Bump step-security/harden-runner from 2.21.1 to 2.22.1

Bumps [step-security/harden-runner](https://github.com/step-security/harden-runner) from 2.21.1 to 2.22.1.
- [Release notes](https://github.com/step-security/harden-runner/releases)
- [Commits](https://github.com/step-security/harden-runner/compare/v2.21.1...ccd8616d44fd3846e67624a50d5aad6d37bf2d25)

---
updated-dependencies:
- dependency-name: step-security/harden-runner
  dependency-version: 2.22.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

.github/workflows/comment_check_amalgamation.yml

@@ -37,6 +37,14 @@ jobs:
             var matchArtifact = artifacts.data.artifacts.filter((artifact) => {
               return artifact.name == "pr"
             })[0];
+            // a run that failed before its jobs started (e.g. a stale queued
+            // run cancelled long after its push) has no artifact to report on
+            if (!matchArtifact) {
+              core.notice('Run ${{ github.event.workflow_run.id }} has no "pr" artifact; nothing to comment on.');
+              core.setOutput('found', 'false');
+              return;
+            }
+            core.setOutput('found', 'true');
             var download = await github.rest.actions.downloadArtifact({
                owner: context.repo.owner,
                repo: context.repo.repo,
@@ -51,9 +59,11 @@ jobs:
       # Extract the untrusted PR artifact into a dedicated empty directory and
       # read only the two expected files by fixed path afterwards. This avoids a
       # malicious archive overwriting workspace files or escaping via ../ paths.
-      - run: unzip -o pr.zip -d ./pr_artifact
+      - if: steps.download.outputs.found == 'true'
+        run: unzip -o pr.zip -d ./pr_artifact
 
       - name: 'Comment on PR'
+        if: steps.download.outputs.found == 'true'
         uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/json_view_benchmarks.yml

@@ -54,7 +54,7 @@ jobs:
     timeout-minutes: 60
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
+        uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25 # v2.22.1
         with:
           egress-policy: audit
 

tests/src/unit-stl_helpers.cpp

@@ -78,7 +78,8 @@ TEST_CASE("detail::bit_cast")
 
     // to and from byte arrays
     const auto bytes = bit_cast<std::array<std::uint8_t, 4>>(std::uint32_t{0x01020304u});
-    CHECK(bit_cast<std::uint32_t>(bytes) == 0x01020304u);
+    // qualified: with a std::array argument, ADL would also find std::bit_cast in C++20
+    CHECK(nlohmann::detail::bit_cast<std::uint32_t>(bytes) == 0x01020304u);
 
     static_assert(noexcept(bit_cast<std::uint64_t>(1.0)), "bit_cast must be noexcept");
 }