[dependabot]

Bumps step-security/harden-runner from 2.17.0 to 2.18.0.

Release notes

Sourced from step-security/harden-runner's releases.

v2.18.0

What's Changed

Global Block List: During supply chain incidents like the recent axios and trivy compromises, StepSecurity will add known malicious domains and IP addresses (IOCs) to a global block list. These will be automatically blocked, even in audit mode, providing immediate protection without requiring any workflow changes.

Deploy on Self-Hosted VM: Added deploy-on-self-hosted-vm input that allows the Harden Runner agent to be installed directly on ephemeral self-hosted Linux runner VMs at workflow runtime. This is intended as an alternative when baking the agent into the VM image is not possible.

Full Changelog: step-security/harden-runner@v2.17.0...v2.18.0

Commits

• 6c3c2f2 Feature/deploy on self hosted vm (#658)
• See full diff in compare view

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 90.18%. Comparing base (3c1c62f) to head (6bd274d).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #4004   +/-   ##
=======================================
  Coverage   90.18%   90.18%           
=======================================
  Files         230      230           
  Lines        7299     7299           
=======================================
  Hits         6582     6582           
  Misses        717      717           

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.