Merge branch 'main' into docupdates

Author: gkaria

.github/workflows/automated-release.yml

@@ -379,7 +379,7 @@ jobs:
       contains(github.event.pull_request.labels.*.name, 'automated-release')
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2
+        uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2
         with:
           egress-policy: audit
 

.github/workflows/docker-publish-calm-hub.yml

@@ -57,7 +57,7 @@ jobs:
             # Step 7: Extract metadata for Docker
             - name: Extract Docker metadata
               id: meta
-              uses: docker/metadata-action@c1e51972afc2121e065aed6d45c65596fe445f3f # v5
+              uses: docker/metadata-action@318604b99e75e41977312d83839a89be02ca4893 # v5
               with:
                   images: ${{ secrets.DOCKER_USERNAME }}/calm-hub
                   tags: |

.github/workflows/semgrep-ci.yml

@@ -21,7 +21,7 @@ jobs:
         env:
             SEMGREP_APP_TOKEN: ${{ secrets.SEMGREP_APP_TOKEN }}
         container:
-            image: semgrep/semgrep@sha256:e2a7ca874b5ef7dd47b3f613a429bc75050e6a1abfb2b42496d7ce2414d286cb
+            image: semgrep/semgrep@sha256:142b5fbdd9427ebdda0fe796168f83ae85679a5f9a5683e70bd7ddfd88533600
         if: (github.actor != 'dependabot[bot]')
         steps:
             - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5