[renovate]

This PR contains the following updates:

Package	Type	Update	Change
step-security/harden-runner	action	major	v1.5.0 → v2.22.4

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

step-security/harden-runner

v2.22.4

Compare Source

What's Changed

• Fixed a Linux agent memory leak that could cause runners to run out of memory during jobs with heavy process or network activity.
• The workaround for GitHub’s DNS resolver and outbound proxy experiment on GitHub-hosted Linux runners now defaults to enabled when feature flags can’t be fetched.
• Improved HTTP/2 TLS interception on Linux (enterprise tier).
• Added retries for failed monitoring API requests, improving reliability of monitoring initialization and raw-event uploads.

Full Changelog: step-security/harden-runner@v2.22.3...v2.22.4

v2.22.3

Compare Source

What's Changed

• Added support for Avrea-hosted runners (enterprise tier)
• Fixed unexpected blocking of allowed connections caused by GitHub’s DNS resolver and outbound proxy experiment on GitHub-hosted Linux runners
• Added a feature flag to disable implicit AWS endpoint allowances on self-hosted Linux runners (enterprise tier)

Full Changelog: step-security/harden-runner@v2.22.2...v2.22.3

v2.22.2

Compare Source

What's Changed

• Fixed inbound (ingress) network traffic being incorrectly classified as outbound (egress) traffic on macOS
• Fixed implicit endpoints intended for self-hosted runners being applied to custom VM environments on Linux (enterprise tier)
• Improved network and DNS tracing, enforcement logic, and process information correlation on Linux (enterprise tier)

Full Changelog: step-security/harden-runner@v2.22.1...v2.22.2

v2.22.1

Compare Source

What's Changed

• Fixed security rules not initializing on GHES self-hosted runners
• Fixed GHES connectivity in block mode by implicitly allowing the GHES hostname

Full Changelog: step-security/harden-runner@v2.22.0...v2.22.1

v2.22.0

Compare Source

What's Changed

• Linux ARM64 support for community tier
• GHES support for self-hosted VMs (enterprise tier)
• MacOS and Windows runner deny list support for block policy (enterprise tier).

Full Changelog: step-security/harden-runner@v2.21.1...v2.22.0

v2.21.1

Compare Source

What's Changed

• Improved performance of the disable-sudo feature.
• Fixed an issue in the Community tier where new endpoints required by the GitHub Actions runner were not being implicitly allowed in block mode.
• Fixed the Harden-Runner post step failing on Linux distributions that do not have a merged /usr filesystem layout (for example Debian 11), where /usr/bin/echo does not exist. This mainly affected self-hosted runners.
• Documentation updates: clarified which features are in the Community (free) vs Enterprise tier.

Full Changelog: step-security/harden-runner@v2.21.0...v2.21.1

v2.21.0

Compare Source

What's Changed

• Support for denied endpoints in block mode. This is included in the enterprise tier. Customers can deny outbound calls, for example, to public package registries.
• Improved Support for AWS CodeBuild GitHub Actions Runners.
• Bug fixes.

Full Changelog: step-security/harden-runner@v2.20.1...v2.21.0

v2.20.1

Compare Source

What's Changed

• AWS CodeBuild-hosted runner support
• Implicitly allow single-labeled (internal) domains in block-mode

Full Changelog: step-security/harden-runner@v2.20.0...v2.20.1

v2.20.0

Compare Source

What's Changed

• Support for block policy for MacOS and Windows GitHub-hosted runners
• Support for Bitrise MacOS GitHub Actions runners
• HTTPS monitoring support for Bun for Linux runners (enterprise tier)

Full Changelog: step-security/harden-runner@v2.19.4...v2.20.0

v2.19.4

Compare Source

What's Changed

• Improvements for HTTPS Monitoring for the Enterprise tier of Harden Runner

Full Changelog: step-security/harden-runner@v2.19.3...v2.19.4

v2.19.3

Compare Source

What's Changed

• Default to audit mode when api-key missing with use-policy-store by @​varunsh-coder in #​665

Full Changelog: step-security/harden-runner@v2.19.2...v2.19.3

v2.19.2

Compare Source

What's Changed

• Update the Harden Runner agent for enterprise tier to use go 1.26 and fix minor bugs.

Full Changelog: step-security/harden-runner@v2.19.1...v2.19.2

v2.19.1

Compare Source

What's Changed

• fix: detect ubuntu-slim runners early and bail out by @​devantler in #​657

What the fix changes

• Harden-Runner will detect ubuntu-slim runners and exit cleanly with an informational log message, instead of post harden runner step failing on chown: invalid user: 'undefined'.

What the fix does not do

• Jobs running on ubuntu-slim will not be monitored by Harden-Runner. The agent relies on kernel-level features (that require elevated capabilities).
• Per GitHub's docs on single-CPU runners: "The container for ubuntu-slim runners runs in unprivileged mode. This means that some operations requiring elevated privileges such as mounting file systems, using Docker-in-Docker, or accessing low-level kernel features are not supported." Those low-level kernel features are what the agent needs, so monitoring inside the unprivileged container is not feasible today.

For StepSecurity enterprise customers
If your security posture requires that workflows are always monitored, you can block the use of ubuntu-slim via workflow run policies see the Runner Label Policy docs. This lets you enforce that jobs only run on monitored runner types.

New Contributors

• @​devantler made their first contribution in #​657

Full Changelog: step-security/harden-runner@v2.19.0...v2.19.1

v2.19.0

Compare Source

What's Changed

New Runner Support

Harden-Runner now supports Depot, Blacksmith, Namespace, and WarpBuild runners with the same egress monitoring, runtime monitoring, and policy enforcement available on GitHub-hosted runners.

Automated Incident Response for Supply Chain Attacks

• Global block list: Outbound connections to known malicious domains and IPs are now blocked even in audit mode.
• System-defined detection rules: Harden-Runner will trigger lockdown mode when a high risk event is detected during an active supply chain attack (for example, a process reading the memory of the runner worker process, a common technique for stealing GitHub Actions secrets).

Bug Fixes

Windows and macOS: stability and reliability fixes

Full Changelog: step-security/harden-runner@v2.18.0...v2.19.0

v2.18.0

Compare Source

What's Changed

Global Block List: During supply chain incidents like the recent axios and trivy compromises, StepSecurity will add known malicious domains and IP addresses (IOCs) to a global block list. These will be automatically blocked, even in audit mode, providing immediate protection without requiring any workflow changes.

Deploy on Self-Hosted VM: Added deploy-on-self-hosted-vm input that allows the Harden Runner agent to be installed directly on ephemeral self-hosted Linux runner VMs at workflow runtime. This is intended as an alternative when baking the agent into the VM image is not possible.

Full Changelog: step-security/harden-runner@v2.17.0...v2.18.0

v2.17.0

Compare Source

What's Changed

Policy Store Support

Added use-policy-store and api-key inputs to fetch security policies directly from the StepSecurity Policy Store. Policies can be defined and attached at the workflow, repo, org, or cluster (ARC) level, with the most granular policy taking precedence. This is the preferred method over the existing policy input which requires id-token: write permission. If no policy is found in the store, the action defaults to audit mode.

Full Changelog: step-security/harden-runner@v2.16.1...v2.17.0

v2.16.1

Compare Source

What's Changed

Enterprise tier: Added support for direct IP addresses in the allow list
Community tier: Migrated Harden Runner telemetry to a new endpoint

Full Changelog: step-security/harden-runner@v2.16.0...v2.16.1

v2.16.0

Compare Source

What's Changed

• Updated action.yml to use node24
• Security fix: Fixed a medium severity vulnerability where the egress block policy could be bypassed via DNS over HTTPS (DoH) by proxying DNS queries through a permitted resolver, allowing data exfiltration even with a restrictive allowed-endpoints list. This issue only affects the Community Tier; the Enterprise Tier is not affected. See GHSA-46g3-37rh-v698 for details.
• Security fix: Fixed a medium severity vulnerability where the egress block policy could be bypassed via DNS queries over TCP to external resolvers, allowing outbound network communication that evades configured network restrictions. This issue only affects the Community Tier; the Enterprise Tier is not affected. See GHSA-g699-3x6g-wm3g for details.

Full Changelog: step-security/harden-runner@v2.15.1...v2.16.0

v2.15.1

Compare Source

What's Changed

• Fixes #​642 bug due to which post step was failing on Windows ARM runners
• Updates npm packages

Full Changelog: step-security/harden-runner@v2.15.0...v2.15.1

v2.15.0

Compare Source

What's Changed

Windows and macOS runner support

We are excited to announce that Harden Runner now supports Windows and macOS runners, extending runtime security beyond Linux for the first time.

Insights for Windows and macOS runners will be displayed in the same consistent format you are already familiar with from Linux runners, giving you a unified view of runtime activity across all platforms.

Full Changelog: step-security/harden-runner@v2.14.2...v2.15.0

v2.14.2

Compare Source

What's Changed

Security fix: Fixed a medium severity vulnerability where outbound network connections using sendto, sendmsg, and sendmmsg socket system calls could bypass audit logging when using egress-policy: audit. This issue only affects the Community Tier in audit mode; block mode and Enterprise Tier were not affected. See GHSA-cpmj-h4f6-r6pq for details.

Full Changelog: step-security/harden-runner@v2.14.1...v2.14.2

v2.14.1

Compare Source

What's Changed

1. In some self-hosted environments, the agent could briefly fall back to public DNS resolvers during startup if the system DNS was not yet available. This behavior was unintended for GitHub-hosted runners and has now been fixed to prevent any use of public DNS resolvers.

2. Fixed npm audit vulnerabilities

Full Changelog: step-security/harden-runner@v2.14.0...v2.14.1

v2.14.0

Compare Source

What's Changed

• Selective installation: Harden-Runner now skips installation on GitHub-hosted runners when the repository has a custom property skip_harden_runner, allowing organizations to opt out specific repos.
• Avoid double install: The action no longer installs Harden-Runner if it’s already present on a GitHub-hosted runner, which could happen when a composite action also installs it.

Full Changelog: step-security/harden-runner@v2.13.3...v2.14.0

v2.13.3

Compare Source

What's Changed

• Fixed an issue where process events were not uploaded in certain edge cases.

Full Changelog: step-security/harden-runner@v2.13.2...v2.13.3

v2.13.2

Compare Source

What's Changed

• Fixed an issue where there was a limit of 512 allowed endpoints when using block egress policy. This restriction has been removed, allowing for an unlimited number of endpoints to be configured.
• Harden Runner now automatically detects if the agent is already pre-installed on a custom VM image used by a GitHub-hosted runner. When detected, the action will skip reinstallation and use the existing agent.

Full Changelog: step-security/harden-runner@v2.13.1...v2.13.2

v2.13.1

Compare Source

What's Changed

• Graceful handling of HTTP errors: Improved error handling when fetching Harden Runner policies from the StepSecurity Policy Store API, ensuring more reliable execution even in case of temporary network/API issues.

• Security updates for npm dependencies: Updated vulnerable npm package dependencies to the latest secure versions.

• Faster enterprise agent downloads: The enterprise agent is now downloaded from GitHub Releases instead of packages.stepsecurity.io, improving download speed and reliability.

Full Changelog: step-security/harden-runner@v2.13.0...v2.13.1

v2.13.0

Compare Source

What's Changed

• Improved job markdown summary
• Https monitoring for all domains (included with the enterprise tier)

Full Changelog: step-security/harden-runner@v2...v2.13.0

v2.12.2

Compare Source

What's Changed

Added HTTPS Monitoring for additional destinations - *.githubusercontent.com
Bug fixes:

• Implicitly allow local multicast, local unicast and broadcast IP addresses in block mode
• Increased policy map size for block mode

Full Changelog: step-security/harden-runner@v2...v2.12.2

v2.12.1

Compare Source

What's Changed

• Detection capabilities have been upgraded to better recognize attempts at runner tampering. These improvements are informed by real-world incident learnings, including analysis of anomalous behaviors observed in the tj-actions and reviewdog supply chain attack.
• Resolved an issue where the block policy was not enforced correctly when the GitHub Actions job was running inside a container on a self-hosted VM runner.

Full Changelog: step-security/harden-runner@v2...v2.12.1

v2.12.0

Compare Source

What's Changed

1. A new option, disable-sudo-and-containers, is now available to replace the disable-sudo policy, addressing Docker-based privilege escalation (CVE-2025-32955). More details can be found in this blog post.

2. New detections have been added based on insights from the tj-actions and reviewdog actions incidents.

Full Changelog: step-security/harden-runner@v2...v2.12.0

v2.11.1

Compare Source

What's Changed

• cache: add support for GitHub Actions cache v2 by @​h0x0er in #​529

Full Changelog: step-security/harden-runner@v2...v2.11.1

v2.11.0

Compare Source

What's Changed

Release v2.11.0 in #​498
Harden-Runner Enterprise tier now supports the use of eBPF for DNS resolution and network call monitoring

Full Changelog: step-security/harden-runner@v2...v2.11.0

v2.10.4

Compare Source

What's Changed

Fixed a potential Harden-Runner post step failure that could occur when printing agent service logs. The fix gracefully handles failures without failing the post step.

Full Changelog: step-security/harden-runner@v2...v2.10.4

v2.10.3

Compare Source

What's Changed

Fixed an issue where DNS requests using uppercase characters (e.g., EXAMPLE.com) were blocked even when the domain was present in the allowed list. This update standardizes domain names to lowercase for consistent comparison.

Full Changelog: step-security/harden-runner@v2...v2.10.3

v2.10.2

Compare Source

What's Changed

1. Fixes low-severity command injection weaknesses
   The advisory is here: GHSA-g85v-wf27-67xc

2. Bug fix to improve detection of whether Harden-Runner is running in a container

Full Changelog: step-security/harden-runner@v2...v2.10.2

v2.10.1

Compare Source

What's Changed

Release v2.10.1 by @​varunsh-coder in #​463
Bug fix: Resolves an issue where DNS resolution of .local domains was failing when using a Kind cluster in a GitHub Actions workflow.

Full Changelog: step-security/harden-runner@v2...v2.10.1

v2.10.0

Compare Source

What's Changed

Release v2.10.0 by @​h0x0er and @​varunsh-coder in #​455

ARM Support: Harden-Runner Enterprise tier now supports GitHub-hosted ARM runners. This includes all the features that apply to previously supported GitHub-hosted x64 Linux runners.

Full Changelog: step-security/harden-runner@v2...v2.10.0

v2.9.1

Compare Source

What's Changed

Release v2.9.1 by @​h0x0er and @​varunsh-coder in #​440
This release includes two changes:

1. Updated markdown displayed in the job summary by the Harden-Runner Action.
2. Fixed a bug affecting Enterprise Tier customers where the agent attempted to upload telemetry for jobs with disable-telemetry set to true. No telemetry was uploaded as the endpoint was not in the allowed list.

Full Changelog: step-security/harden-runner@v2...v2.9.1

v2.9.0

Compare Source

What's Changed

Release v2.9.0 by @​h0x0er and @​varunsh-coder in #​435
This release includes:

• Enterprise Tier - Telemetry Upload Enhancement:
  For the enterprise tier, this change helps overcome size constraints, allowing for more reliable telemetry uploads from the Harden-Runner agent to the StepSecurity backend API. No configuration change is needed to enable this.
• Harden-Runner Agent Authentication:
  The Harden-Runner agent now uses a per-job key to authenticate to the StepSecurity backend API to submit telemetry. This change prevents the submission of telemetry data anonymously for a given job, improving the integrity of the data collection process. No configuration change is needed to enable this.
• README Update:
  A Table of Contents has been added to the README file to improve navigation. This makes it easier for users to find the information they need quickly.
• Dependency Update:
  Updated the braces npm package dependency to a non-vulnerable version. The vulnerability in braces did not affect the Harden Runner Action

Full Changelog: step-security/harden-runner@v2...v2.9.0

v2.8.1

Compare Source

What's Changed

• Bug fix: Update isGitHubHosted implementation by @​varunsh-coder in #​425
  The previous implementation incorrectly identified large GitHub-hosted runners as self-hosted runners. As a result, harden-runner was not executing on these large GitHub-hosted runners.

Full Changelog: step-security/harden-runner@v2...v2.8.1

v2.8.0

Compare Source

What's Changed

Release v2.8.0 by @​h0x0er and @​varunsh-coder in #​416
This release includes:

• File Monitoring Enhancements: Adds the capability to view the name and path of every file written during the build process.
• Process Tracking Enhancements: Adds the capability to view process names and arguments of processes run during the build process.

These enhancements are based on insights from the XZ Utils incident, aimed at improving observability and detections during the build process.

Full Changelog: step-security/harden-runner@v2...v2.8.0

v2.7.1

Compare Source

What's Changed

Release v2.7.1 by @​varunsh-coder, @​h0x0er, @​ashishkurmi in #​397
This release:

• Improves the capability to inspect outbound HTTPS traffic on GitHub-hosted and self-hosted VM runners
• Updates README to add link to case study video on how Harden-Runner detected a supply chain attack on a Google open-source project
• Addresses minor bugs

Full Changelog: step-security/harden-runner@v2.7.0...v2.7.1

v2.7.0

Compare Source

What's Changed

Release 2.7.0 by @​varunsh-coder and @​h0x0er in #​376
This release:

1. Updates the node runtime to node20
2. Adds capability to inspect outbound HTTPS traffic on GitHub-hosted and self-hosted VM runners

Full Changelog: step-security/harden-runner@v2...v2.7.0

v2.6.1

Compare Source

What's Changed

Release v2.6.1 by @​varunsh-coder and @​h0x0er in #​356
This release:

1. Improves the job summary markdown written by the Harden-Runner Action
2. Improves detection of cache endpoint used by the job
3. Detects use of Kubernetes mode in Actions Runner Controller (ARC) based runners
4. Updates dependencies

Full Changelog: step-security/harden-runner@v2...v2.6.1

v2.6.0

Compare Source

What's Changed

Release v2.6.0 by @​varunsh-coder in #​346

This release adds support for self-hosted Virtual Machine runners (e.g. on EC2).

• Both ephemeral and persistent self-hosted VM runners are supported
• Documentation: https://docs.stepsecurity.io/harden-runner/how-tos/enable-runtime-security-vm

Full Changelog: step-security/harden-runner@v2...v2.6.0

v2.5.1

Compare Source

What's Changed

• Updated default allowed endpoints to include *.actions.githubusercontent.com. GitHub Actions recently started making calls to additional sub-domains for this domain. Please update to this latest version of harden-runner to allow these new endpoints.
• Update README.md by @​varunsh-coder in #​326
• Bump step-security/harden-runner from 2.4.1 to 2.5.0 by @​dependabot in #​327

Full Changelog: step-security/harden-runner@v2...v2.5.1

v2.5.0

Compare Source

What's Changed

Release v2.5.0 by @​h0x0er and @​varunsh-coder in #​325

This release:

1. Adds support for Actions Runner Controller (ARC) environment
2. Improves the job summary markdown

Full Changelog: step-security/harden-runner@v2...v2.5.0

v2.4.1

Compare Source

What's Changed

Release v2.4.1 by @​varunsh-coder and @​Devils-Knight in #​309

This release

1. Shows a preview of the network events in the job summary markdown
2. Uses a fallback DNS service from Cloudflare in addition to Google DNS to improve reliability

Full Changelog: step-security/harden-runner@v2...v2.4.1

v2.4.0

Compare Source

What's Changed

• Release v2.4.0 by @​varunsh-coder and @​h0x0er in #​292
  Adds support for wildcard domains in block mode. e.g. you can add *.data.mcr.microsoft.com:443 to the allowed list, and egress traffic will be allowed to eastus.data.mcr.microsoft.com:443 and westus.data.mcr.microsoft.com:443.
  Link to documentation.
• Bump actions/checkout from 3.5.0 to 3.5.2 by @​dependabot in #​277
• Bump github/codeql-action from 2.2.11 to 2.2.12 by @​dependabot in #​278
• Bump step-security/harden-runner from 2.3.0 to 2.3.1 by @​dependabot in #​282
• Added a workflow for reviewing code changes using stepsecurity code reviewer by @​boahc077 in #​290

Full Changelog: step-security/harden-runner@v2...v2.4.0

v2.3.1

Compare Source

What's Changed

• Release v2.3.1 by @​arjundashrath and @​varunsh-coder in #​281
  Fixes #​279 and #​275
• Update README.md by @​varunsh-coder in #​267
• Bump step-security/harden-runner from 2.2.1 to 2.3.0 by @​dependabot in #​268
• Bump codecov/codecov-action from 3.1.1 to 3.1.2 by @​dependabot in #​273
• Bump ossf/scorecard-action from 2.1.2 to 2.1.3 by @​dependabot in #​265
• Bump actions/checkout from 3.3.0 to 3.5.0 by @​dependabot in #​261
• Bump github/codeql-action from 2.2.6 to 2.2.11 by @​dependabot in #​270

Full Changelog: step-security/harden-runner@v2...v2.3.1

v2.3.0

Compare Source

What's Changed

• Enable setting policy via insights website (link to documentation) by @​h0x0er and @​varunsh-coder in #​266
  The Policy Store helps you manage Harden Runner policies without altering your workflow files.
• Update README.md by @​varunsh-coder in #​255
• Bump github/codeql-action from 2.2.4 to 2.2.6 by @​dependabot in #​254
• Bump step-security/harden-runner from 2.2.0 to 2.2.1 by @​dependabot in #​256

Full Changelog: step-security/harden-runner@v2...v2.3.0

v2.2.1

Compare Source

What's Changed

• Fix issue to get cache endpoint by @​h0x0er in #​253
  Harden runner has the ability to automatically detect the cache endpoint used by each job. When Harden runner is used in block mode, this endpoint is added to the list of allowed endpoints. A fix has been implemented to improve this feature by updating the logic used to fetch the cache endpoint. This update involves using code from the actions/cache library to ensure the endpoint is properly retrieved.
• Update README.md by @​varunsh-coder in #​247
• Bump step-security/harden-runner from 2.1.0 to 2.2.0 by @​dependabot in #​248
• Bump github/codeql-action from 2.1.38 to 2.2.4 by @​dependabot in #​244

Full Changelog: step-security/harden-runner@v2...v2.2.1

v2.2.0

Compare Source

What's Changed

• Release v2.2.0 by @​varunsh-coder in #​245
  1. Added functionality that allows for skipping Harden Runner installation if any errors arise during the installation process.
  2. Updated Harden-Runner GitHub Action to use the latest version of the Harden Runner agent, which resolves three issues:
     • Addressed a bug that allowed calls to direct IP addresses not included in the allowed list when executing code in a docker image.
     • Enhanced annotations to eliminate false positives, specifically not showing false positive calls to docker.io
     • Upgraded containerd dependency to a non-vulnerable version.
• Bump codecov/codecov-action from 2.1.0 to 3.1.1 by @​dependabot in #​233
• Bump step-security/harden-runner from 2.0.0 to 2.1.0 by @​dependabot in #​232
• Bump github/codeql-action from 2.1.37 to 2.1.38 by @​dependabot in #​229
• Update README.md by @​varunsh-coder in #​231

Full Changelog: step-security/harden-runner@v2...v2.2.0

v2.1.0

Compare Source

What's Changed

• Add harden-runner insights URL in job summary by @​h0x0er and @​varunsh-coder in #​227.
  This makes it easier to locate and click on the insights link. One had to look for it in the build log earlier.
• Update README.md by @​varunsh-coder in #​210
• Bump github/codeql-action from 2.1.29 to 2.1.31 by @​dependabot in #​206
• Bump step-security/harden-runner from 1.5.0 to 2.0.0 by @​dependabot in #​211
• Update README by @​varunsh-coder in #​216
• Bump ossf/scorecard-action from 2.0.6 to 2.1.0 by @​dependabot in #​221
• Bump github/codeql-action from 2.1.31 to 2.1.37 by @​dependabot in #​220
• Bump ossf/scorecard-action from 2.1.0 to 2.1.2 by @​dependabot in #​223
• Bump actions/upload-artifact from 3.1.1 to 3.1.2 by @​dependabot in #​225
• Bump actions/checkout from 3.1.0 to 3.3.0 by @​dependabot in #​224

Full Changelog: step-security/harden-runner@v2...v2.1.0

v2.0.0

Compare Source

Release v2.0.0

• Feature to disable sudo: Use disable-sudo: true to run job steps without sudo access on the GitHub-hosted runner. disable-sudo is false by default and needs to be opted-into. (documentation)
• File monitoring improvements: All source code files are monitored now for overwrite, instead of a few extensions. Instead of getting annotations for overwrites, you can also opt-in to getting email or Slack notifications if source code is overwritten. (documentation)
• Support for private repositories: Starting with Harder Runner v2.0.0, use of harden runner for private repositories will require a Team/ Enterprise license. Harder Runner GitHub Action is free for all public repositories.

What's Changed

• Update README.md by @​varunsh-coder in #​187
• Bump step-security/harden-runner from 1.4.5 to 1.5.0 by @​dependabot in #​188
• Bump github/codeql-action from 2.1.22 to 2.1.26 by @​dependabot in #​189
• Add scorecard by @​varunsh-coder in #​192
• Bump actions/checkout from 3.0.0 to 3.1.0 by @​dependabot in #​198
• Bump github/codeql-action from 2.1.26 to 2.1.27 by @​dependabot in #​197
• Bump actions/upload-artifact from 3.0.0 to 3.1.0 by @​dependabot in #​194
• Bump ossf/scorecard-action from 2.0.4 to 2.0.6 by @​dependabot in #​202
• Bump github/codeql-action from 2.1.27 to 2.1.28 by @​dependabot in #​201
• Bump actions/upload-artifact from 3.1.0 to 3.1.1 by @​dependabot in #​203
• Bump github/codeql-action from 2.1.28 to 2.1.29 by @​dependabot in #​204
• Update README by @​varunsh-coder in #​208

Full Changelog: step-security/harden-runner@v1...v2.0.0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.