Bump the github-actions group across 1 directory with 2 updates

[dependabot]

Bumps the github-actions group with 2 updates in the / directory: step-security/harden-runner and super-linter/super-linter.

Updates step-security/harden-runner from 2.12.0 to 2.12.1

Release notes

Sourced from step-security/harden-runner's releases.

v2.12.1

What's Changed

• Detection capabilities have been upgraded to better recognize attempts at runner tampering. These improvements are informed by real-world incident learnings, including analysis of anomalous behaviors observed in the tj-actions and reviewdog supply chain attack.
• Resolved an issue where the block policy was not enforced correctly when the GitHub Actions job was running inside a container on a self-hosted VM runner.

Full Changelog: step-security/harden-runner@v2...v2.12.1

Commits

• 002fdce Merge pull request #544 from step-security/rc-21
• 2489e3f Merge branch 'main' into rc-21
• 75dd441 Merge pull request #555 from step-security/dependabot/github_actions/step-sec...
• 4381ace Bump step-security/publish-unit-test-result-action from 2.19.0 to 2.20.0
• a9da90b Merge pull request #553 from h0x0er/feat/container-workflows
• a60ef21 update
• 4ad512f Merge branch 'rc-21' into feat/container-workflows
• 6b41a39 fixed test case
• fa70c45 update agent
• eb47845 self-hosted: refactored block-policy apply logic
• Additional commits viewable in compare view

Updates super-linter/super-linter from 7.3.0 to 7.4.0

Release notes

Sourced from super-linter/super-linter's releases.

v7.4.0

7.4.0 (2025-05-13)

🚀 Features

• add env var for npm-groovy-lint failon level (#6530) (418c922)
• check in-progress commit msg with commitlint (#6757) (57345c5), closes #6411
• disable xmllint verbose output if debuging (#6747) (e6c42ca), closes #6653
• do not hide php composer output (#6637) (1c62141)
• pass optional arguments to gitleaks (#6756) (109384b), closes #6601
• set github_before_sha on pull requests (#6687) (d7f5222)
• support eslint flat config files (#6619) (d349d57)
• support ktlint format fix (#6748) (5cb5915), closes #6618
• warn the user on conflicting tools (#6759) (b4aaae9)

🐛 Bugfixes

• check if commit count is defined before using (#6733) (d007229)
• check return code and misc test improvements (#6697) (7f46ec3)
• configure nbqa tools (#6761) (e31adf9), closes #6736
• consider git dirs safe (#6675) (101d5a6)
• do not use a pager on git log (#6765) (f5bae0c)
• emit prettier verbose output when debugging (#6636) (4e1eb5f)
• export github_before_sha (#6714) (6401906)
• fix default values for prettier fix vars (#6769) (4230ecc), closes #6768
• more robust error checking and test fixes (#6693) (1c70566)
• skip symbolic links when passing files to prettier (#6620) (417a58a)
• update editorconfig-checker config file name (#6730) (72f02f0)

⬆️ Dependency updates

• bundler: bump the rubocop group in /dependencies with 10 updates (#6661) (2757a99)
• bundler: bump the rubocop group in /dependencies with 4 updates (#6782) (17cf935)
• docker: bump python in the docker-base-images group (#6723) (960298b)
• docker: bump the docker group across 1 directory with 17 updates (#6776) (8b602a4)
• java: bump com.google.googlejavaformat:google-java-format (#6780) (aa3f3f8)
• java: bump com.puppycrawl.tools:checkstyle (#6639) (59f2b6b)
• npm: bump @​babel/eslint-parser in /dependencies (#6762) (fd53895)
• npm: bump @​babel/runtime-corejs3 (#6651) (8fbf79e)
• npm: bump @​stoplight/spectral-cli in /dependencies (#6742) (56355b5)
• npm: bump asl-validator from 3.13.0 to 3.14.0 in /dependencies (#6631) (30aa4b3)
• npm: bump asl-validator from 3.14.0 to 3.15.0 in /dependencies (#6777) (660f7dc)
• npm: bump next (#6676) (f171ee5)
• npm: bump next (#6708) (43faf95)
• npm: bump next (#6729) (536538a)
• npm: bump npm-groovy-lint from 15.1.0 to 15.2.0 in /dependencies (#6779) (c19a3da)
• npm: bump prettier from 3.5.2 to 3.5.3 in /dependencies (#6629) (6864c8c)

... (truncated)

Changelog

Sourced from super-linter/super-linter's changelog.

Changelog

7.4.0 (2025-05-13)

🚀 Features

• add env var for npm-groovy-lint failon level (#6530) (418c922)
• check in-progress commit msg with commitlint (#6757) (57345c5), closes #6411
• disable xmllint verbose output if debuging (#6747) (e6c42ca), closes #6653
• do not hide php composer output (#6637) (1c62141)
• pass optional arguments to gitleaks (#6756) (109384b), closes #6601
• set github_before_sha on pull requests (#6687) (d7f5222)
• support eslint flat config files (#6619) (d349d57)
• support ktlint format fix (#6748) (5cb5915), closes #6618
• warn the user on conflicting tools (#6759) (b4aaae9)

🐛 Bugfixes

• check if commit count is defined before using (#6733) (d007229)
• check return code and misc test improvements (#6697) (7f46ec3)
• configure nbqa tools (#6761) (e31adf9), closes #6736
• consider git dirs safe (#6675) (101d5a6)
• do not use a pager on git log (#6765) (f5bae0c)
• emit prettier verbose output when debugging (#6636) (4e1eb5f)
• export github_before_sha (#6714) (6401906)
• fix default values for prettier fix vars (#6769) (4230ecc), closes #6768
• more robust error checking and test fixes (#6693) (1c70566)
• skip symbolic links when passing files to prettier (#6620) (417a58a)
• update editorconfig-checker config file name (#6730) (72f02f0)

⬆️ Dependency updates

• bundler: bump the rubocop group in /dependencies with 10 updates (#6661) (2757a99)
• bundler: bump the rubocop group in /dependencies with 4 updates (#6782) (17cf935)
• docker: bump python in the docker-base-images group (#6723) (960298b)
• docker: bump the docker group across 1 directory with 17 updates (#6776) (8b602a4)
• java: bump com.google.googlejavaformat:google-java-format (#6780) (aa3f3f8)
• java: bump com.puppycrawl.tools:checkstyle (#6639) (59f2b6b)
• npm: bump @​babel/eslint-parser in /dependencies (#6762) (fd53895)
• npm: bump @​babel/runtime-corejs3 (#6651) (8fbf79e)
• npm: bump @​stoplight/spectral-cli in /dependencies (#6742) (56355b5)
• npm: bump asl-validator from 3.13.0 to 3.14.0 in /dependencies (#6631) (30aa4b3)
• npm: bump asl-validator from 3.14.0 to 3.15.0 in /dependencies (#6777) (660f7dc)
• npm: bump next (#6676) (f171ee5)
• npm: bump next (#6708) (43faf95)
• npm: bump next (#6729) (536538a)
• npm: bump npm-groovy-lint from 15.1.0 to 15.2.0 in /dependencies (#6779) (c19a3da)

... (truncated)

Commits

• 1215045 chore(main): release 7.4.0 (#6634)
• 8b602a4 deps(docker): bump the docker group across 1 directory with 17 updates (#6776)
• f8df7f6 deps(npm): bump the stylelint group across 1 directory with 3 updates (#6775)
• 660f7dc deps(npm): bump asl-validator from 3.14.0 to 3.15.0 in /dependencies (#6777)
• 25d4ced deps(npm): bump renovate from 40.10.4 to 40.11.8 in /dependencies (#6778)
• c19a3da deps(npm): bump npm-groovy-lint from 15.1.0 to 15.2.0 in /dependencies (#6779)
• aa3f3f8 deps(java): bump com.google.googlejavaformat:google-java-format (#6780)
• e154957 deps(python): bump the pip group across 1 directory with 3 updates (#6781)
• 17cf935 deps(bundler): bump the rubocop group in /dependencies with 4 updates (#6782)
• 2757a99 deps(bundler): bump the rubocop group in /dependencies with 10 updates (#6661)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Package	Version	Score	Details
actions/step-security/harden-runner	002fdce3c6a235733a90a27c80493a3241e56863	🟢 8.6	Details Check Score Reason Binary-Artifacts 🟢 10 no binaries found in the repo Branch-Protection ⚠️ -1 internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration CI-Tests 🟢 10 7 out of 7 merged PRs checked by a CI test -- score normalized to 10 CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Code-Review 🟢 10 all changesets reviewed Contributors 🟢 6 project has 2 contributing companies or organizations -- score normalized to 6 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Dependency-Update-Tool 🟢 10 update tool detected Fuzzing ⚠️ 0 project is not fuzzed License 🟢 10 license file detected Maintained 🟢 10 30 commit(s) and 3 issue activity found in the last 90 days -- score normalized to 10 Packaging ⚠️ -1 packaging workflow not detected Pinned-Dependencies 🟢 6 dependency not pinned by hash detected -- score normalized to 6 SAST 🟢 9 SAST tool detected but not run on all commits Security-Policy 🟢 10 security policy file detected Signed-Releases ⚠️ -1 no releases found Token-Permissions 🟢 10 GitHub workflow tokens follow principle of least privilege Vulnerabilities 🟢 9 1 existing vulnerabilities detected
actions/step-security/harden-runner	002fdce3c6a235733a90a27c80493a3241e56863	🟢 8.6	Details Check Score Reason Binary-Artifacts 🟢 10 no binaries found in the repo Branch-Protection ⚠️ -1 internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration CI-Tests 🟢 10 7 out of 7 merged PRs checked by a CI test -- score normalized to 10 CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Code-Review 🟢 10 all changesets reviewed Contributors 🟢 6 project has 2 contributing companies or organizations -- score normalized to 6 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Dependency-Update-Tool 🟢 10 update tool detected Fuzzing ⚠️ 0 project is not fuzzed License 🟢 10 license file detected Maintained 🟢 10 30 commit(s) and 3 issue activity found in the last 90 days -- score normalized to 10 Packaging ⚠️ -1 packaging workflow not detected Pinned-Dependencies 🟢 6 dependency not pinned by hash detected -- score normalized to 6 SAST 🟢 9 SAST tool detected but not run on all commits Security-Policy 🟢 10 security policy file detected Signed-Releases ⚠️ -1 no releases found Token-Permissions 🟢 10 GitHub workflow tokens follow principle of least privilege Vulnerabilities 🟢 9 1 existing vulnerabilities detected
actions/super-linter/super-linter	12150456a73e248bdc94d0794898f94e23127c88	🟢 6.6	Details Check Score Reason Security-Policy 🟢 10 security policy file detected Code-Review 🟢 4 Found 3/7 approved changesets -- score normalized to 4 Maintained 🟢 10 30 commit(s) and 17 issue activity found in the last 90 days -- score normalized to 10 CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Fuzzing ⚠️ 0 project is not fuzzed Binary-Artifacts 🟢 10 no binaries found in the repo License 🟢 10 license file detected Branch-Protection ⚠️ -1 internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration Signed-Releases ⚠️ -1 no releases found Packaging 🟢 10 packaging workflow detected SAST 🟢 9 SAST tool is not run on all commits -- score normalized to 9 Pinned-Dependencies ⚠️ 0 dependency not pinned by hash detected -- score normalized to 0 Vulnerabilities 🟢 8 2 existing vulnerabilities detected

Scanned Files

• .github/workflows/dependency.yml
• .github/workflows/lint.yml