chore(deps): update step-security/harden-runner action to v2.19.0

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
step-security/harden-runner	action	minor	v2.18.0 → v2.19.0

---

Release Notes

step-security/harden-runner (step-security/harden-runner)

v2.19.0

Compare Source

What's Changed

New Runner Support

Harden-Runner now supports Depot, Blacksmith, Namespace, and WarpBuild runners with the same egress monitoring, runtime monitoring, and policy enforcement available on GitHub-hosted runners.

Automated Incident Response for Supply Chain Attacks

• Global block list: Outbound connections to known malicious domains and IPs are now blocked even in audit mode.
• System-defined detection rules: Harden-Runner will trigger lockdown mode when a high risk event is detected during an active supply chain attack (for example, a process reading the memory of the runner worker process, a common technique for stealing GitHub Actions secrets).

Bug Fixes

Windows and macOS: stability and reliability fixes

Full Changelog: step-security/harden-runner@v2.18.0...v2.19.0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[claude]

Claude finished @renovate[bot]'s task in 25s —— View job

---

Code Review

• Gather context and review changed files
• Analyze the dependency update
• Post review findings

---

This is a routine dependency update by Renovate, bumping step-security/harden-runner from v2.18.0 to v2.19.0.

Changes:

• .github/actions/claude-code-review/action.yml: SHA pinned ref updated to 8d3c67de8e2fe68ef647c8db1e6a09f647780f40
• .github/workflows/claude.yml: SHA pinned ref updated to 8d3c67de8e2fe68ef647c8db1e6a09f647780f40

Assessment: Approve

The changes are correct and follow best practices:

1. SHA pinning is preserved — both files use full commit SHA pinning with a version comment (e.g., # v2.19.0), which is the recommended security practice for GitHub Actions. The SHA 8d3c67de8e2fe68ef647c8db1e6a09f647780f40 matches the new release.

2. Consistent update — both occurrences of the action are updated to the same SHA, so there's no version skew.

3. Valuable security improvements in v2.19.0:

   • Global block list: outbound connections to known malicious domains/IPs are blocked even in audit mode
   • Automated incident response: lockdown mode triggered on high-risk supply chain events
   • Expanded runner support (Depot, Blacksmith, Namespace, WarpBuild)
   • Bug fixes for Windows and macOS

No issues found. This is a straightforward, safe update that improves the supply chain security posture of the CI workflows.