build(deps): bump step-security/harden-runner from 2.19.4 to 2.20.0

[dependabot]

Bumps step-security/harden-runner from 2.19.4 to 2.20.0.

Release notes

Sourced from step-security/harden-runner's releases.

v2.20.0

What's Changed

• Support for block policy for MacOS and Windows GitHub-hosted runners
• Support for Bitrise MacOS GitHub Actions runners
• HTTPS monitoring support for Bun for Linux runners (enterprise tier)

Full Changelog: step-security/harden-runner@v2.19.4...v2.20.0

Commits

• bf7454d Merge pull request #673 from step-security/fix/aggregate-error-startup-hang
• 1188420 Update non-TLS agent to v0.16.2
• 162cfea Update non-TLS agent to v0.16.1
• eb9e1f4 Bring macOS runner updates from PR 674
• 1a10b01 Update Windows agent to v1.0.7
• 8b4a105 Apply npm audit fixes with release-age cooldown
• 3626e03 Default TLS status check failures to enabled
• 100e08b Update agent-ebpf to v1.8.12
• 774f75f Update agent to v1.8.9
• f312657 Extend missing-agent-dir guard to Linux and macOS cleanup paths
• Additional commits viewable in compare view

Summary by CodeRabbit

• 보안 및 유지보수
  • CI/CD 보안 검사와 감사 워크플로우에서 실행 환경 보호 구성요소를 최신 버전으로 업데이트했습니다.
  • 기존 네트워크 감사 설정, 보안 검사, 보고 및 게이트 동작은 변경되지 않았습니다.

[opencode-agent]

Pull request overview

OpenCode cannot approve yet because required coverage evidence did not pass.

Review outcome

1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence

• Problem: The required coverage-evidence job result was failure, so OpenCode cannot establish approval sufficiency for this head.

• Root cause: Automated approval is only valid when the same-head coverage-evidence job proves supported repository test suites passed and configured docstring gates passed or were advisory, or reports not applicable because no supported source files or package manifests exist. Missing, failed, skipped, unavailable, or unsupported-tooling test evidence is a blocker.

• Fix: Install or configure the repository test/docstring evidence tooling when source files or package manifests exist, rerun the current-head coverage-evidence job, and approve only after it reports success with required evidence or explicit no-source not-applicable evidence.

• Regression test: Keep the approval branch checking needs.coverage-evidence.result == success before posting APPROVE, and publish REQUEST_CHANGES when coverage-evidence blocker states such as cancelled, skipped, failed, unsupported-tooling, or below-100 evidence are present.

• Result: REQUEST_CHANGES

• Reason: coverage-evidence result was failure, so required test/docstring evidence was not proven for current head c6c538bf1fde56c271055a0918f0aa9dfbdc3a2c.

• Head SHA: c6c538bf1fde56c271055a0918f0aa9dfbdc3a2c

• Workflow run: 30108557819

• Workflow attempt: 1

Coverage evidence

Coverage evidence job did not run or did not publish coverage evidence.

Changed-File Evidence Map

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Workflow (8 files)"]
  S1 --> I1["GitHub Actions review job"]
  I1 --> R1["Review risk: Workflow (8 files)"]
  R1 --> V1["actionlint plus required checks"]

Loading

[opencode-agent]

OpenCode Review Overview

• Head SHA: c6c538bf1fde56c271055a0918f0aa9dfbdc3a2c
• Workflow run: 30108557819
• Workflow attempt: 1
• Gate result: REQUEST_CHANGES (approval step)

Pull request overview

OpenCode cannot approve yet because required coverage evidence did not pass.

Review outcome

1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence

• Problem: The required coverage-evidence job result was failure, so OpenCode cannot establish approval sufficiency for this head.

• Root cause: Automated approval is only valid when the same-head coverage-evidence job proves supported repository test suites passed and configured docstring gates passed or were advisory, or reports not applicable because no supported source files or package manifests exist. Missing, failed, skipped, unavailable, or unsupported-tooling test evidence is a blocker.

• Fix: Install or configure the repository test/docstring evidence tooling when source files or package manifests exist, rerun the current-head coverage-evidence job, and approve only after it reports success with required evidence or explicit no-source not-applicable evidence.

• Regression test: Keep the approval branch checking needs.coverage-evidence.result == success before posting APPROVE, and publish REQUEST_CHANGES when coverage-evidence blocker states such as cancelled, skipped, failed, unsupported-tooling, or below-100 evidence are present.

• Result: REQUEST_CHANGES

• Reason: coverage-evidence result was failure, so required test/docstring evidence was not proven for current head c6c538bf1fde56c271055a0918f0aa9dfbdc3a2c.

• Head SHA: c6c538bf1fde56c271055a0918f0aa9dfbdc3a2c

• Workflow run: 30108557819

• Workflow attempt: 1

Coverage evidence

Coverage evidence job did not run or did not publish coverage evidence.

Changed-File Evidence Map

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Workflow (8 files)"]
  S1 --> I1["GitHub Actions review job"]
  I1 --> R1["Review risk: Workflow (8 files)"]
  R1 --> V1["actionlint plus required checks"]

Loading

[coderabbitai]

Warning

Review limit reached

@opencode-agent[bot], you've reached your PR review limit, so we couldn't start this review.

Next review available in: 44 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 48222c1b-2d78-446d-88bb-ab8e7b2fb999

📥 Commits

Reviewing files that changed from the base of the PR and between e12285f and 27533ce.

📒 Files selected for processing (2)

• .github/workflows/python-security.yml
• .github/workflows/strix.yml

📝 Walkthrough

Walkthrough

여러 보안 워크플로우에서 step-security/harden-runner 액션의 고정 버전을 v2.19.4에서 v2.20.0으로 업데이트했습니다. 기존 egress 정책과 워크플로우 실행 로직은 유지됩니다.

Changes

러너 하드닝 업데이트

Layer / File(s)	Summary
하드닝 액션 커밋 핀 갱신 .github/workflows/*.yml	보안 및 분석 작업에서 step-security/harden-runner 참조를 v2.20.0 커밋으로 변경하고 기존 설정과 실행 흐름을 유지했습니다.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Suggested reviewers: seonghobae

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	제목은 모든 변경 파일의 주요 변경 사항인 step-security/harden-runner 버전 업데이트를 정확하고 간결하게 설명합니다.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch dependabot/github_actions/main/step-security/harden-runner-2.20.0

---

_{Comment @coderabbitai help to get the list of available commands.}

Superseded by current head f8c77ae. The requested-changes review was bound to c6c538b; all current-head security workflows pass and no unresolved review threads remain.

[seonghobae]

@dependabot rebase

[dependabot]

Looks like this PR has been edited by someone other than Dependabot. That means Dependabot can't rebase it - sorry!

If you're happy for Dependabot to recreate it from scratch, overwriting any edits, you can request @dependabot recreate.

[seonghobae]

All changes consistently replace the pinned harden-runner SHA and version annotation only; permissions, egress policy, and workflow behavior remain unchanged.

[seonghobae]

@dependabot rebase

[dependabot]

Looks like this PR has been edited by someone other than Dependabot. That means Dependabot can't rebase it - sorry!

If you're happy for Dependabot to recreate it from scratch, overwriting any edits, you can request @dependabot recreate.

[seonghobae]

@dependabot rebase

[dependabot]

Looks like this PR has been edited by someone other than Dependabot. That means Dependabot can't rebase it - sorry!

If you're happy for Dependabot to recreate it from scratch, overwriting any edits, you can request @dependabot recreate.

[seonghobae]

@dependabot rebase

[dependabot]

Looks like this PR has been edited by someone other than Dependabot. That means Dependabot can't rebase it - sorry!

If you're happy for Dependabot to recreate it from scratch, overwriting any edits, you can request @dependabot recreate.

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.