fix(workflows): revert step-security actions to original authors#24
fix(workflows): revert step-security actions to original authors#24botantler[bot] merged 1 commit intomainfrom
Conversation
Remove harden-runner steps (trial expired). Replace step-security forks with original upstream actions using SHA pinning. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
![botantler[bot]](https://avatars.githubusercontent.com/in/1025824?s=60&v=4){kind=small}
There was a problem hiding this comment.
Pull request overview
This PR updates GitHub Actions workflows to remove StepSecurity’s harden-runner step (trial expired) and revert a forked action back to its upstream author while keeping SHA pinning, aligning workflow dependencies with upstream sources.
Changes:
- Removed
step-security/harden-runnersteps from CI and scheduled report workflows. - Replaced
step-security/git-auto-commit-actionwithstefanzweifel/git-auto-commit-action(SHA-pinned) in CI.
Reviewed changes
Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
| .github/workflows/report-repos-with-no-team.yml | Removes the harden-runner step from the scheduled “no team” report workflow. |
| .github/workflows/report-repos-with-no-admin-team.yml | Removes the harden-runner step from the scheduled “no admin team” report workflow. |
| .github/workflows/report-repos-with-multi-admin-teams.yml | Removes the harden-runner step from the scheduled “multi admin teams” report workflow. |
| .github/workflows/ci.yml | Removes harden-runner across CI jobs and switches auto-commit action back to upstream (SHA-pinned). |
| - name: Commit and push changes | ||
| uses: step-security/git-auto-commit-action@905c3cd6e9ed2b67b4d46ff401fdb6d745d0ff9d # v7.1.0 | ||
| uses: stefanzweifel/git-auto-commit-action@04702edda442b2e678b25b537cec683a1493fcb9 # v7.1.0 | ||
| with: |
There was a problem hiding this comment.
The PR description lists a replacement of step-security/docker-login-action with docker/login-action, but there is no docker/login-action usage (or step-security/docker-login-action) anywhere in the repo’s workflow YAML. Please either update the PR description to reflect the actual changes, or include the intended action replacement in this PR.
Replace step-security forks with original upstream actions using SHA pinning, and remove
harden-runnersteps (trial expired).Changes
Replaced actions
step-security/docker-login-actionv3.7.0docker/login-action@c94ce9fbv3.7.0step-security/git-auto-commit-actionv7.1.0/v7.1.1stefanzweifel/git-auto-commit-action@04702eddv7.1.0Removed steps
step-security/harden-runner(all versions) — trial expired, no upstream equivalent