[renovate]

This PR contains the following updates:

Package	Type	Update	Change
step-security/harden-runner	action	patch	v2.22.3 → v2.22.4

---

Release Notes

step-security/harden-runner

v2.22.4

Compare Source

What's Changed

• Fixed a Linux agent memory leak that could cause runners to run out of memory during jobs with heavy process or network activity.
• The workaround for GitHub’s DNS resolver and outbound proxy experiment on GitHub-hosted Linux runners now defaults to enabled when feature flags can’t be fetched.
• Improved HTTP/2 TLS interception on Linux (enterprise tier).
• Added retries for failed monitoring API requests, improving reliability of monitoring initialization and raw-event uploads.

Full Changelog: step-security/harden-runner@v2.22.3...v2.22.4

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 12:00 AM and 03:59 AM (* 0-3 * * *)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[coderabbitai]

No actionable comments were generated in the recent review.

Walkthrough

The lint and scorecards workflows update their pinned step-security/harden-runner action from v2.22.3 to v2.22.4. The lint workflow keeps its egress policy set to audit.

Changes: Workflow Action Updates

Layer / File(s)	Summary
Update harden-runner pins .github/workflows/lint.yaml, .github/workflows/scorecards.yml	Both workflows update the pinned action to v2.22.4. The lint workflow retains its audit egress policy.

Estimated code review effort: 1 (Trivial) | ~3 minutes

Change: Other

Suggested reviewers: robnester-rh, acepresso, bohdanmar

Merge Risk: Minimal · up to 6c321

This is a routine patch-level update of a CI hardening action. No actionable merge-blocking risk was found.

Pre-merge checks: 4

Check name	Status	Explanation
Title check		The title states the main change: the step-security/harden-runner action is updated from v2.22.3 to v2.22.4. The raw summary confirms the same version bump in lint.yaml and scorecards.yml. The title i…
Description check		The description is a Renovate-generated update table. It names the package, the version change (v2.22.3 to v2.22.4), and includes release notes for the action. This matches the workflow changes in the…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Title check

Explanation

The title states the main change: the step-security/harden-runner action is updated from v2.22.3 to v2.22.4. The raw summary confirms the same version bump in lint.yaml and scorecards.yml. The title is specific and matches the changeset.

Full details: Description check

Explanation

The description is a Renovate-generated update table. It names the package, the version change (v2.22.3 to v2.22.4), and includes release notes for the action. This matches the workflow changes in the summary.

Recent review info

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Enterprise
• Run ID: c7c28e7c-d46d-4991-9feb-6c229b9e64f0

Commits

Reviewing files that changed from the base of the PR and between 0935d97 and 6c3213c.

Files selected for processing: 2

• .github/workflows/lint.yaml
• .github/workflows/scorecards.yml

Included review availability: This review used your included allowance. Your plan provides up to 12 included reviews per hour; 9 remain after this review.