chore(deps): bump step-security/harden-runner from 2.20.0 to 2.20.1

[dependabot]

Bumps step-security/harden-runner from 2.20.0 to 2.20.1.

Release notes

Sourced from step-security/harden-runner's releases.

v2.20.1

What's Changed

• AWS CodeBuild-hosted runner support
• Implicitly allow single-labeled (internal) domains in block-mode

Full Changelog: step-security/harden-runner@v2.20.0...v2.20.1

Commits

• b09bb98 Merge pull request #680 from step-security/aws-code-build
• 35cd77b docs: document the Global Block List in the features list
• bb6dbef chore: rebuild dist with clean dependency install
• 98f73c5 chore: update eBPF agent to v1.8.14
• 54193c1 Reapply "feat(runners): detect AWS CodeBuild-hosted runners as third-party pr...
• d22dd48 Revert "fix(self-hosted): flush agent events at job end when deploy-on-self-h...
• 0ff0941 fix(self-hosted): flush agent events at job end when deploy-on-self-hosted-vm...
• a3c333d Revert "feat(runners): detect AWS CodeBuild-hosted runners as third-party pro...
• bf94c00 feat(runners): detect AWS CodeBuild-hosted runners as third-party provider
• 514522c fix(self-hosted): resolve runner user when USER env var is unset
• See full diff in compare view

[opencode-agent]

Pull request overview

OpenCode could not approve from deterministic current-head evidence because GitHub Checks have failed.

Findings

1. HIGH Current-head GitHub Checks - Fix failed required checks before approval

• Problem: Failed same-head checks remain for 8a1133d406d0d15b425644e0dc3910f112ccbb36.
• Root cause: The model-unavailable evidence fallback is allowed only when peer GitHub Checks are complete and clean.
• Fix: Read and fix the failed check logs below, then rerun the current-head checks.
• Regression test: Keep the model-unavailable fallback gated on an empty failed-check rollup.

Failed checks:

• R CMD check/check: FAILURE (https://github.com/ContextualWisdomLab/aFIPC/actions/runs/31328021184/job/93287710850)
• check check run: failure (https://github.com/ContextualWisdomLab/aFIPC/actions/runs/31328021184/job/93287710850)

Changed-File Evidence Map

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Workflow (3 files)"]
  S1 --> I1["GitHub Actions review job"]
  I1 --> R1["Review risk: Workflow (3 files)"]
  R1 --> V1["actionlint plus required checks"]

Loading

[opencode-agent]

OpenCode Review Overview

• Head SHA: 8a1133d406d0d15b425644e0dc3910f112ccbb36
• Workflow run: 31700391417
• Workflow attempt: 1
• Gate result: REQUEST_CHANGES (approval step)

Pull request overview

OpenCode could not approve from deterministic current-head evidence because GitHub Checks have failed.

Findings

1. HIGH Current-head GitHub Checks - Fix failed required checks before approval

• Problem: Failed same-head checks remain for 8a1133d406d0d15b425644e0dc3910f112ccbb36.
• Root cause: The model-unavailable evidence fallback is allowed only when peer GitHub Checks are complete and clean.
• Fix: Read and fix the failed check logs below, then rerun the current-head checks.
• Regression test: Keep the model-unavailable fallback gated on an empty failed-check rollup.

Failed checks:

• R CMD check/check: FAILURE (https://github.com/ContextualWisdomLab/aFIPC/actions/runs/31328021184/job/93287710850)
• check check run: failure (https://github.com/ContextualWisdomLab/aFIPC/actions/runs/31328021184/job/93287710850)

Changed-File Evidence Map

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Workflow (3 files)"]
  S1 --> I1["GitHub Actions review job"]
  I1 --> R1["Review risk: Workflow (3 files)"]
  R1 --> V1["actionlint plus required checks"]

Loading

[seonghobae]

Reviewed the exact-head Dependabot patch. It updates step-security/harden-runner from the fully pinned v2.20.0 commit to the fully pinned v2.20.1 commit consistently across all three repository workflows, with no permission or workflow-logic expansion. The remaining R CMD check failure is the repository-wide RcppParallel/oneTBB ABI issue addressed separately in #212, not a finding in this dependency patch. Approval does not waive current-head required checks.

[opencode-agent]

Pull request overview

OpenCode cannot approve yet because required coverage evidence did not pass.

Review outcome

1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence

• Problem: The required coverage-evidence job result was abandoned, so OpenCode cannot establish approval sufficiency for this head.

• Root cause: Automated approval is only valid when the same-head coverage-evidence job proves supported repository test suites passed and configured docstring gates passed or were advisory, or reports not applicable because no supported source files or package manifests exist. Missing, failed, skipped, unavailable, or unsupported-tooling test evidence is a blocker.

• Fix: Install or configure the repository test/docstring evidence tooling when source files or package manifests exist, rerun the current-head coverage-evidence job, and approve only after it reports success with required evidence or explicit no-source not-applicable evidence.

• Regression test: Keep the approval branch checking needs.coverage-evidence.result == success before posting APPROVE, and publish REQUEST_CHANGES when coverage-evidence blocker states such as cancelled, skipped, failed, unsupported-tooling, or below-100 evidence are present.

• Result: REQUEST_CHANGES

• Reason: coverage-evidence result was abandoned, so required test/docstring evidence was not proven for current head 8757e7b022cb66f21886d4c241857a9986ef7a6c.

• Head SHA: 8757e7b022cb66f21886d4c241857a9986ef7a6c

• Workflow run: 32040429987

• Workflow attempt: 1

Coverage evidence

Coverage evidence job did not run or did not publish coverage evidence.

Changed-File Evidence Map

flowchart LR
  Evidence["OpenCode evidence"] --> Review["Current PR review path"]
  Review --> Verify["Required checks"]

Loading