chore(deps): bump step-security/harden-runner from 2.19.0 to 2.19.1

[dependabot]

Bumps step-security/harden-runner from 2.19.0 to 2.19.1.

Release notes

Sourced from step-security/harden-runner's releases.

v2.19.1

What's Changed

• fix: detect ubuntu-slim runners early and bail out by @​devantler in step-security/harden-runner#657

What the fix changes

• Harden-Runner will detect ubuntu-slim runners and exit cleanly with an informational log message, instead of post harden runner step failing on chown: invalid user: 'undefined'.

What the fix does not do

• Jobs running on ubuntu-slim will not be monitored by Harden-Runner. The agent relies on kernel-level features (that require elevated capabilities).
• Per GitHub's docs on single-CPU runners: "The container for ubuntu-slim runners runs in unprivileged mode. This means that some operations requiring elevated privileges such as mounting file systems, using Docker-in-Docker, or accessing low-level kernel features are not supported." Those low-level kernel features are what the agent needs, so monitoring inside the unprivileged container is not feasible today.

For StepSecurity enterprise customers If your security posture requires that workflows are always monitored, you can block the use of ubuntu-slim via workflow run policies see the Runner Label Policy docs. This lets you enforce that jobs only run on monitored runner types.

New Contributors

• @​devantler made their first contribution in step-security/harden-runner#657

Full Changelog: step-security/harden-runner@v2.19.0...v2.19.1

Commits

• a5ad31d Merge pull request #657 from devantler/fix/ubuntu-slim-user-env
• 6e92856 build dist and trim ubuntu-slim message
• 4e0504e Merge branch 'main' into fix/ubuntu-slim-user-env
• 376d25a fix: detect ubuntu-slim runners early and bail out
• See full diff in compare view

You can trigger a rebase of this PR by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[github-actions]

Dependency Review

The following issues were found:

• ✅ 0 vulnerable package(s)
• ✅ 0 package(s) with incompatible licenses
• ✅ 0 package(s) with invalid SPDX license definitions
• ⚠️ 20 package(s) with unknown licenses.

See the Details below.

Snapshot Warnings

⚠️: The number of snapshots compared for the base SHA (0) and the head SHA (1) do not match. You may see unexpected additions in the diff.

Re-running this action after a short time may resolve the issue. See the documentation for more information and troubleshooting advice.

License Issues

go.mod

Package	Version	License	Issue Type
github.com/creack/pty	v1.1.21	Null	Unknown License
github.com/davecgh/go-spew	v1.1.1	Null	Unknown License
github.com/hashicorp/go-version	v1.9.0	Null	Unknown License
github.com/otiai10/copy	v1.14.1	Null	Unknown License
github.com/pmezard/go-difflib	v1.0.0	Null	Unknown License
github.com/sirupsen/logrus	v1.9.4	Null	Unknown License
github.com/spf13/cobra	v1.10.2	Null	Unknown License
github.com/spf13/pflag	v1.0.10	Null	Unknown License
github.com/stretchr/testify	v1.11.1	Null	Unknown License
gopkg.in/yaml.v3	v3.0.1	Null	Unknown License
github.com/creack/pty	v1.1.21	Null	Unknown License
github.com/davecgh/go-spew	v1.1.1	Null	Unknown License
github.com/hashicorp/go-version	v1.9.0	Null	Unknown License
github.com/otiai10/copy	v1.14.1	Null	Unknown License
github.com/pmezard/go-difflib	v1.0.0	Null	Unknown License
github.com/sirupsen/logrus	v1.9.4	Null	Unknown License
github.com/spf13/cobra	v1.10.2	Null	Unknown License
github.com/spf13/pflag	v1.0.10	Null	Unknown License
github.com/stretchr/testify	v1.11.1	Null	Unknown License
gopkg.in/yaml.v3	v3.0.1	Null	Unknown License

OpenSSF Scorecard

Scorecard details

Package	Version	Score	Details
actions/step-security/harden-runner	a5ad31d6a139d249332a2605b85202e8c0b78450	🟢 8.1	Details Check Score Reason Binary-Artifacts 🟢 10 no binaries found in the repo Branch-Protection 🟢 8 branch protection is not maximal on development and all release branches CI-Tests 🟢 10 15 out of 15 merged PRs checked by a CI test -- score normalized to 10 CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Code-Review 🟢 10 all changesets reviewed Contributors 🟢 6 project has 2 contributing companies or organizations -- score normalized to 6 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Dependency-Update-Tool 🟢 10 update tool detected Fuzzing ⚠️ 0 project is not fuzzed License 🟢 10 license file detected Maintained 🟢 10 12 commit(s) and 5 issue activity found in the last 90 days -- score normalized to 10 Packaging ⚠️ -1 packaging workflow not detected Pinned-Dependencies 🟢 6 dependency not pinned by hash detected -- score normalized to 6 SAST 🟢 10 SAST tool is run on all commits Security-Policy 🟢 10 security policy file detected Signed-Releases ⚠️ -1 no releases found Token-Permissions 🟢 10 GitHub workflow tokens follow principle of least privilege Vulnerabilities ⚠️ 2 8 existing vulnerabilities detected
gomod/github.com/aymanbagabas/go-pty	v0.2.2	🟢 3.3	Details Check Score Reason Code-Review ⚠️ 0 Found 0/3 approved changesets -- score normalized to 0 Binary-Artifacts 🟢 10 no binaries found in the repo Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Maintained 🟢 5 6 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 5 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Pinned-Dependencies ⚠️ 0 dependency not pinned by hash detected -- score normalized to 0 CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Fuzzing ⚠️ 0 project is not fuzzed Packaging ⚠️ -1 packaging workflow not detected License 🟢 10 license file detected Signed-Releases ⚠️ -1 no releases found Security-Policy ⚠️ 0 security policy file not detected Branch-Protection ⚠️ 0 branch protection not enabled on development/release branches SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0
gomod/github.com/creack/pty	v1.1.21	Unknown	Unknown
gomod/github.com/davecgh/go-spew	v1.1.1	Unknown	Unknown
gomod/github.com/hashicorp/go-version	v1.9.0	Unknown	Unknown
gomod/github.com/otiai10/copy	v1.14.1	Unknown	Unknown
gomod/github.com/pmezard/go-difflib	v1.0.0	Unknown	Unknown
gomod/github.com/sirupsen/logrus	v1.9.4	Unknown	Unknown
gomod/github.com/spf13/cobra	v1.10.2	Unknown	Unknown
gomod/github.com/spf13/pflag	v1.0.10	Unknown	Unknown
gomod/github.com/stretchr/testify	v1.11.1	Unknown	Unknown
gomod/github.com/u-root/u-root	v0.11.0	🟢 7.4	Details Check Score Reason Maintained 🟢 10 30 commit(s) and 4 issue activity found in the last 90 days -- score normalized to 10 Code-Review 🟢 10 all changesets reviewed Security-Policy 🟢 4 security policy file detected Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions CII-Best-Practices ⚠️ 2 badge detected: InProgress License 🟢 10 license file detected Binary-Artifacts 🟢 9 binaries present in source code Fuzzing 🟢 10 project is fuzzed Branch-Protection ⚠️ -1 internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md Signed-Releases ⚠️ -1 no releases found Packaging 🟢 10 packaging workflow detected SAST 🟢 10 SAST tool is run on all commits Pinned-Dependencies ⚠️ 0 dependency not pinned by hash detected -- score normalized to 0
gomod/golang.org/x/crypto	v0.45.0	Unknown	Unknown
gomod/golang.org/x/sync	v0.8.0	Unknown	Unknown
gomod/golang.org/x/sys	v0.43.0	Unknown	Unknown
gomod/golang.org/x/term	v0.42.0	Unknown	Unknown
gomod/gopkg.in/yaml.v3	v3.0.1	Unknown	Unknown
actions/step-security/harden-runner	a5ad31d6a139d249332a2605b85202e8c0b78450	🟢 8.1	Details Check Score Reason Binary-Artifacts 🟢 10 no binaries found in the repo Branch-Protection 🟢 8 branch protection is not maximal on development and all release branches CI-Tests 🟢 10 15 out of 15 merged PRs checked by a CI test -- score normalized to 10 CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Code-Review 🟢 10 all changesets reviewed Contributors 🟢 6 project has 2 contributing companies or organizations -- score normalized to 6 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Dependency-Update-Tool 🟢 10 update tool detected Fuzzing ⚠️ 0 project is not fuzzed License 🟢 10 license file detected Maintained 🟢 10 12 commit(s) and 5 issue activity found in the last 90 days -- score normalized to 10 Packaging ⚠️ -1 packaging workflow not detected Pinned-Dependencies 🟢 6 dependency not pinned by hash detected -- score normalized to 6 SAST 🟢 10 SAST tool is run on all commits Security-Policy 🟢 10 security policy file detected Signed-Releases ⚠️ -1 no releases found Token-Permissions 🟢 10 GitHub workflow tokens follow principle of least privilege Vulnerabilities ⚠️ 2 8 existing vulnerabilities detected
gomod/github.com/aymanbagabas/go-pty	v0.2.2	🟢 3.3	Details Check Score Reason Code-Review ⚠️ 0 Found 0/3 approved changesets -- score normalized to 0 Binary-Artifacts 🟢 10 no binaries found in the repo Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Maintained 🟢 5 6 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 5 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Pinned-Dependencies ⚠️ 0 dependency not pinned by hash detected -- score normalized to 0 CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Fuzzing ⚠️ 0 project is not fuzzed Packaging ⚠️ -1 packaging workflow not detected License 🟢 10 license file detected Signed-Releases ⚠️ -1 no releases found Security-Policy ⚠️ 0 security policy file not detected Branch-Protection ⚠️ 0 branch protection not enabled on development/release branches SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0
gomod/github.com/creack/pty	v1.1.21	Unknown	Unknown
gomod/github.com/davecgh/go-spew	v1.1.1	Unknown	Unknown
gomod/github.com/hashicorp/go-version	v1.9.0	Unknown	Unknown
gomod/github.com/otiai10/copy	v1.14.1	Unknown	Unknown
gomod/github.com/pmezard/go-difflib	v1.0.0	Unknown	Unknown
gomod/github.com/sirupsen/logrus	v1.9.4	Unknown	Unknown
gomod/github.com/spf13/cobra	v1.10.2	Unknown	Unknown
gomod/github.com/spf13/pflag	v1.0.10	Unknown	Unknown
gomod/github.com/stretchr/testify	v1.11.1	Unknown	Unknown
gomod/github.com/u-root/u-root	v0.11.0	🟢 7.4	Details Check Score Reason Maintained 🟢 10 30 commit(s) and 4 issue activity found in the last 90 days -- score normalized to 10 Code-Review 🟢 10 all changesets reviewed Security-Policy 🟢 4 security policy file detected Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions CII-Best-Practices ⚠️ 2 badge detected: InProgress License 🟢 10 license file detected Binary-Artifacts 🟢 9 binaries present in source code Fuzzing 🟢 10 project is fuzzed Branch-Protection ⚠️ -1 internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md Signed-Releases ⚠️ -1 no releases found Packaging 🟢 10 packaging workflow detected SAST 🟢 10 SAST tool is run on all commits Pinned-Dependencies ⚠️ 0 dependency not pinned by hash detected -- score normalized to 0
gomod/golang.org/x/crypto	v0.45.0	Unknown	Unknown
gomod/golang.org/x/sync	v0.8.0	Unknown	Unknown
gomod/golang.org/x/sys	v0.43.0	Unknown	Unknown
gomod/golang.org/x/term	v0.42.0	Unknown	Unknown
gomod/gopkg.in/yaml.v3	v3.0.1	Unknown	Unknown

Scanned Files

• .github/workflows/release.yml
• .github/workflows/tpip-check.yml
• go.mod

[qltysh]

Coverage Impact

This PR will not change total coverage.

🚦 See full report on Qlty Cloud »

🛟 Help

• Diff Coverage: Coverage for added or modified lines of code (excludes deleted files). Learn more.

• Total Coverage: Coverage for the whole repository, calculated as the sum of all File Coverage. Learn more.

• File Coverage: Covered Lines divided by Covered Lines plus Missed Lines. (Excludes non-executable lines including blank lines and comments.)

  • Indirect Changes: Changes to File Coverage for files that were not modified in this PR. Learn more.