ci(deps): bump the github-actions group with 2 updates

[dependabot]

Bumps the github-actions group with 2 updates: step-security/harden-runner and actions/dependency-review-action.

Updates step-security/harden-runner from 2.13.1 to 2.13.2

Release notes

Sourced from step-security/harden-runner's releases.

v2.13.2

What's Changed

• Fixed an issue where there was a limit of 512 allowed endpoints when using block egress policy. This restriction has been removed, allowing for an unlimited number of endpoints to be configured.
• Harden Runner now automatically detects if the agent is already pre-installed on a custom VM image used by a GitHub-hosted runner. When detected, the action will skip reinstallation and use the existing agent.

Full Changelog: step-security/harden-runner@v2.13.1...v2.13.2

Commits

• 95d9a5d Merge pull request #606 from step-security/rc-28
• 87e429d Update limitations.md
• ef891c3 feat: add support for custom vm image
• 1fa8c8a update agent
• 92c522a Merge pull request #593 from step-security/ak-readme-updates
• 4719ad5 README updates
• 4fde639 Merge pull request #591 from eromosele-stepsecurity/Upd
• f682f2f Update README.md
• See full diff in compare view

Updates actions/dependency-review-action from 4.8.1 to 4.8.2

Release notes

Sourced from actions/dependency-review-action's releases.

v4.8.2

Minor fixes:

• Fix PURL parsing for scoped packages (#1008 from @​danielhardej)
• Fix for large summaries (#1007 from @​gitulisca)
• README includes a working example for allow-dependencies-licenses (#1009 from @​danielhardej)

Commits

• 3c4e3dc Merge pull request #1016 from actions/dra-release
• 02930b2 Update CONTRIBUTING to reflect new guidelines
• 49ffd9f Update CONTRIBUTING to reflect the need to build
• 70cb25e 4.8.2 release
• ebabd31 Merge pull request #1008 from danielhardej/danielhardej-patch-20251023
• 19f9360 Update package-lock.json
• 5fd2f98 Bump @​types/jest to version 29.5.14
• 28647f4 Fix PURL parsing by removing encodeURI
• f620fd1 Merge pull request #1013 from actions/dangoor/token-fix
• 9b42b7e Remove bad token reference
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[github-actions]

✅MegaLinter analysis: Success

Descriptor	Linter	Files	Fixed	Errors	Warnings	Elapsed time
✅ ACTION	actionlint	20		0	0	0.5s
✅ DOCKERFILE	hadolint	2		0	0	0.77s
✅ GHERKIN	gherkin-lint	6		0	0	2.31s
✅ JSON	npm-package-json-lint	yes		no	no	0.53s
✅ JSON	prettier	19	4	0	0	0.7s
✅ JSON	v8r	19		0	0	7.67s
✅ MARKDOWN	markdownlint	11	0	0	0	0.9s
✅ MARKDOWN	markdown-table-formatter	11	0	0	0	0.22s
✅ REPOSITORY	gitleaks	yes		no	no	0.99s
✅ REPOSITORY	git_diff	yes		no	no	0.02s
✅ REPOSITORY	grype	yes		no	no	30.09s
✅ REPOSITORY	secretlint	yes		no	no	0.99s
✅ REPOSITORY	syft	yes		no	no	1.92s
✅ REPOSITORY	trivy	yes		no	no	4.91s
✅ REPOSITORY	trivy-sbom	yes		no	no	0.25s
✅ REPOSITORY	trufflehog	yes		no	no	2.79s
✅ SPELL	lychee	77		0	0	11.78s
✅ YAML	prettier	28	0	0	0	1.16s
✅ YAML	v8r	28		0	0	9.37s
✅ YAML	yamllint	28		0	0	1.16s

See detailed reports in MegaLinter artifacts

Your project could benefit from a custom flavor, which would allow you to run only the linters you need, and thus improve runtime performances. (Skip this info by defining FLAVOR_SUGGESTIONS: false)

• Documentation: Custom Flavors
• Command: npx [email protected] --custom-flavor-setup --custom-flavor-linters ACTION_ACTIONLINT,DOCKERFILE_HADOLINT,GHERKIN_GHERKIN_LINT,JSON_V8R,JSON_PRETTIER,JSON_NPM_PACKAGE_JSON_LINT,MARKDOWN_MARKDOWNLINT,MARKDOWN_MARKDOWN_TABLE_FORMATTER,REPOSITORY_GIT_DIFF,REPOSITORY_GITLEAKS,REPOSITORY_GRYPE,REPOSITORY_SECRETLINT,REPOSITORY_SYFT,REPOSITORY_TRIVY,REPOSITORY_TRIVY_SBOM,REPOSITORY_TRUFFLEHOG,SPELL_LYCHEE,YAML_PRETTIER,YAML_YAMLLINT,YAML_V8R

[github-actions]

📦 Container Size Analysis

Note

Comparing ghcr.io/philips-software/amp-devcontainer-rust:edge ➔ ghcr.io/philips-software/amp-devcontainer-rust:pr-1021

📈 Size Comparison Table

OS/Platform	Previous	Current	Change	Trend
linux/amd64	546.53 MB	546.53 MB	+1.17 kB (+0%)	🔼
linux/arm64	501.16 MB	501.16 MB	305 B (0%)	🔽

[github-actions]

📦 Container Size Analysis

Note

Comparing ghcr.io/philips-software/amp-devcontainer-cpp:edge ➔ ghcr.io/philips-software/amp-devcontainer-cpp:pr-1021

📈 Size Comparison Table

OS/Platform	Previous	Current	Change	Trend
linux/amd64	682.59 MB	682.59 MB	201 B (0%)	🔽
linux/arm64	664.94 MB	664.94 MB	643 B (0%)	🔽

[github-actions]

Test Results

 5 files  ±0   5 suites  ±0   3m 38s ⏱️ -12s
31 tests ±0  31 ✅ ±0  0 💤 ±0  0 ❌ ±0 
65 runs  ±0  65 ✅ ±0  0 💤 ±0  0 ❌ ±0 

Results for commit d3de15f. ± Comparison against base commit 4ae17ec.

[github-actions]

Pull Request Report (#1021)

Static measures

Description	Value
Number of added lines	3
Number of deleted lines	3
Number of changed files	2
Number of commits	1
Number of reviews	1
Number of comments (w/o review comments)	5
Number of reviews that contains a comment to resolve	0
Number of reviews that requested a change from the author	0
Number of reviews that approved the Pull Request	1
Get the total number of participants of a Pull Request	4

Time related measures

Description	Value
PR lead time (from creation to close of PR)	1 Hours
Time that was spend on the branch before the PR was created	1 Sec
Time that was spend on the branch before the PR was merged	1 Hours
Time to merge after last review	12.9 Min

Status check related measures

Description	Value
Total runtime for last status check run (Workflow for PR)	35.2 Min
Total time spend in last status check run on PR	14.8 Min

[github-actions]

🎉 Hooray! The changes in this pull request went live with the release of v6.6.1 🎉