From e872d09ef0467214061792a9a2c73b64d7b2becb Mon Sep 17 00:00:00 2001 From: Claude Date: Tue, 20 Oct 2026 13:47:16 +0000 Subject: [PATCH] fix(ci): drop harden-runner until actions.lock records it #945 added step-security/harden-runner@v2.22.2 to ci-health-sweep.yml, dependabot-automerge.yml and roadmap-sync.yml, but actions.lock has no record for it. GitHub therefore rejects the workflows at startup: Dependabot Auto-Merge ends in startup_failure on every PR since 13:34 (runs 39431585232, 39431759488 and 39432798311, the last on Dependabot #937). This restores the three files to their state before #945, which only removes the harden-runner step. To re-add it, put the steps back and run `gh actions-lock` in the same change. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01CYR5bf5FBLS7cXQK72aVNM --- .github/workflows/ci-health-sweep.yml | 8 -------- .github/workflows/dependabot-automerge.yml | 8 -------- .github/workflows/roadmap-sync.yml | 8 -------- 3 files changed, 24 deletions(-) diff --git a/.github/workflows/ci-health-sweep.yml b/.github/workflows/ci-health-sweep.yml index 3d705b66..c26d8ecc 100644 --- a/.github/workflows/ci-health-sweep.yml +++ b/.github/workflows/ci-health-sweep.yml @@ -45,14 +45,6 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 30 steps: - # Egress allowlist (RE001): this job talks only to the GitHub API. - - name: Harden runner - uses: step-security/harden-runner@v2.22.2 - with: - egress-policy: block - allowed-endpoints: > - api.github.com:443 - github.com:443 - uses: actions/checkout@v7.0.1 - name: Run CI-health sweep env: diff --git a/.github/workflows/dependabot-automerge.yml b/.github/workflows/dependabot-automerge.yml index d1875204..86842d10 100644 --- a/.github/workflows/dependabot-automerge.yml +++ b/.github/workflows/dependabot-automerge.yml @@ -62,14 +62,6 @@ jobs: pull-requests: write # needed to approve steps: - # Egress allowlist (RE001): this job talks only to the GitHub API. - - name: Harden runner - uses: step-security/harden-runner@v2.22.2 - with: - egress-policy: block - allowed-endpoints: > - api.github.com:443 - github.com:443 - name: Fetch Dependabot metadata id: meta uses: dependabot/fetch-metadata@v3.1.0 diff --git a/.github/workflows/roadmap-sync.yml b/.github/workflows/roadmap-sync.yml index ea784ee8..eae7a233 100644 --- a/.github/workflows/roadmap-sync.yml +++ b/.github/workflows/roadmap-sync.yml @@ -46,14 +46,6 @@ jobs: EXCLUDE: 'idaptik burble rattlescript vcl-ut' WINDOW_MIN: ${{ inputs.window_min || '45' }} # look-back window (> cron interval for overlap) steps: - # Egress allowlist (RE001): this job talks only to the GitHub API. - - name: Harden runner - uses: step-security/harden-runner@v2.22.2 - with: - egress-policy: block - allowed-endpoints: > - api.github.com:443 - github.com:443 - name: Mint App installation token id: app uses: actions/create-github-app-token@v3.3.0