From 4dadf8b0b80f95d8e2373db36010717a1ac06562 Mon Sep 17 00:00:00 2001 From: Quinn Blenkinsop Date: Wed, 23 Sep 2026 12:19:41 -0700 Subject: [PATCH 1/2] deps(actions): update pinned GitHub Actions Refresh checkout and Harden-Runner to same-major releases available beyond the seven-day cooldown. Keep immutable commit SHA pins. Co-authored-by: OpenAI --- .github/workflows/docker-build.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/docker-build.yml b/.github/workflows/docker-build.yml index c7fe7fde..9a510b03 100644 --- a/.github/workflows/docker-build.yml +++ b/.github/workflows/docker-build.yml @@ -44,11 +44,11 @@ jobs: - tanstack-start steps: - name: Harden Runner - uses: step-security/harden-runner@fa2e9d605c4eeb9fcad4c99c224cee0c6c7f3594 # v2.16.0 + uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0 with: egress-policy: audit - - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 - name: Build Docker image run: docker build examples/${{ matrix.example }} From a10d5b557f6f0d87733a9a8096dc660643a58366 Mon Sep 17 00:00:00 2001 From: Quinn Blenkinsop Date: Wed, 23 Sep 2026 12:19:50 -0700 Subject: [PATCH 2/2] fix(ci): stop persisting checkout credentials The Docker build job does not need authenticated Git operations. Disable checkout credential persistence to keep the token out of the local Git configuration. Co-authored-by: OpenAI --- .github/workflows/docker-build.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.github/workflows/docker-build.yml b/.github/workflows/docker-build.yml index 9a510b03..4eba7b79 100644 --- a/.github/workflows/docker-build.yml +++ b/.github/workflows/docker-build.yml @@ -49,6 +49,8 @@ jobs: egress-policy: audit - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 + with: + persist-credentials: false - name: Build Docker image run: docker build examples/${{ matrix.example }}