build(deps): bump step-security/harden-runner from 2.19.4 to 2.20.0

.github/workflows/build.yml

@@ -25,7 +25,7 @@ jobs:
 
     steps:
       - name: "Harden the runner (Block egress traffic: Only allow calls to allowed endpoints)"
-        uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
         with:
           egress-policy: block
           allowed-endpoints: >+
@@ -335,7 +335,7 @@ jobs:
 
     steps:
     - name: "Harden the runner (Block egress traffic: Only allow calls to allowed endpoints)"
-      uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
+      uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
       with:
         egress-policy: block
         allowed-endpoints: >+

.github/workflows/codeql-analysis.yml

@@ -35,7 +35,7 @@ jobs:
 
     steps:
     - name: "Harden the runner (Block egress traffic: Only allow calls to allowed endpoints)"
-      uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
+      uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
       with:
         egress-policy: block
         allowed-endpoints: >+

.github/workflows/dependency-review.yml

@@ -17,7 +17,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: "Harden the runner (Block egress traffic: Only allow calls to allowed endpoints)"
-        uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
         with:
           egress-policy: block
           allowed-endpoints: >+

.github/workflows/devcontainer.yml

@@ -16,7 +16,7 @@ jobs:
 
     steps:
       - name: "Harden the runner (Block egress traffic: Only allow calls to allowed endpoints)"
-        uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
         with:
           egress-policy: block
           allowed-endpoints: >+

.github/workflows/docs.yml

@@ -20,7 +20,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: "Harden the runner (Block egress traffic: Only allow calls to allowed endpoints)"
-      uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
+      uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
       with:
         egress-policy: block
         allowed-endpoints: >+
@@ -53,7 +53,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: "Harden the runner (Block egress traffic: Only allow calls to allowed endpoints)"
-        uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
         with:
           egress-policy: block
           allowed-endpoints: >+
@@ -97,7 +97,7 @@ jobs:
       contents: write
     steps:
       - name: "Harden the runner (Block egress traffic: Only allow calls to allowed endpoints)"
-        uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
         with:
           egress-policy: block
           allowed-endpoints: >+

.github/workflows/python-publish.yml

@@ -25,7 +25,7 @@ jobs:
 
     steps:
     - name: "Harden the runner (Block egress traffic: Only allow calls to allowed endpoints)"
-      uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
+      uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
       with:
         egress-policy: block
         allowed-endpoints: >+

.github/workflows/release.yml

@@ -21,7 +21,7 @@ jobs:
       release_id: ${{ steps.release_info.outputs.tag }}
 
     steps:
-      - uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
+      - uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
         with:
           egress-policy: block
           allowed-endpoints: >+

.github/workflows/run.yml

@@ -16,7 +16,7 @@ jobs:
 
     steps:
       - name: "Harden the runner (Block egress traffic: Only allow calls to allowed endpoints)"
-        uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
         with:
           egress-policy: block
           allowed-endpoints: >+
@@ -28,6 +28,16 @@ jobs:
             community.chocolatey.org:443
             community.chocolatey.org:80
             packages.chocolatey.org:443
+            cygwin.com:443
+            mirrors.kernel.org:443
+            *.c.lencr.org:443
+            *.c.lencr.org:80
+            *.dl.sourceforge.net:443
+            downloads.sourceforge.net:443
+            sourceforge.net:443
+            svn.code.sf.net:443
+            svn.code.sf.net:3690
+            ziglang.org:443
 
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
@@ -130,9 +140,11 @@ jobs:
             allowed-endpoints: >+
               _https._tcp.packages.microsoft.com:443
               api.github.com:443
+              *.dl.sourceforge.net:443
               community.chocolatey.org:443
               community.chocolatey.org:80
               dc.services.visualstudio.com:443
+              downloads.sourceforge.net:443
               fe2cr.update.microsoft.com:443
               files.pythonhosted.org:443
               github.com:443
@@ -141,6 +153,7 @@ jobs:
               packages.microsoft.com:443
               pypi.org:443
               release-assets.githubusercontent.com:443
+              sourceforge.net:443
               ziglang.org:443
     runs-on: ${{ matrix.platform }}
     permissions:
@@ -149,7 +162,7 @@ jobs:
 
     steps:
       - name: "Harden the runner (Block egress traffic: Only allow calls to allowed endpoints)"
-        uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
         with:
           egress-policy: block
           allowed-endpoints: ${{ matrix.allowed-endpoints }}

.github/workflows/scorecard.yml

@@ -27,7 +27,7 @@ jobs:
 
     steps:
       - name: "Harden the runner (Block egress traffic: Only allow calls to allowed endpoints)"
-        uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
         with:
           egress-policy: block
           allowed-endpoints: >+

.github/workflows/source-provenance.yml

@@ -21,7 +21,7 @@ jobs:
 
     steps:
       - name: "Harden the runner (Block egress traffic: Only allow calls to allowed endpoints)"
-        uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
         with:
           egress-policy: block
           allowed-endpoints: >+
@@ -55,7 +55,7 @@ jobs:
 
     steps:
       - name: "Harden the runner (Block egress traffic: Only allow calls to allowed endpoints)"
-        uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
         with:
           egress-policy: block
           allowed-endpoints: >+

.github/workflows/test.yml

@@ -18,7 +18,7 @@ jobs:
       id-token: write
     steps:
       - name: "Harden the runner (Block egress traffic: Only allow calls to allowed endpoints)"
-        uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
         with:
           egress-policy: block
           # dfetch.invalid and giiiiiidhub.com are intentionally invalid test

.github/workflows/winget-publish.yml

@@ -32,7 +32,7 @@ jobs:
 
     steps:
       - name: "Harden the runner (Block egress traffic: Only allow calls to allowed endpoints)"
-        uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
         with:
           egress-policy: block
           allowed-endpoints: >+