Merge 3d40ae961a into 9df4ea095f

Bumps [step-security/harden-runner](https://github.com/step-security/harden-runner) from 2.14.0 to 2.14.1.
- [Release notes](https://github.com/step-security/harden-runner/releases)
- [Commits](20cf305ff2...e3f713f2d8)

---
updated-dependencies:
- dependency-name: step-security/harden-runner
  dependency-version: 2.14.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

.github/workflows/dependencies.yml

@@ -13,7 +13,7 @@ jobs:
       contents: write # this is needed to push commits and branches
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
+        uses: step-security/harden-runner@e3f713f2d8f53843e71c69a996d56f51aa9adfb9 # v2.14.1
         with:
           egress-policy: audit
 

.github/workflows/installer.yml

@@ -26,7 +26,7 @@ jobs:
           - macos-latest
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
+        uses: step-security/harden-runner@e3f713f2d8f53843e71c69a996d56f51aa9adfb9 # v2.14.1
         with:
           egress-policy: audit
 
@@ -47,7 +47,7 @@ jobs:
       - test
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
+        uses: step-security/harden-runner@e3f713f2d8f53843e71c69a996d56f51aa9adfb9 # v2.14.1
         with:
           egress-policy: audit
 

.github/workflows/main.yml

@@ -24,7 +24,7 @@ jobs:
     if: github.repository == 'ohmyzsh/ohmyzsh'
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
+        uses: step-security/harden-runner@e3f713f2d8f53843e71c69a996d56f51aa9adfb9 # v2.14.1
         with:
           egress-policy: audit
 

.github/workflows/project.yml

@@ -17,7 +17,7 @@ jobs:
     if: github.repository == 'ohmyzsh/ohmyzsh'
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
+        uses: step-security/harden-runner@e3f713f2d8f53843e71c69a996d56f51aa9adfb9 # v2.14.1
         with:
           egress-policy: audit
       - name: Authenticate as @ohmyzsh

.github/workflows/scorecard.yml

@@ -36,7 +36,7 @@ jobs:
 
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
+        uses: step-security/harden-runner@e3f713f2d8f53843e71c69a996d56f51aa9adfb9 # v2.14.1
         with:
           egress-policy: audit
 
@@ -60,6 +60,6 @@ jobs:
           retention-days: 5
 
       - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@19b2f06db2b6f5108140aeb04014ef02b648f789 # v4.31.11
+        uses: github/codeql-action/upload-sarif@b20883b0cd1f46c72ae0ba6d1090936928f9fa30 # v4.32.0
         with:
           sarif_file: results.sarif

plugins/docker/README.md

@@ -84,3 +84,9 @@ If you use Podman's Docker wrapper, you need to enable legacy completion. See ab
 | dvprune | `docker volume prune`         | Cleanup dangling volumes                                                                 |
 | dxc     | `docker container exec`       | Run a new command in a running container                                                 |
 | dxcit   | `docker container exec -it`   | Run a new command in a running container in an interactive shell                         |
+
+## Functions
+
+| Command                     | Description                                                                                           |
+| :-------------------------- | :---------------------------------------------------------------------------------------------------- |
+| `dxgcit <pattern> <cmd...>` | Run a new command in a running container selected via pattern matching on the image or container name |

plugins/docker/docker.plugin.zsh

@@ -36,6 +36,40 @@ alias dvprune='docker volume prune'
 alias dxc='docker container exec'
 alias dxcit='docker container exec -it'
 
+function _dxgcit() {
+  if [ $# -lt 2 ]; then
+    echo "Usage: $0 <grep-pattern> <command...>" >&2
+    return 1
+  fi
+
+  local pattern=$1
+  shift 1
+
+  local -a candidates
+  candidates=(
+    ${(f)"$(docker ps --format "{{.ID}}:{{.Names}}:{{.Image}}" | grep -- "$pattern")"}
+  )
+  if [ ${#candidates[@]} -eq 0 ]; then
+    printf "No container/image matches name pattern: '%s'!\n" "$pattern" >&2
+    return 1
+  fi
+  if [ ${#candidates[@]} -ne 1 ]; then
+    printf "Ambiguous container/image name pattern: '%s' results in '%d' candidates!\n" \
+      "$pattern" "${#candidates[@]}" >&2
+    for candidate in ${candidates[@]}; do
+      parts=(${(@s/:/)candidate})
+      printf "  %s (%s) (image: %s)\n" "${parts[1]}" "${parts[2]}" "${parts[3]}" >&2
+    done
+    return 1
+  fi
+
+  local -a candidate
+  candidate=(${(@s/:/)${candidates[1]}})
+  local id="${candidate[1]}"
+  docker container exec -it "$id" "$@"
+}
+alias dxgcit='_dxgcit'
+
 if (( ! $+commands[docker] )); then
   return
 fi