Updated step-security/harden-runner

.github/workflows/dependency-review.yml

@@ -18,7 +18,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1
+        uses: step-security/harden-runner@fa2e9d605c4eeb9fcad4c99c224cee0c6c7f3594 # v2.16.0
         with:
           disable-sudo: true
           egress-policy: block

.github/workflows/dockerhub_description.yml

@@ -3,26 +3,28 @@ name: DockerHub Description
 on:
   push:
     branches:
-      - 'trunk'
+      - trunk
     paths:
       - 'Dockerfiles/*/README.md'
       - '.github/workflows/dockerhub_description.yml'
   workflow_dispatch:
 
+concurrency:
+  group: dockerhub-description-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 env:
   DOCKER_REPOSITORY: "zabbix"
   IMAGES_PREFIX: "zabbix-"
   DOCKERFILES_DIRECTORY: "./Dockerfiles"
 
 permissions:
-   contents: read
+  contents: read
 
 jobs:
-  main:
+  update-description:
     name: Update description
     runs-on: ubuntu-latest
-    env:
-      DOCKER_REPOSITORY: "zabbix"
     permissions:
       contents: read
     strategy:
@@ -46,9 +48,10 @@ jobs:
           - web-nginx-mysql
           - web-nginx-pgsql
           - web-service
+
     steps:
       - name: Block egress traffic
-        uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1
+        uses: step-security/harden-runner@fa2e9d605c4eeb9fcad4c99c224cee0c6c7f3594 # v2.16.0
         with:
           disable-sudo: true
           egress-policy: block
@@ -61,7 +64,16 @@ jobs:
         with:
           fetch-depth: 1
 
-      - name: Update DockerHub repo description (zabbix-${{ matrix.component }})
+      - name: Check README file
+        run: |
+          set -Eeuo pipefail
+          readme="${DOCKERFILES_DIRECTORY}/${{ matrix.component }}/README.md"
+          if [[ ! -f "$readme" ]]; then
+            echo "::error::README file is missing: $readme"
+            exit 1
+          fi
+
+      - name: Update DockerHub repo description
         uses: peter-evans/dockerhub-description@1b9a80c056b620d92cedb9d9b5a223409c68ddfa # v5.0.0
         with:
           username: ${{ secrets.DOCKER_USERNAME }}

.github/workflows/rhel_registry_description.yml

@@ -42,7 +42,7 @@ jobs:
 
     steps:
       - name: Block egress traffic
-        uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1
+        uses: step-security/harden-runner@fa2e9d605c4eeb9fcad4c99c224cee0c6c7f3594 # v2.16.0
         with:
           disable-sudo: true
           egress-policy: block
@@ -112,7 +112,7 @@ jobs:
 
     steps:
       - name: Block egress traffic
-        uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1
+        uses: step-security/harden-runner@fa2e9d605c4eeb9fcad4c99c224cee0c6c7f3594 # v2.16.0
         with:
           disable-sudo: true
           egress-policy: block

.github/workflows/scorecard.yml

@@ -33,9 +33,16 @@ jobs:
 
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1
+        uses: step-security/harden-runner@fa2e9d605c4eeb9fcad4c99c224cee0c6c7f3594 # v2.16.0
         with:
-          egress-policy: audit
+          disable-sudo: true
+          egress-policy: block
+          allowed-endpoints: >
+            api.github.com:443
+            api.scorecard.dev:443
+            rekor.sigstore.dev:443
+            tuf-repo-cdn.sigstore.dev:443
+            fulcio.sigstore.dev:443
 
       - name: "Checkout code"
         uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1

.github/workflows/sonarcloud.yml

@@ -44,7 +44,7 @@ jobs:
 
     steps:
       - name: Block egress traffic
-        uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1
+        uses: step-security/harden-runner@fa2e9d605c4eeb9fcad4c99c224cee0c6c7f3594 # v2.16.0
         with:
           egress-policy: audit