build(deps): bump step-security/harden-runner from 2.20.1 to 2.21.0 - #105
Conversation
Bumps [step-security/harden-runner](https://github.com/step-security/harden-runner) from 2.20.1 to 2.21.0. - [Release notes](https://github.com/step-security/harden-runner/releases) - [Commits](step-security/harden-runner@b09bb98...05e3151) --- updated-dependencies: - dependency-name: step-security/harden-runner dependency-version: 2.21.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
![opencode-agent[bot]](https://avatars.githubusercontent.com/in/1549082?s=60&v=4){kind=small}
There was a problem hiding this comment.
Pull request overview
OpenCode could not approve from deterministic current-head evidence because GitHub Checks have failed.
Findings
1. HIGH Current-head GitHub Checks - Fix failed required checks before approval
- Problem: Failed same-head checks remain for
72de5499d6e97ae7f7bd804ab78b3e1644dd5a4f. - Root cause: The model-unavailable evidence fallback is allowed only when peer GitHub Checks are complete and clean.
- Fix: Read and fix the failed check logs below, then rerun the current-head checks.
- Regression test: Keep the model-unavailable fallback gated on an empty failed-check rollup.
Failed checks:
- account-unification-tests check run: failure (https://github.com/ContextualWisdomLab/keyverse/actions/runs/32248499293/job/96054138352)
- ci/account-unification-tests: FAILURE (https://github.com/ContextualWisdomLab/keyverse/actions/runs/32248499293/job/96054138352)
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow: hourly-product-development.yml"]
S1 --> I1["GitHub Actions review job"]
I1 --> R1["Review risk: Workflow: hourly-product-development.yml"]
R1 --> V1["actionlint plus required checks"]
OpenCode Review Overview
Pull request overviewOpenCode could not approve from deterministic current-head evidence because GitHub Checks have failed. Findings1. HIGH Current-head GitHub Checks - Fix failed required checks before approval
Failed checks:
Changed-File Evidence Mapflowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow: hourly-product-development.yml"]
S1 --> I1["GitHub Actions review job"]
I1 --> R1["Review risk: Workflow: hourly-product-development.yml"]
R1 --> V1["actionlint plus required checks"]
|
There was a problem hiding this comment.
Pull request overview
OpenCode could not approve from deterministic current-head evidence because GitHub Checks have failed.
Findings
1. HIGH Current-head GitHub Checks - Fix failed required checks before approval
- Problem: Failed same-head checks remain for
72de5499d6e97ae7f7bd804ab78b3e1644dd5a4f. - Root cause: The model-unavailable evidence fallback is allowed only when peer GitHub Checks are complete and clean.
- Fix: Read and fix the failed check logs below, then rerun the current-head checks.
- Regression test: Keep the model-unavailable fallback gated on an empty failed-check rollup.
Failed checks:
- account-unification-tests check run: failure (https://github.com/ContextualWisdomLab/keyverse/actions/runs/32248499293/job/96054138352)
- ci/account-unification-tests: FAILURE (https://github.com/ContextualWisdomLab/keyverse/actions/runs/32248499293/job/96054138352)
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow: hourly-product-development.yml"]
S1 --> I1["GitHub Actions review job"]
I1 --> R1["Review risk: Workflow: hourly-product-development.yml"]
R1 --> V1["actionlint plus required checks"]
|
Exact-head failure analysis for 72de549: account-unification-tests fails at uv sync --locked because the base pyproject requires coverage 7.15.4 and setuptools 84.0.0 while this head still carries the prior 7.15.2 and 83.0.0 lock entries. Reproduced with uv 0.12.5. PR #112 is the existing lock refresh for this root cause and has terminal-success Checks; keep #105 behind that protected merge, then update this branch and rerun exact-head Checks. No self-approval or predecessor evidence transfer. |
|
Exact-head failure evidence for |
|
Exact-head fix pushed: The exact-head CI failure was the same stale account-unification lockfile at Local verification at this exact tree: locked dependency sync and the complete account-unification pytest suite passed; git diff check passed. Workflow syntax validation also passed (with only the repository's pre-existing informational shellcheck warning outside this change). @opencode-agent please independently review this exact head and revalidate all terminal Checks. Do not self-approve, merge, or enable auto-merge. |
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
|
Stacked this dependency PR on the lock-refresh base |
|
@opencode-agent @cwl-noema-review Please perform a fresh independent review anchored to exact current head ef03c5a. Re-check the current base, complete diff, and terminal/queued Checks; bind any review to this SHA only. Do not treat prior comments or queued Checks as approval, and do not self-approve or merge. |
|
Current-head review request: exact SHA |
|
Review only exact current HEAD |
…github_actions/step-security/harden-runner-2.21.0
|
Review only exact current HEAD |
1 participant
Bumps step-security/harden-runner from 2.20.1 to 2.21.0.
Release notes
Sourced from step-security/harden-runner's releases.
Commits
05e3151Merge pull request #684 from step-security/rc-420f37afafix: ignore denied-endpoints on non-enterprise tier93b58eefix: resolve cache host read-first and never downgrade egress policye7399ddfix: align deny-list mode detection with agent and log when both endpoint inp...c16689ftest: add denied_endpoints to Configuration fixtures and cover deny-list merge40b99cfMerge pull request #682 from rohan-stepsecurity/rp/feat/codebuild-self-v2fedec02Merge branch 'rc-42' into rp/feat/codebuild-self-v25361fb1feat: add build artifacts286474ffeat: Support Bravo agent install on CodeBuild runners051ec05Merge pull request #683 from h0x0er/jatin/deny-listDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)