build(deps): bump the actions group across 1 directory with 3 updates

[dependabot]

Bumps the actions group with 3 updates in the / directory: step-security/harden-runner, step-security/action-slack-notify and zizmorcore/zizmor-action.

Updates step-security/harden-runner from 2.19.0 to 2.19.4

Release notes

Sourced from step-security/harden-runner's releases.

v2.19.4

What's Changed

• Improvements for HTTPS Monitoring for the Enterprise tier of Harden Runner

Full Changelog: step-security/harden-runner@v2.19.3...v2.19.4

v2.19.3

What's Changed

• Default to audit mode when api-key missing with use-policy-store by @​varunsh-coder in step-security/harden-runner#665

Full Changelog: step-security/harden-runner@v2.19.2...v2.19.3

v2.19.2

What's Changed

• Update the Harden Runner agent for enterprise tier to use go 1.26 and fix minor bugs.

Full Changelog: step-security/harden-runner@v2.19.1...v2.19.2

v2.19.1

What's Changed

• fix: detect ubuntu-slim runners early and bail out by @​devantler in step-security/harden-runner#657

What the fix changes

• Harden-Runner will detect ubuntu-slim runners and exit cleanly with an informational log message, instead of post harden runner step failing on chown: invalid user: 'undefined'.

What the fix does not do

• Jobs running on ubuntu-slim will not be monitored by Harden-Runner. The agent relies on kernel-level features (that require elevated capabilities).
• Per GitHub's docs on single-CPU runners: "The container for ubuntu-slim runners runs in unprivileged mode. This means that some operations requiring elevated privileges such as mounting file systems, using Docker-in-Docker, or accessing low-level kernel features are not supported." Those low-level kernel features are what the agent needs, so monitoring inside the unprivileged container is not feasible today.

For StepSecurity enterprise customers If your security posture requires that workflows are always monitored, you can block the use of ubuntu-slim via workflow run policies see the Runner Label Policy docs. This lets you enforce that jobs only run on monitored runner types.

New Contributors

• @​devantler made their first contribution in step-security/harden-runner#657

Full Changelog: step-security/harden-runner@v2.19.0...v2.19.1

Commits

• 9af89fc Merge pull request #667 from step-security/update-agent-v1.8.6
• 485dce8 Update agent to v1.8.6
• ab7a940 Merge pull request #665 from step-security/fix/use-policy-store-default-audit
• ec41b78 Default to audit mode when api-key missing with use-policy-store
• 9ca718d Merge pull request #664 from step-security/update-agent-v1.8.5
• 1dee3df Update agent to v1.8.5
• a5ad31d Merge pull request #657 from devantler/fix/ubuntu-slim-user-env
• 6e92856 build dist and trim ubuntu-slim message
• 4e0504e Merge branch 'main' into fix/ubuntu-slim-user-env
• 376d25a fix: detect ubuntu-slim runners early and bail out
• See full diff in compare view

Updates step-security/action-slack-notify from 2.3.5 to 2.4.0

Release notes

Sourced from step-security/action-slack-notify's releases.

v2.4.0

What's Changed

• chore: Cherry-picked changes from upstream by @​github-actions[bot] in step-security/action-slack-notify#59
• feat: Update action.yml with docker published image by @​Raj-StepSecurity in step-security/action-slack-notify#60

New Contributors

• @​github-actions[bot] made their first contribution in step-security/action-slack-notify#59

Full Changelog: step-security/action-slack-notify@v2...v2.4.0

v2.3.6

What's Changed

• ci: Update action.yml by @​Raj-StepSecurity in step-security/action-slack-notify#47
• ci: Create claude_review.yml by @​Raj-StepSecurity in step-security/action-slack-notify#56
• ci: Create auto-cherry-pick.yml by @​Raj-StepSecurity in step-security/action-slack-notify#57
• feat: added banner and update subscription check to make maintained actions free for public repos by @​anurag-stepsecurity in step-security/action-slack-notify#55
• feat: Update action.yml by @​Raj-StepSecurity in step-security/action-slack-notify#58

New Contributors

• @​anurag-stepsecurity made their first contribution in step-security/action-slack-notify#55

Full Changelog: step-security/action-slack-notify@v2...v2.3.6

Commits

• e4cdee1 Merge pull request #60 from step-security/Raj-StepSecurity-patch-8
• 7e52924 feat: Update action.yml with docker published image
• df6752c Merge pull request #59 from step-security/auto-cherry-pick
• 3948001 Bump alpine from 865b95f to 5b10f43
• 69ab608 Remove message title when MSG_MINIMAL is true Done
• 36e490f Bump alpine from 51183f2 to 865b95f
• 7d21461 Bump alpine from 56fa17d to 51183f2
• e336b0f Clarify ENABLE_ESCAPES behaviour in readme
• 7210d1a Merge pull request #58 from step-security/Raj-StepSecurity-patch-7
• 558bd1f feat: Update action.yml
• Additional commits viewable in compare view

Updates zizmorcore/zizmor-action from 0.5.3 to 0.5.7

Release notes

Sourced from zizmorcore/zizmor-action's releases.

v0.5.7

1.26.1 is now available via the action 1.26.1 is now the default version of zizmor used by the action

v0.5.6

• 1.25.2 is now available via the action
• 1.25.2 is now the default version of zizmor used by the action

v0.5.5

This is a no-op release.

v0.5.4

• 1.25.0 is now available via the action
• 1.25.0 is now the default version of zizmor used by the action

Commits

• 192e21d Sync zizmor versions (#127)
• 2720f26 Update README.md with new actions/checkout version (#126)
• 40b41b8 chore(deps): bump the github-actions group with 2 updates (#123)
• a687b25 chore(deps): bump github/codeql-action from 4.35.5 to 4.36.0 in the github-ac...
• 64a6900 add note to explain that the default value for online-checks is different t...
• 14050ab chore(deps): bump the github-actions group with 2 updates (#118)
• ee9b419 chore(deps): bump github/codeql-action in the github-actions group (#116)
• fddf2b4 Bump pins in README (#115)
• 5f14fd0 Sync zizmor versions (#114)
• a16621b Bump pins in README (#112)
• Additional commits viewable in compare view