From 3ea84c96ef2713edcdd63be0dd3e6ae906c9d1da Mon Sep 17 00:00:00 2001
From: Raj-StepSecurity <rajkumar@stepsecurity.io>
Date: Fri, 10 Jul 2026 16:40:49 +0530
Subject: [PATCH] chore: Cherry-picked changes from upstream

---
 .github/workflows/integrity-check.yml       | 11 ++++++-----
 .github/workflows/validate-orchestrator.yml |  2 +-
 2 files changed, 7 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/integrity-check.yml b/.github/workflows/integrity-check.yml
index 6ed6185..a46de52 100644
--- a/.github/workflows/integrity-check.yml
+++ b/.github/workflows/integrity-check.yml
@@ -10,9 +10,6 @@ permissions:
   checks: write
   statuses: write
 
-env:
-  CODECOV_TOKEN: '2f2eb890-30e2-4724-83eb-7633832cf0de'
-
 concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true
@@ -22,6 +19,10 @@ jobs:
     name: Tests
     runs-on: ubuntu-latest
     steps:
+      - name: Harden the runner (Audit all outbound calls)
+        uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1
+        with:
+          egress-policy: audit
       - uses: actions/checkout@v7
       - name: Install package manager (from package.json)
         run: |
@@ -34,7 +35,7 @@ jobs:
         id: yarn-config
         run: echo "cacheFolder=$(yarn config get cacheFolder)" >> "$GITHUB_OUTPUT"
       - name: Restore yarn install cache (node_modules + cacheFolder + install-state)
-        uses: actions/cache@v4
+        uses: actions/cache@v5
         with:
           path: |
             ${{ steps.yarn-config.outputs.cacheFolder }}
@@ -49,7 +50,7 @@ jobs:
           case "$(yarn --version)" in 1.*) echo 'expected up-to-date yarn version'; exit 1 ;; esac
           yarn install --immutable
       - run: yarn lint
-      - run: yarn test:ci --coverage
+      - run: yarn test:ci
       - run: bash <(curl -s https://codecov.io/bash)
       - run: yarn build || { echo "build command should always succeed" ; exit 61; }
   #      - run: yarn build --quiet && git diff --quiet dist || { echo "dist should be auto generated" ; git diff dist ; exit 62; }
diff --git a/.github/workflows/validate-orchestrator.yml b/.github/workflows/validate-orchestrator.yml
index 86b2116..d5d2a25 100644
--- a/.github/workflows/validate-orchestrator.yml
+++ b/.github/workflows/validate-orchestrator.yml
@@ -86,7 +86,7 @@ jobs:
         id: yarn-config
         run: echo "cacheFolder=$(yarn config get cacheFolder)" >> "$GITHUB_OUTPUT"
       - name: Restore yarn install cache (node_modules + cacheFolder + install-state)
-        uses: actions/cache@v4
+        uses: actions/cache@v5
         with:
           path: |
             ${{ steps.yarn-config.outputs.cacheFolder }}