admin/step-security-harden-runner
1
0
Fork 0
mirror of https://github.com/step-security/harden-runner synced 2026-08-09 13:11:02 +00:00
Code Issues Packages Projects Releases Wiki Activity
704 Commits 90 Branches 71 Tags
main
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Varun Sharma b09bb98e06 Merge pull request #680 from step-security/aws-code-build 
feat: AWS CodeBuild-hosted runner support, eBPF agent v1.8.14, Global Block List docs
 2026-08-04 22:48:29 -07:00
Varun Sharma 35cd77bcf6 docs: document the Global Block List in the features list 
The Global Block List shipped earlier but was never added to the README.
It applies to both the Community and Enterprise tiers, so it is listed
under Community (Free), which the Enterprise list already inherits.
 2026-08-03 19:24:47 -07:00
Varun Sharma bb6dbef4bf chore: rebuild dist with clean dependency install 
The bundle was previously built against a stale node_modules
(@actions/cache 4.0.3) instead of the lockfile version (4.1.0), so the
committed dist did not match a clean-install build and build-check
failed.
 2026-08-03 09:29:25 -07:00
Varun Sharma 98f73c5a0d chore: update eBPF agent to v1.8.14 
Bump the TLS and bravo agent downloads to agent-ebpf v1.8.14 and update
the corresponding SHA256 checksums. Non-TLS, macOS, and Windows agents
are unchanged.
 2026-08-03 09:24:47 -07:00
Varun Sharma 54193c17a4 Reapply "feat(runners): detect AWS CodeBuild-hosted runners as third-party provider" 
This reverts commit a3c333d110.
 2026-07-29 08:01:48 -07:00
Varun Sharma d22dd481ce Revert "fix(self-hosted): flush agent events at job end when deploy-on-self-hosted-vm is used" 
This reverts commit 0ff09412fb.
 2026-07-29 08:01:38 -07:00
Varun Sharma 0ff09412fb fix(self-hosted): flush agent events at job end when deploy-on-self-hosted-vm is used 
The post step exited early for all self-hosted runners, so an agent
deployed by the pre-step via deploy-on-self-hosted-vm never received the
job-end signal (post_event.json) and never flushed process and file
events. On ephemeral VMs such as AWS CodeBuild-hosted runners the VM is
destroyed right after the job, losing those events.

Record in GITHUB_STATE when the pre-step installs the agent on the VM
and run the same Linux cleanup as GitHub-hosted in that case. Persistent
self-hosted runners with a pre-installed agent keep the early exit.
 2026-07-29 01:52:01 -07:00
Varun Sharma a3c333d110 Revert "feat(runners): detect AWS CodeBuild-hosted runners as third-party provider" 
This reverts commit bf94c00d6b.
 2026-07-29 01:49:47 -07:00
Varun Sharma bf94c00d6b feat(runners): detect AWS CodeBuild-hosted runners as third-party provider 
CodeBuild-hosted runner VMs are ephemeral, so the persistent self-hosted
agent mode does not fit: its machine-scoped config carries no run_id or
one_time_key (process and file events are not attributed to the run) and
the post step exits without flushing events before the VM is destroyed.
Detect CODEBUILD_RUNNER_TYPE=GITHUB and route to the per-run bravo agent,
which reports run-scoped insights and flushes on job end.
 2026-07-29 01:39:41 -07:00
Varun Sharma 514522c5e4 fix(self-hosted): resolve runner user when USER env var is unset 
On AWS CodeBuild-hosted runners the Actions runner executes as root and
the USER environment variable is not set, so the self-hosted install
path ran 'sudo chown -R undefined /home/agent' and agent installation
failed silently. Resolve the user via os.userInfo() when USER is unset,
and skip the chown instead of failing when no user can be determined.
 2026-07-29 01:31:37 -07:00
Varun Sharma bf7454d06d Merge pull request #673 from step-security/fix/aggregate-error-startup-hang 
Release v2.20.0
 2026-07-06 23:21:11 -10:00
Varun Sharma 1188420976 Update non-TLS agent to v0.16.2 2026-07-03 05:17:38 -10:00
Varun Sharma 162cfeac17 Update non-TLS agent to v0.16.1 2026-07-02 05:18:39 -10:00
Varun Sharma eb9e1f4943 Bring macOS runner updates from PR 674 2026-07-01 07:08:34 -07:00
Varun Sharma 1a10b01783 Update Windows agent to v1.0.7 2026-07-01 06:57:34 -07:00
Varun Sharma 8b4a105ef5 Apply npm audit fixes with release-age cooldown 2026-06-29 21:28:45 -07:00
Varun Sharma 3626e03277 Default TLS status check failures to enabled 2026-06-29 21:17:58 -07:00
Varun Sharma 100e08b39c Update agent-ebpf to v1.8.12 2026-06-29 21:12:47 -07:00
Varun Sharma 774f75f2c6 Update agent to v1.8.9 2026-06-12 17:34:35 -07:00
Varun Sharma f312657a64 Extend missing-agent-dir guard to Linux and macOS cleanup paths 
handleLinuxCleanup and handleMacosCleanup also did an unconditional writeFileSync
to a path inside the agent dir, throwing ENOENT when Pre-step crashed before
installing the agent (proven by integration test on synthetic-reject branch).
Mirror the same dir-existence check that handleWindowsCleanup already has.
 2026-06-11 12:59:24 -07:00
Varun Sharma 0c7c518e1e Address PR review: skip last retry sleep, log error stacks, loosen test bound 2026-06-08 21:33:56 -07:00
Varun Sharma 49e6c282a3 Fix Pre-step hang on agent API timeout + guard against unhandled rejections 
- Replace @actions/http-client socketTimeout with fetch + AbortSignal.timeout(3s)
  on monitor, tls-inspect, policy fetch, policy-store fetch, and addSummary,
  so DNS + TCP connect + TLS are bounded (was unbounded, causing ~2-4 min hangs)
- Add unhandledRejection guard in setup.ts and cleanup.ts so Node 22+ does not
  silently kill the step on background async errors from third-party deps
- Skip Windows post-step cleanup when agent dir is missing (Pre-step crashed
  before install), instead of throwing ENOENT on post_event.json
- Bump @types/node to ^24, typescript to ^5, ts-jest to ^29.4 to match node24
  runtime and enable AbortSignal.timeout typings
 2026-06-08 21:13:29 -07:00
Varun Sharma 9af89fc715 Merge pull request #667 from step-security/update-agent-v1.8.6 
Update agent to v1.8.6
 2026-05-21 09:06:08 -07:00
Varun Sharma 485dce8cb5 Update agent to v1.8.6 2026-05-19 07:26:57 -07:00
Varun Sharma ab7a9404c0 Merge pull request #665 from step-security/fix/use-policy-store-default-audit 
Default to audit mode when api-key missing with use-policy-store
 2026-05-14 14:29:51 -07:00
Varun Sharma ec41b783c2 Default to audit mode when api-key missing with use-policy-store 2026-05-14 14:11:04 -07:00
Varun Sharma 9ca718d3bf Merge pull request #664 from step-security/update-agent-v1.8.5 
Update agent to v1.8.5
 2026-05-13 13:25:36 -07:00
Varun Sharma 1dee3df8d2 Update agent to v1.8.5 2026-05-12 10:53:30 -07:00
Varun Sharma a5ad31d6a1 Merge pull request #657 from devantler/fix/ubuntu-slim-user-env 
fix: detect ubuntu-slim runners early and bail out
 2026-05-01 23:21:23 -07:00
Varun Sharma 6e928567d7 build dist and trim ubuntu-slim message 
Drop the parenthetical detail from UBUNTU_SLIM_MESSAGE so the user-facing
log is concise, and regenerate dist/ so the action can run from this
branch without a separate build step.
 2026-05-01 22:50:08 -07:00
Varun Sharma 8d3c67de8e Release v2.19.0 (#661) 2026-04-20 00:33:22 -07:00
Varun Sharma 6c3c2f2c1c Feature/deploy on self hosted vm (#658) 2026-04-15 00:42:20 -07:00
Varun Sharma f808768d15 Feature/policy store (#656) 2026-04-08 23:47:46 -07:00
Varun Sharma fe10465874 v2.16.1 (#654) 2026-03-30 11:43:08 -07:00
Varun Sharma fa2e9d605c Release v2.16.0 (#646) 2026-03-16 00:18:40 -07:00
Varun Sharma 58077d3c7e Release v2.15.1 (#641) 2026-03-05 13:02:45 -08:00
Varun Sharma f0a59d8853 Release v2.15.0 (#639) 2026-02-24 15:14:57 -08:00
Varun Sharma 5ef0c079ce Merge pull request #635 from step-security/rc-34 
v2.14.2
 2026-02-06 17:26:07 -08:00
Varun Sharma eb43c7b3fd update agent 2026-02-06 16:51:21 -08:00
Varun Sharma e3f713f2d8 Merge pull request #631 from step-security/rc-31 
Release v2.14.1
 2026-01-25 21:01:21 -08:00
Varun Sharma 423acdda6f chore: fix npm audit vulnerabilities 2026-01-25 09:03:51 -08:00
Varun Sharma 0ddb86cf03 update agent 2026-01-23 18:38:30 -08:00
Varun Sharma 20cf305ff2 Merge pull request #622 from step-security/feature/custom-property-skip 
Feature/custom property skip
 2025-12-09 11:28:11 -08:00
Varun Sharma c51e8eeb6c feat: skip agent install and post step on subsequent runs for GitHub-hosted runners 2025-12-07 22:01:18 -08:00
Varun Sharma e152b90204 feat: skip harden-runner based on repository custom property 2025-12-07 21:54:18 -08:00
Varun Sharma ee1faec052 feat: replace skip-harden-runner with skip-on-custom-property input 2025-12-07 21:54:10 -08:00
Varun Sharma 1dc7c17646 feat: add skip-harden-runner input to conditionally skip execution 2025-12-07 21:54:01 -08:00
Varun Sharma df199fb7be Merge pull request #620 from step-security/rc-29 
Release v2.13.3
 2025-12-01 20:45:08 -08:00
Varun Sharma 03d096a772 update agent 2025-11-30 21:07:45 -08:00
Varun Sharma 40901073af fix: update agent 2025-11-30 07:46:48 -08:00
Varun Sharma 95d9a5deda Merge pull request #606 from step-security/rc-28 
Release v2.13.2
 2025-11-04 23:36:48 -08:00
Varun Sharma 87e429d3fb Update limitations.md 2025-11-04 22:15:02 -08:00
Varun Sharma ef891c3a30 feat: add support for custom vm image 2025-11-04 17:02:50 -08:00
Varun Sharma 1fa8c8a8b1 update agent 2025-11-04 16:44:00 -08:00
Varun Sharma f4a75cfd61 Merge pull request #588 from step-security/rc-26 
Release v2.13.1
 2025-09-09 10:51:44 -07:00
Varun Sharma 95503d076c ci: remove code-review workflow 2025-09-09 10:19:03 -07:00
Varun Sharma 4b250a0739 ci: add job to confirm dist is as expected 2025-09-09 10:15:51 -07:00
Varun Sharma 5b0ab6abcf update dependencies 2025-09-06 11:46:22 -07:00
Varun Sharma d11f2c1d65 fix bug where status code was not being preserved 2025-09-06 11:34:53 -07:00
Varun Sharma b3fc98e4df improve error handling for policy store sceanrio 2025-09-06 11:26:42 -07:00
Varun Sharma 92fc5d4bf7 update error message 2025-09-06 08:41:22 -07:00
Varun Sharma b61b0a4938 policy store improvements 
Only fail the job if ID token is not available
 2025-09-06 08:20:33 -07:00
Varun Sharma e3d3f2baea use GitHub release instead of packages 2025-09-06 07:54:01 -07:00
Varun Sharma 646ac01e72 update agent 2025-09-05 11:31:24 -07:00
Varun Sharma 7bc18df383 update agent 2025-09-04 18:06:48 -07:00
Varun Sharma 17d38b322b update agent 2025-08-18 21:37:25 -07:00
Varun Sharma ec9f2d5744 Merge pull request #565 from step-security/rc-24 
Release v2.13.0
 2025-07-15 12:29:13 -07:00
Varun Sharma 04bcbc31cf update agent 2025-07-15 08:37:07 -07:00
Varun Sharma 7c7a56fcaa feat: get job summary from API 2025-07-13 22:59:51 -07:00
Varun Sharma 6c439dc8bd Merge pull request #562 from step-security/rc-22 
Release v2.12.2
 2025-06-29 23:07:55 -07:00
Varun Sharma bf5688696d update agent 2025-06-27 09:10:55 -07:00
Varun Sharma 5436dac7b5 update agent 2025-06-26 00:54:04 -07:00
Varun Sharma 88d305a353 update agent 2025-06-19 23:18:49 -07:00
Varun Sharma b976878278 update agent 2025-06-18 00:47:43 -07:00
Varun Sharma 875cc92db2 Update agent 2025-06-13 10:57:36 -07:00
Varun Sharma 002fdce3c6 Merge pull request #544 from step-security/rc-21 
Release v2.12.1
 2025-06-11 07:18:17 -07:00
Varun Sharma 2489e3fcb3 Merge branch 'main' into rc-21 2025-06-10 23:12:51 -07:00
Varun Sharma 75dd441a81 Merge pull request #555 from step-security/dependabot/github_actions/step-security/publish-unit-test-result-action-2.20.0 
Bump step-security/publish-unit-test-result-action from 2.19.0 to 2.20.0
 2025-06-10 22:00:25 -07:00
Varun Sharma a9da90b635 Merge pull request #553 from h0x0er/feat/container-workflows 
self-hosted: refactored block-policy apply logic
 2025-06-05 00:17:06 -07:00
Varun Sharma fa70c45ca9 update agent 2025-06-04 23:09:21 -07:00
Varun Sharma 1705d777e5 Merge pull request #550 from step-security/dependabot/github_actions/step-security/publish-unit-test-result-action-2.19.0 
Bump step-security/publish-unit-test-result-action from 2.18.0 to 2.19.0
 2025-05-30 21:31:42 -07:00
Varun Sharma 42a3378d67 update agent version 2025-05-28 18:06:34 -07:00
Varun Sharma f0cb479b0f fix download path 2025-05-14 00:05:34 -07:00
Varun Sharma 9abfa72990 update agent 2025-05-14 00:00:00 -07:00
Varun Sharma 4379a81ea6 update agent to v1.6.5 2025-05-10 17:53:37 -07:00
Varun Sharma 5a5cdce402 update agent 2025-05-05 01:03:16 -07:00
Varun Sharma 1106c3d7dd Update agent 2025-05-02 00:08:57 -07:00
Varun Sharma 0634a2670c Merge pull request #541 from step-security/rc-20 
Release v2.12.0
 2025-04-21 12:01:51 -07:00
Varun Sharma 2e3c511341 Update action.yml 2025-04-20 21:24:43 -07:00
Varun Sharma 40873e6a41 Update README.md 2025-04-20 21:20:58 -07:00
Varun Sharma 484c2799ec Update README.md 2025-04-17 14:32:50 -07:00
Varun Sharma 4c8582f455 Update agent versions 2025-04-13 23:07:55 -07:00
Varun Sharma e8d595cd66 fix disable_sudo_and_containers bug 2025-04-13 18:03:05 -07:00
Varun Sharma 5d277fc873 fix journalctl related bug 2025-04-13 10:09:49 -07:00
Varun Sharma ff2ab228bd Merge pull request #536 from rohan-stepsecurity/feat/flag/disable-sudo-and-containers 
fix: run sudo command only when both disable-sudo and disable-sudo-an…
 2025-04-13 10:08:45 -07:00
Varun Sharma 769df4ef5d Update agent 2025-04-13 08:30:14 -07:00
Varun Sharma a7a8a29fbc Update dist 2025-04-13 08:25:25 -07:00
Varun Sharma 75fd6ee0fe Merge pull request #535 from rohan-stepsecurity/feat/flag/disable-sudo-and-containers 
feat: add new flag disable-sudo-and-containers
 2025-04-13 08:22:02 -07:00
Varun Sharma 230ee49196 Update agent 2025-04-12 07:40:55 -07:00
Varun Sharma 617de1d11d Merge pull request #533 from oskogstad/patch-1 
Update version in Getting Started example
 2025-04-03 16:28:31 -07:00