From 6ef9c1f452d0554d82496b8e4357e2376f17e2a1 Mon Sep 17 00:00:00 2001 From: Aris Konstantoulas Date: Thu, 9 Apr 2026 16:27:35 +0300 Subject: [PATCH] fix(vuln): pin and bump action refs (SEC-171) --- .github/workflows/build-and-quality-checks.yml | 4 ++-- .github/workflows/check-pr-title.yml | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/workflows/build-and-quality-checks.yml b/.github/workflows/build-and-quality-checks.yml index 8916a78..6b4f891 100644 --- a/.github/workflows/build-and-quality-checks.yml +++ b/.github/workflows/build-and-quality-checks.yml @@ -11,7 +11,7 @@ jobs: steps: - name: Harden the runner (Audit all outbound calls) - uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1 + uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2 with: egress-policy: audit @@ -98,4 +98,4 @@ jobs: env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} # Needed to get PR information, if any SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }} - run: mvn -B verify org.sonarsource.scanner.maven:sonar-maven-plugin:sonar -Dsonar.projectKey=rudderlabs_rudder-sdk-java \ No newline at end of file + run: mvn -B verify org.sonarsource.scanner.maven:sonar-maven-plugin:sonar -Dsonar.projectKey=rudderlabs_rudder-sdk-java diff --git a/.github/workflows/check-pr-title.yml b/.github/workflows/check-pr-title.yml index 3eeb66b..78281fa 100644 --- a/.github/workflows/check-pr-title.yml +++ b/.github/workflows/check-pr-title.yml @@ -10,7 +10,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Harden the runner (Audit all outbound calls) - uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1 + uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2 with: egress-policy: audit @@ -18,4 +18,4 @@ jobs: uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0 - name: Check PR title - uses: rudderlabs/github-action-check-pr-title@29308e12984bdb3f3dcf8dcec3308f4f4652529c # v1.0.7 \ No newline at end of file + uses: rudderlabs/github-action-check-pr-title@29308e12984bdb3f3dcf8dcec3308f4f4652529c # v1.0.7