chore(deps): update step-security/harden-runner action to v2.18.0 (main)

[renovate]

This PR contains the following updates:

Package	Type	Update	Change	Pending
step-security/harden-runner	action	minor	v2.17.0 → v2.18.0	v2.19.0

---

Release Notes

step-security/harden-runner (step-security/harden-runner)

v2.18.0

Compare Source

What's Changed

Global Block List: During supply chain incidents like the recent axios and trivy compromises, StepSecurity will add known malicious domains and IP addresses (IOCs) to a global block list. These will be automatically blocked, even in audit mode, providing immediate protection without requiring any workflow changes.

Deploy on Self-Hosted VM: Added deploy-on-self-hosted-vm input that allows the Harden Runner agent to be installed directly on ephemeral self-hosted Linux runner VMs at workflow runtime. This is intended as an alternative when baking the agent into the VM image is not possible.

Full Changelog: step-security/harden-runner@v2.17.0...v2.18.0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

renovate[bot]
This pull request has been included in the following image tags:

ghcr.io/vexxhost/python-openstackclient:main
ghcr.io/vexxhost/python-openstackclient:latest
ghcr.io/vexxhost/python-openstackclient:1bd1dee

Digest: ghcr.io/vexxhost/python-openstackclient@sha256:7a437dd3a9c954bc69c56f77b9a1baf0f95142d0c9253e0e619ea16e246b44e7