0.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File Description
.github/workflows/issue-analysis.yml Updates pinned action SHAs for runner hardening, checkout, and uv installation used by the issue analysis automation job.
.github/workflows/ci.yml Updates pinned action SHAs for runner hardening, checkout, .NET setup, uv installation, and Ruff lint/format in the main CI pipeline.

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot
Copilot review effort
Applies to this pull request for everyone.Learn more about Copilot code review.
Copilot left review comments
@corinagum Corina (corinagum) corinagum approved these changes

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@corinagum