From e5f146bd0736ee556e0feaef5f907ec05b7149ef Mon Sep 17 00:00:00 2001 From: Matthew Watkins Date: Thu, 3 Sep 2026 14:51:43 +0100 Subject: [PATCH] CI: Bump allow-list pin and quieten repeat summaries Two unrelated pieces of workflow housekeeping. The harden-runner allow-list now points at v0.16.1 of the shared lfreleng-actions/.github list. Both forms that carry the reference move together: the harden_runner_allowlist input default and the literal config pin in the workflows that do not take that input. Every job also loaded the allow-list and wrote the same static block to the job summary, so a caller of one of these workflows saw it once per job rather than once per run. The action already exposes allow_list_summary for this, so the block is suppressed everywhere except the first invocation in each file: what a job hardened against is worth stating, but only the first time anyone reads it. Reusable workflows cannot see beyond themselves, so this is once per workflow rather than once per run. A caller invoking several still gets one block from each, which is a large reduction on one per job and as far as a workflow can enforce on its own behalf. Co-authored-by: Claude Signed-off-by: Matthew Watkins --- .github/workflows/build-test-multiarch.yaml | 7 ++++++- .github/workflows/build-test-release-multiarch.yaml | 11 ++++++++++- .github/workflows/build-test-release.yaml | 10 +++++++++- .github/workflows/build-test.yaml | 7 ++++++- .github/workflows/release-drafter.yaml | 2 +- examples/build-test-release-multiarch/gerrit.yaml | 3 ++- examples/build-test-release-multiarch/github.yaml | 3 ++- examples/build-test-release/gerrit.yaml | 3 ++- examples/build-test-release/github.yaml | 3 ++- 9 files changed, 40 insertions(+), 9 deletions(-) diff --git a/.github/workflows/build-test-multiarch.yaml b/.github/workflows/build-test-multiarch.yaml index 8e798ec..3130f19 100644 --- a/.github/workflows/build-test-multiarch.yaml +++ b/.github/workflows/build-test-multiarch.yaml @@ -246,7 +246,7 @@ on: required: false type: string # yamllint disable-line rule:line-length - default: 'lfreleng-actions//.github/harden-runner/lfreleng-actions/allow_list.txt@f0f76ac22f342c9a788ebcabe584e68a79cc2e83' # v0.16.0 + default: 'lfreleng-actions//.github/harden-runner/lfreleng-actions/allow_list.txt@ec0736244fc776e326283c6af6840e30f316f63c' # v0.16.1 # --- Gerrit-aware checkout (empty unless dispatched via Gerrit) --- gerrit_refspec: @@ -455,6 +455,7 @@ jobs: uses: lfreleng-actions/harden-runner-block-action@805eedb0508c07714b61887a2b87a5c4bbeff22a # v0.12.1 with: config: ${{ inputs.harden_runner_allowlist }} + allow_list_summary: 'false' - name: 'Harden runner' # yamllint disable-line rule:line-length uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0 @@ -540,6 +541,7 @@ jobs: uses: lfreleng-actions/harden-runner-block-action@805eedb0508c07714b61887a2b87a5c4bbeff22a # v0.12.1 with: config: ${{ inputs.harden_runner_allowlist }} + allow_list_summary: 'false' - name: 'Harden runner' # yamllint disable-line rule:line-length uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0 @@ -634,6 +636,7 @@ jobs: uses: lfreleng-actions/harden-runner-block-action@805eedb0508c07714b61887a2b87a5c4bbeff22a # v0.12.1 with: config: ${{ inputs.harden_runner_allowlist }} + allow_list_summary: 'false' - name: 'Harden runner' # yamllint disable-line rule:line-length uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0 @@ -734,6 +737,7 @@ jobs: uses: lfreleng-actions/harden-runner-block-action@805eedb0508c07714b61887a2b87a5c4bbeff22a # v0.12.1 with: config: ${{ inputs.harden_runner_allowlist }} + allow_list_summary: 'false' - name: 'Harden runner' # yamllint disable-line rule:line-length uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0 @@ -821,6 +825,7 @@ jobs: uses: lfreleng-actions/harden-runner-block-action@805eedb0508c07714b61887a2b87a5c4bbeff22a # v0.12.1 with: config: ${{ inputs.harden_runner_allowlist }} + allow_list_summary: 'false' - name: 'Harden runner' # yamllint disable-line rule:line-length uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0 diff --git a/.github/workflows/build-test-release-multiarch.yaml b/.github/workflows/build-test-release-multiarch.yaml index 517027d..3195a24 100644 --- a/.github/workflows/build-test-release-multiarch.yaml +++ b/.github/workflows/build-test-release-multiarch.yaml @@ -250,7 +250,7 @@ on: required: false type: string # yamllint disable-line rule:line-length - default: 'lfreleng-actions//.github/harden-runner/lfreleng-actions/allow_list.txt@f0f76ac22f342c9a788ebcabe584e68a79cc2e83' # v0.16.0 + default: 'lfreleng-actions//.github/harden-runner/lfreleng-actions/allow_list.txt@ec0736244fc776e326283c6af6840e30f316f63c' # v0.16.1 # --- Gerrit-aware checkout (empty unless dispatched via Gerrit) --- gerrit_refspec: @@ -474,6 +474,7 @@ jobs: uses: lfreleng-actions/harden-runner-block-action@805eedb0508c07714b61887a2b87a5c4bbeff22a # v0.12.1 with: config: ${{ inputs.harden_runner_allowlist }} + allow_list_summary: 'false' - name: 'Harden runner' # yamllint disable-line rule:line-length uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0 @@ -562,6 +563,7 @@ jobs: uses: lfreleng-actions/harden-runner-block-action@805eedb0508c07714b61887a2b87a5c4bbeff22a # v0.12.1 with: config: ${{ inputs.harden_runner_allowlist }} + allow_list_summary: 'false' - name: 'Harden runner' # yamllint disable-line rule:line-length uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0 @@ -649,6 +651,7 @@ jobs: uses: lfreleng-actions/harden-runner-block-action@805eedb0508c07714b61887a2b87a5c4bbeff22a # v0.12.1 with: config: ${{ inputs.harden_runner_allowlist }} + allow_list_summary: 'false' - name: 'Harden runner' # yamllint disable-line rule:line-length uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0 @@ -748,6 +751,7 @@ jobs: uses: lfreleng-actions/harden-runner-block-action@805eedb0508c07714b61887a2b87a5c4bbeff22a # v0.12.1 with: config: ${{ inputs.harden_runner_allowlist }} + allow_list_summary: 'false' - name: 'Harden runner' # yamllint disable-line rule:line-length uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0 @@ -848,6 +852,7 @@ jobs: uses: lfreleng-actions/harden-runner-block-action@805eedb0508c07714b61887a2b87a5c4bbeff22a # v0.12.1 with: config: ${{ inputs.harden_runner_allowlist }} + allow_list_summary: 'false' - name: 'Harden runner' # yamllint disable-line rule:line-length uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0 @@ -931,6 +936,7 @@ jobs: uses: lfreleng-actions/harden-runner-block-action@805eedb0508c07714b61887a2b87a5c4bbeff22a # v0.12.1 with: config: ${{ inputs.harden_runner_allowlist }} + allow_list_summary: 'false' - name: 'Harden runner' # yamllint disable-line rule:line-length uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0 @@ -1043,6 +1049,7 @@ jobs: uses: lfreleng-actions/harden-runner-block-action@805eedb0508c07714b61887a2b87a5c4bbeff22a # v0.12.1 with: config: ${{ inputs.harden_runner_allowlist }} + allow_list_summary: 'false' - name: 'Harden runner' # yamllint disable-line rule:line-length uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0 @@ -1115,6 +1122,7 @@ jobs: uses: lfreleng-actions/harden-runner-block-action@805eedb0508c07714b61887a2b87a5c4bbeff22a # v0.12.1 with: config: ${{ inputs.harden_runner_allowlist }} + allow_list_summary: 'false' - name: 'Harden runner' # yamllint disable-line rule:line-length uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0 @@ -1178,6 +1186,7 @@ jobs: uses: lfreleng-actions/harden-runner-block-action@805eedb0508c07714b61887a2b87a5c4bbeff22a # v0.12.1 with: config: ${{ inputs.harden_runner_allowlist }} + allow_list_summary: 'false' - name: 'Harden runner' # yamllint disable-line rule:line-length uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0 diff --git a/.github/workflows/build-test-release.yaml b/.github/workflows/build-test-release.yaml index ae83657..5fefa57 100644 --- a/.github/workflows/build-test-release.yaml +++ b/.github/workflows/build-test-release.yaml @@ -192,7 +192,7 @@ on: required: false type: string # yamllint disable-line rule:line-length - default: 'lfreleng-actions//.github/harden-runner/lfreleng-actions/allow_list.txt@f0f76ac22f342c9a788ebcabe584e68a79cc2e83' # v0.16.0 + default: 'lfreleng-actions//.github/harden-runner/lfreleng-actions/allow_list.txt@ec0736244fc776e326283c6af6840e30f316f63c' # v0.16.1 # --- Gerrit-aware checkout (empty unless dispatched via Gerrit) --- gerrit_refspec: @@ -416,6 +416,7 @@ jobs: uses: lfreleng-actions/harden-runner-block-action@805eedb0508c07714b61887a2b87a5c4bbeff22a # v0.12.1 with: config: ${{ inputs.harden_runner_allowlist }} + allow_list_summary: 'false' - name: 'Harden runner' # yamllint disable-line rule:line-length uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0 @@ -519,6 +520,7 @@ jobs: uses: lfreleng-actions/harden-runner-block-action@805eedb0508c07714b61887a2b87a5c4bbeff22a # v0.12.1 with: config: ${{ inputs.harden_runner_allowlist }} + allow_list_summary: 'false' - name: 'Harden runner' # yamllint disable-line rule:line-length uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0 @@ -587,6 +589,7 @@ jobs: uses: lfreleng-actions/harden-runner-block-action@805eedb0508c07714b61887a2b87a5c4bbeff22a # v0.12.1 with: config: ${{ inputs.harden_runner_allowlist }} + allow_list_summary: 'false' - name: 'Harden runner' # yamllint disable-line rule:line-length uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0 @@ -658,6 +661,7 @@ jobs: uses: lfreleng-actions/harden-runner-block-action@805eedb0508c07714b61887a2b87a5c4bbeff22a # v0.12.1 with: config: ${{ inputs.harden_runner_allowlist }} + allow_list_summary: 'false' - name: 'Harden runner' # yamllint disable-line rule:line-length uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0 @@ -714,6 +718,7 @@ jobs: uses: lfreleng-actions/harden-runner-block-action@805eedb0508c07714b61887a2b87a5c4bbeff22a # v0.12.1 with: config: ${{ inputs.harden_runner_allowlist }} + allow_list_summary: 'false' - name: 'Harden runner' # yamllint disable-line rule:line-length uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0 @@ -796,6 +801,7 @@ jobs: uses: lfreleng-actions/harden-runner-block-action@805eedb0508c07714b61887a2b87a5c4bbeff22a # v0.12.1 with: config: ${{ inputs.harden_runner_allowlist }} + allow_list_summary: 'false' - name: 'Harden runner' # yamllint disable-line rule:line-length uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0 @@ -862,6 +868,7 @@ jobs: uses: lfreleng-actions/harden-runner-block-action@805eedb0508c07714b61887a2b87a5c4bbeff22a # v0.12.1 with: config: ${{ inputs.harden_runner_allowlist }} + allow_list_summary: 'false' - name: 'Harden runner' # yamllint disable-line rule:line-length uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0 @@ -924,6 +931,7 @@ jobs: uses: lfreleng-actions/harden-runner-block-action@805eedb0508c07714b61887a2b87a5c4bbeff22a # v0.12.1 with: config: ${{ inputs.harden_runner_allowlist }} + allow_list_summary: 'false' - name: 'Harden runner' # yamllint disable-line rule:line-length uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0 diff --git a/.github/workflows/build-test.yaml b/.github/workflows/build-test.yaml index c6048d5..e87ad4e 100644 --- a/.github/workflows/build-test.yaml +++ b/.github/workflows/build-test.yaml @@ -189,7 +189,7 @@ on: required: false type: string # yamllint disable-line rule:line-length - default: 'lfreleng-actions//.github/harden-runner/lfreleng-actions/allow_list.txt@f0f76ac22f342c9a788ebcabe584e68a79cc2e83' # v0.16.0 + default: 'lfreleng-actions//.github/harden-runner/lfreleng-actions/allow_list.txt@ec0736244fc776e326283c6af6840e30f316f63c' # v0.16.1 # --- Gerrit-aware checkout (empty unless dispatched via Gerrit) --- gerrit_refspec: @@ -409,6 +409,7 @@ jobs: uses: lfreleng-actions/harden-runner-block-action@805eedb0508c07714b61887a2b87a5c4bbeff22a # v0.12.1 with: config: ${{ inputs.harden_runner_allowlist }} + allow_list_summary: 'false' - name: 'Harden runner' # yamllint disable-line rule:line-length uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0 @@ -466,6 +467,7 @@ jobs: uses: lfreleng-actions/harden-runner-block-action@805eedb0508c07714b61887a2b87a5c4bbeff22a # v0.12.1 with: config: ${{ inputs.harden_runner_allowlist }} + allow_list_summary: 'false' - name: 'Harden runner' # yamllint disable-line rule:line-length uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0 @@ -537,6 +539,7 @@ jobs: uses: lfreleng-actions/harden-runner-block-action@805eedb0508c07714b61887a2b87a5c4bbeff22a # v0.12.1 with: config: ${{ inputs.harden_runner_allowlist }} + allow_list_summary: 'false' - name: 'Harden runner' # yamllint disable-line rule:line-length uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0 @@ -593,6 +596,7 @@ jobs: uses: lfreleng-actions/harden-runner-block-action@805eedb0508c07714b61887a2b87a5c4bbeff22a # v0.12.1 with: config: ${{ inputs.harden_runner_allowlist }} + allow_list_summary: 'false' - name: 'Harden runner' # yamllint disable-line rule:line-length uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0 @@ -675,6 +679,7 @@ jobs: uses: lfreleng-actions/harden-runner-block-action@805eedb0508c07714b61887a2b87a5c4bbeff22a # v0.12.1 with: config: ${{ inputs.harden_runner_allowlist }} + allow_list_summary: 'false' - name: 'Harden runner' # yamllint disable-line rule:line-length uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0 diff --git a/.github/workflows/release-drafter.yaml b/.github/workflows/release-drafter.yaml index d53f89b..7f31605 100644 --- a/.github/workflows/release-drafter.yaml +++ b/.github/workflows/release-drafter.yaml @@ -30,7 +30,7 @@ jobs: # yamllint disable-line rule:line-length - uses: lfreleng-actions/harden-runner-block-action@805eedb0508c07714b61887a2b87a5c4bbeff22a # v0.12.1 with: - config: '@f0f76ac22f342c9a788ebcabe584e68a79cc2e83' # v0.16.0 + config: '@ec0736244fc776e326283c6af6840e30f316f63c' # v0.16.1 # Harden the runner with the just-loaded allow-list. - name: 'Harden runner (block)' diff --git a/examples/build-test-release-multiarch/gerrit.yaml b/examples/build-test-release-multiarch/gerrit.yaml index 6112e7b..707ed60 100644 --- a/examples/build-test-release-multiarch/gerrit.yaml +++ b/examples/build-test-release-multiarch/gerrit.yaml @@ -47,7 +47,7 @@ env: # Harden-runner egress allow-list shared by the publish jobs. Matches the # default used inside the reusable workflow; override for your project. # yamllint disable-line rule:line-length - HARDEN_RUNNER_ALLOWLIST: 'lfreleng-actions//.github/harden-runner/lfreleng-actions/allow_list.txt@f0f76ac22f342c9a788ebcabe584e68a79cc2e83' # v0.16.0 + HARDEN_RUNNER_ALLOWLIST: 'lfreleng-actions//.github/harden-runner/lfreleng-actions/allow_list.txt@ec0736244fc776e326283c6af6840e30f316f63c' # v0.16.1 jobs: release: @@ -127,6 +127,7 @@ jobs: uses: lfreleng-actions/harden-runner-block-action@42663a22f7abe31521cbc6120901353a4b2849bc # v0.2.0 with: config: ${{ env.HARDEN_RUNNER_ALLOWLIST }} + allow_list_summary: 'false' - name: 'Harden runner (block)' # yamllint disable-line rule:line-length uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4 diff --git a/examples/build-test-release-multiarch/github.yaml b/examples/build-test-release-multiarch/github.yaml index ae473ee..0302eec 100644 --- a/examples/build-test-release-multiarch/github.yaml +++ b/examples/build-test-release-multiarch/github.yaml @@ -44,7 +44,7 @@ env: # Harden-runner egress allow-list shared by the publish jobs. Matches the # default used inside the reusable workflow; override for your project. # yamllint disable-line rule:line-length - HARDEN_RUNNER_ALLOWLIST: 'lfreleng-actions//.github/harden-runner/lfreleng-actions/allow_list.txt@f0f76ac22f342c9a788ebcabe584e68a79cc2e83' # v0.16.0 + HARDEN_RUNNER_ALLOWLIST: 'lfreleng-actions//.github/harden-runner/lfreleng-actions/allow_list.txt@ec0736244fc776e326283c6af6840e30f316f63c' # v0.16.1 jobs: release: @@ -132,6 +132,7 @@ jobs: uses: lfreleng-actions/harden-runner-block-action@42663a22f7abe31521cbc6120901353a4b2849bc # v0.2.0 with: config: ${{ env.HARDEN_RUNNER_ALLOWLIST }} + allow_list_summary: 'false' - name: 'Harden runner (block)' # yamllint disable-line rule:line-length uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4 diff --git a/examples/build-test-release/gerrit.yaml b/examples/build-test-release/gerrit.yaml index 7043f34..efa19a2 100644 --- a/examples/build-test-release/gerrit.yaml +++ b/examples/build-test-release/gerrit.yaml @@ -43,7 +43,7 @@ env: # Harden-runner egress allow-list shared by the publish jobs. Matches the # default used inside the reusable workflow; override for your project. # yamllint disable-line rule:line-length - HARDEN_RUNNER_ALLOWLIST: 'lfreleng-actions//.github/harden-runner/lfreleng-actions/allow_list.txt@f0f76ac22f342c9a788ebcabe584e68a79cc2e83' # v0.16.0 + HARDEN_RUNNER_ALLOWLIST: 'lfreleng-actions//.github/harden-runner/lfreleng-actions/allow_list.txt@ec0736244fc776e326283c6af6840e30f316f63c' # v0.16.1 jobs: release: @@ -119,6 +119,7 @@ jobs: uses: lfreleng-actions/harden-runner-block-action@42663a22f7abe31521cbc6120901353a4b2849bc # v0.2.0 with: config: ${{ env.HARDEN_RUNNER_ALLOWLIST }} + allow_list_summary: 'false' - name: 'Harden runner (block)' # yamllint disable-line rule:line-length uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4 diff --git a/examples/build-test-release/github.yaml b/examples/build-test-release/github.yaml index 1cd565e..c5442c5 100644 --- a/examples/build-test-release/github.yaml +++ b/examples/build-test-release/github.yaml @@ -39,7 +39,7 @@ env: # Harden-runner egress allow-list shared by the publish jobs. Matches the # default used inside the reusable workflow; override for your project. # yamllint disable-line rule:line-length - HARDEN_RUNNER_ALLOWLIST: 'lfreleng-actions//.github/harden-runner/lfreleng-actions/allow_list.txt@f0f76ac22f342c9a788ebcabe584e68a79cc2e83' # v0.16.0 + HARDEN_RUNNER_ALLOWLIST: 'lfreleng-actions//.github/harden-runner/lfreleng-actions/allow_list.txt@ec0736244fc776e326283c6af6840e30f316f63c' # v0.16.1 jobs: release: @@ -116,6 +116,7 @@ jobs: uses: lfreleng-actions/harden-runner-block-action@42663a22f7abe31521cbc6120901353a4b2849bc # v0.2.0 with: config: ${{ env.HARDEN_RUNNER_ALLOWLIST }} + allow_list_summary: 'false' - name: 'Harden runner (block)' # yamllint disable-line rule:line-length uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4