Bump step-security/harden-runner from 2.11.0 to 2.12.1

[dependabot]

Bumps step-security/harden-runner from 2.11.0 to 2.12.1.

Release notes

Sourced from step-security/harden-runner's releases.

v2.12.1

What's Changed

• Detection capabilities have been upgraded to better recognize attempts at runner tampering. These improvements are informed by real-world incident learnings, including analysis of anomalous behaviors observed in the tj-actions and reviewdog supply chain attack.
• Resolved an issue where the block policy was not enforced correctly when the GitHub Actions job was running inside a container on a self-hosted VM runner.

Full Changelog: step-security/harden-runner@v2...v2.12.1

v2.12.0

What's Changed

1. A new option, disable-sudo-and-containers, is now available to replace the disable-sudo policy, addressing Docker-based privilege escalation (CVE-2025-32955). More details can be found in this blog post.

2. New detections have been added based on insights from the tj-actions and reviewdog actions incidents.

Full Changelog: step-security/harden-runner@v2...v2.12.0

v2.11.1

What's Changed

• cache: add support for GitHub Actions cache v2 by @​h0x0er in step-security/harden-runner#529

Full Changelog: step-security/harden-runner@v2...v2.11.1

Commits

• 002fdce Merge pull request #544 from step-security/rc-21
• 2489e3f Merge branch 'main' into rc-21
• 75dd441 Merge pull request #555 from step-security/dependabot/github_actions/step-sec...
• 4381ace Bump step-security/publish-unit-test-result-action from 2.19.0 to 2.20.0
• a9da90b Merge pull request #553 from h0x0er/feat/container-workflows
• a60ef21 update
• 4ad512f Merge branch 'rc-21' into feat/container-workflows
• 6b41a39 fixed test case
• fa70c45 update agent
• eb47845 self-hosted: refactored block-policy apply logic
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[hsbt]

@headius Could you look JRuby failure?

===============================================================================
Failure: test_hash_symbol_colon_key(PPTestModule::PPSingleLineTest)
/home/runner/work/pp/pp/test/test_pp.rb:234:in 'test_hash_symbol_colon_key'
     231:     quote2 = '{"@a": 1, "$a": 1, "+@": 1, "a=": 1, "[]": 1}'
     232:     quote3 = '{"a\"b": 1, "@@a": 1, "<=>": 1, "===": 1, "[]=": 1}'
     233:     assert_equal(no_quote, PP.singleline_pp(eval(no_quote), ''.dup))
  => 234:     assert_equal({ "\u3042": 1 }.inspect, PP.singleline_pp(eval(unicode_quote), ''.dup))
     235:     assert_equal(quote0, PP.singleline_pp(eval(quote0), ''.dup))
     236:     assert_equal(quote1, PP.singleline_pp(eval(quote1), ''.dup))
     237:     assert_equal(quote2, PP.singleline_pp(eval(quote2), ''.dup))
org/jruby/RubyKernel.java:1397:in 'catch'
org/jruby/RubyKernel.java:1392:in 'catch'
org/jruby/RubyArray.java:2079:in 'each'
org/jruby/RubyArray.java:2079:in 'each'
org/jruby/RubyKernel.java:1397:in 'catch'
org/jruby/RubyKernel.java:1392:in 'catch'
<"{\xE3: 1}"> expected but was
<"{あ: 1}">
E===============================================================================
Error: test_hash_symbol_colon_key(PPTestModule::PPSingleLineTest): ArgumentError: invalid byte sequence in UTF-8
org/jruby/RubyString.java:4682:in 'split'
org/jruby/RubyHash.java:1678:in 'each_value'
org/jruby/RubyHash.java:1678:in 'each_value'
org/jruby/RubyArray.java:2079:in 'each'
org/jruby/RubyKernel.java:1397:in 'catch'
org/jruby/RubyKernel.java:1392:in 'catch'
org/jruby/RubyArray.java:2079:in 'each'
org/jruby/RubyArray.java:2079:in 'each'
org/jruby/RubyKernel.java:1397:in 'catch'
org/jruby/RubyKernel.java:1392:in 'catch'
Cause0:
  Test::Unit::AssertionFailedError: <"{\xE3: 1}"> expected but was
  <"{あ: 1}">.
  
  diff:
  - {�: 1}
  ?  ^
  + {あ: 1}
  ?  ^^
/home/runner/work/pp/pp/test/test_pp.rb:234:in 'test_hash_symbol_colon_key'
     231:     quote2 = '{"@a": 1, "$a": 1, "+@": 1, "a=": 1, "[]": 1}'
     232:     quote3 = '{"a\"b": 1, "@@a": 1, "<=>": 1, "===": 1, "[]=": 1}'
     233:     assert_equal(no_quote, PP.singleline_pp(eval(no_quote), ''.dup))
  => 234:     assert_equal({ "\u3042": 1 }.inspect, PP.singleline_pp(eval(unicode_quote), ''.dup))
     235:     assert_equal(quote0, PP.singleline_pp(eval(quote0), ''.dup))
     236:     assert_equal(quote1, PP.singleline_pp(eval(quote1), ''.dup))
     237:     assert_equal(quote2, PP.singleline_pp(eval(quote2), ''.dup))
org/jruby/RubyKernel.java:1397:in 'catch'
org/jruby/RubyKernel.java:1392:in 'catch'
org/jruby/RubyArray.java:2079:in 'each'
org/jruby/RubyArray.java:2079:in 'each'
org/jruby/RubyKernel.java:1397:in 'catch'
org/jruby/RubyKernel.java:1392:in 'catch'
===============================================================================

https://github.com/ruby/pp/actions/runs/15690453507/job/44204111367?pr=44

[hsbt]

@dependabot rebase