Update agent

Bump enterprise agent version

.github/workflows/canary.yml

@@ -22,7 +22,7 @@ jobs:
     permissions:
       contents: write
     steps:
-    - uses: step-security/harden-runner@1b05615854632b887b69ae1be8cbefe72d3ae423 # v1
+    - uses: step-security/harden-runner@5c7944e73c4c2a096b17a9cb74d65b6c2bbafbde # v1
       with:
         egress-policy: audit
         allowed-endpoints:
@@ -41,3 +41,9 @@ jobs:
       env:
         PAT: ${{ secrets.PAT }}
         canary: true
+
+    - name: Canary TLS test
+      uses: docker://ghcr.io/step-security/integration-test/int:latest
+      env:
+        PAT: ${{ secrets.PAT }}
+        canary-tls: true

.github/workflows/code-review.yml

@@ -11,7 +11,7 @@ jobs:
       pull-requests: read
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@1b05615854632b887b69ae1be8cbefe72d3ae423 # v2.6.0
+        uses: step-security/harden-runner@5c7944e73c4c2a096b17a9cb74d65b6c2bbafbde # v2.9.1
         with:
           disable-sudo: true
           egress-policy: block

.github/workflows/codeql-analysis.yml

@@ -41,7 +41,7 @@ jobs:
 
     steps:
     - name: Harden Runner
-      uses: step-security/harden-runner@1b05615854632b887b69ae1be8cbefe72d3ae423
+      uses: step-security/harden-runner@5c7944e73c4c2a096b17a9cb74d65b6c2bbafbde
       with:
         egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
 
@@ -50,7 +50,7 @@ jobs:
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@cdcdbb579706841c47f7063dda365e292e5cad7a
+      uses: github/codeql-action/init@2d790406f505036ef40ecba973cc774a50395aac
       with:
         languages: ${{ matrix.language }}
         # If you wish to specify custom queries, you can do so here or in a config file.
@@ -61,7 +61,7 @@ jobs:
     # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
     # If this step fails, then you should remove it and run the build manually (see below)
     - name: Autobuild
-      uses: github/codeql-action/autobuild@cdcdbb579706841c47f7063dda365e292e5cad7a
+      uses: github/codeql-action/autobuild@2d790406f505036ef40ecba973cc774a50395aac
 
     # ℹ️ Command-line programs to run using the OS shell.
     # 📚 https://git.io/JvXDl
@@ -75,4 +75,4 @@ jobs:
     #   make release
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@cdcdbb579706841c47f7063dda365e292e5cad7a
+      uses: github/codeql-action/analyze@2d790406f505036ef40ecba973cc774a50395aac

.github/workflows/dependency-review.yml

@@ -17,11 +17,11 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@1b05615854632b887b69ae1be8cbefe72d3ae423 # v2.6.0
+        uses: step-security/harden-runner@5c7944e73c4c2a096b17a9cb74d65b6c2bbafbde # v2.9.1
         with:
           egress-policy: audit
 
       - name: 'Checkout Repository'
         uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
       - name: 'Dependency Review'
-        uses: actions/dependency-review-action@6c5ccdad469c9f8a2996bfecaec55a631a347034 # v3.1.0
+        uses: actions/dependency-review-action@0c155c5e8556a497adf53f2c18edabf945ed8e70 # v4.3.2

.github/workflows/recurring-int-tests.yml

@@ -13,7 +13,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Harden Runner
-      uses: step-security/harden-runner@1b05615854632b887b69ae1be8cbefe72d3ae423
+      uses: step-security/harden-runner@5c7944e73c4c2a096b17a9cb74d65b6c2bbafbde
       with:
         egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
 
@@ -22,3 +22,18 @@ jobs:
       env:
         PAT: ${{ secrets.PAT }}
         canary: true
+
+  int-tls-tests:
+    name: int tls tests
+    runs-on: ubuntu-latest
+    steps:
+    - name: Harden Runner
+      uses: step-security/harden-runner@5c7944e73c4c2a096b17a9cb74d65b6c2bbafbde
+      with:
+        egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
+
+    - name: Canary test
+      uses: docker://ghcr.io/step-security/integration-test/int:latest
+      env:
+        PAT: ${{ secrets.PAT }}
+        canary-tls: true

.github/workflows/release.yml

@@ -25,7 +25,7 @@ jobs:
     permissions:
       contents: write
     steps:
-    - uses: step-security/harden-runner@1b05615854632b887b69ae1be8cbefe72d3ae423
+    - uses: step-security/harden-runner@5c7944e73c4c2a096b17a9cb74d65b6c2bbafbde
       with:
         egress-policy: audit
         allowed-endpoints:

.github/workflows/scorecards.yml

@@ -25,7 +25,7 @@ jobs:
 
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@1b05615854632b887b69ae1be8cbefe72d3ae423 # v2.6.0
+        uses: step-security/harden-runner@5c7944e73c4c2a096b17a9cb74d65b6c2bbafbde # v2.9.1
         with:
           egress-policy: audit
 
@@ -35,7 +35,7 @@ jobs:
           persist-credentials: false
 
       - name: "Run analysis"
-        uses: ossf/scorecard-action@0864cf19026789058feabb7e87baa5f140aac736 # tag=v1.1.1
+        uses: ossf/scorecard-action@dc50aa9510b46c811795eb24b2f1ba02a914e534 # tag=v1.1.1
         with:
           results_file: results.sarif
           results_format: sarif
@@ -54,7 +54,7 @@ jobs:
       # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
       # format to the repository Actions tab.
       - name: "Upload artifact"
-        uses: actions/upload-artifact@a8a3f3ad30e3422c9c7b888a15615d19a852ae32 # tag=v3.0.0
+        uses: actions/upload-artifact@0b2256b8c012f0828dc542b3febcab082c67f72b # tag=v3.0.0
         with:
           name: SARIF file
           path: results.sarif
@@ -62,6 +62,6 @@ jobs:
 
       # Upload the results to GitHub's code scanning dashboard.
       - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@cdcdbb579706841c47f7063dda365e292e5cad7a # tag=v1.0.26
+        uses: github/codeql-action/upload-sarif@2d790406f505036ef40ecba973cc774a50395aac # tag=v1.0.26
         with:
           sarif_file: results.sarif

.github/workflows/test.yml

@@ -13,10 +13,13 @@ concurrency:
   group: ${{ github.workflow }}
 jobs:
   test:
+    permissions:
+      checks: write
+      pull-requests: write
     runs-on: ubuntu-latest
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@1b05615854632b887b69ae1be8cbefe72d3ae423 # v2.6.0
+        uses: step-security/harden-runner@5c7944e73c4c2a096b17a9cb74d65b6c2bbafbde # v2.9.1
         with:
           disable-sudo: true
           egress-policy: audit
@@ -35,3 +38,9 @@ jobs:
       - name: Run coverage
         run: npm test -- --coverage
       - uses: codecov/codecov-action@eaaf4bedf32dbdc6b720b63067d99c4d77d6047d # v3.1.4
+      - name: Publish Test Results
+        uses: step-security/publish-unit-test-result-action@v2
+        if: always()
+        with:
+          files: |
+            reports/*.xml

.gitignore

@@ -20,6 +20,7 @@ lib-cov
 
 # Coverage directory used by tools like istanbul
 coverage
+reports
 *.lcov
 
 # nyc test coverage

README.md

@@ -13,55 +13,94 @@
 
 </div>
 
-## GitHub Actions Runtime Security
+## Table of Contents
 
-Harden-Runner provides runtime security for GitHub-hosted and self-hosted environments.
+- [Introduction](#introduction)
+- [3,500+ open source projects use Harden-Runner](#3500-open-source-projects-use-harden-runner)
+  - [Trusted By](#trusted-by)
+  - [Case Studies](#case-studies)
+- [Why use Harden-Runner](#why-use-harden-runner)
+- [Getting Started](#getting-started)
+  - [Hardening GitHub-Hosted Runners](#hardening-github-hosted-runners)
+    - [Hands-On Tutorials](#hands-on-tutorials)
+  - [Support for Private Repositories](#support-for-private-repositories)
+  - [Hardening Self-Hosted Runners](#hardening-self-hosted-runners)
+    - [Self-Hosted Actions Runner Controller (ARC) Runners](#self-hosted-actions-runner-controller-arc-runners)
+    - [Self-Hosted VM Runners (e.g. on EC2)](#self-hosted-vm-runners-eg-on-ec2)
+- [Features at a glance](#features-at-a-glance)
+  - [View outbound network traffic at the job level](#view-outbound-network-traffic-at-the-job-level)
+  - [View outbound network traffic at the organization level](#view-outbound-network-traffic-at-the-organization-level)
+  - [View outbound HTTPS traffic at the job level](#view-outbound-https-traffic-at-the-job-level)
+  - [Detect anomalous outbound network traffic](#detect-anomalous-outbound-network-traffic)
+  - [Filter outbound network traffic to allowed endpoints](#filter-outbound-network-traffic-to-allowed-endpoints)
+  - [Determine minimum GITHUB_TOKEN permissions using Harden-Runner](#determine-minimum-github_token-permissions-using-harden-runner)
+  - [View the name and path of every file written during the build process](#view-the-name-and-path-of-every-file-written-during-the-build-process)
+  - [View process names and arguments](#view-process-names-and-arguments)
+  - [Detect tampering of source code during build](#detect-tampering-of-source-code-during-build)
+  - [Run your job without sudo access](#run-your-job-without-sudo-access)
+  - [Get real-time security alerts](#get-real-time-security-alerts)
+- [Discussions](#discussions)
+- [How does it work?](#how-does-it-work)
+  - [GitHub-Hosted Runners](#github-hosted-runners-1)
+  - [Self-Hosted Actions Runner Controller (ARC) Runners](#self-hosted-actions-runner-controller-arc-runners-1)
+  - [Self-Hosted VM Runners (e.g. on EC2)](#self-hosted-vm-runners-eg-on-ec2-1)
+- [Limitations](#limitations)
+  - [GitHub-Hosted Runners](#github-hosted-runners-2)
+  - [Self-Hosted Actions Runner Controller (ARC) Runners](#self-hosted-actions-runner-controller-arc-runners-2)
+  - [Self-Hosted VM Runners (e.g. on EC2)](#self-hosted-vm-runners-eg-on-ec2-2)
 
-For self-hosted environments, Harden-Runner supports:
 
-1. Kubernetes runners setup using Actions Runner Controller (ARC)
-2. Virtual Machine runners (e.g. on EC2) - both ephemeral and persistent runners are supported
+## Introduction
 
-[![Harden Runner Demo](images/RuntimeSecurityDemo.gif)](https://youtu.be/fpdwX5hYACo)
+Harden-Runner provides network egress filtering and runtime security for GitHub-hosted and self-hosted runners. It is called Harden-Runner because it `hardens` the `runner` on which GitHub Actions workflows run.
 
-## Explore open source projects using Harden-Runner
+Learn how Harden-Runner works through the video below, which shows how it detected a supply chain attack on a Google open-source project.
 
-| [![CISA](https://avatars.githubusercontent.com/u/18539691?s=60&v=4)](https://app.stepsecurity.io/github/cisagov/skeleton-generic/actions/runs/6199340224) | [![Microsoft](https://avatars.githubusercontent.com/u/6154722?s=60&v=4)](https://app.stepsecurity.io/github/microsoft/ebpf-for-windows/actions/runs/5559160177) | [![Google](https://avatars.githubusercontent.com/u/2810941?s=60&v=4)](https://app.stepsecurity.io/github/GoogleCloudPlatform/functions-framework-ruby/actions/runs/5546354505) | [![DataDog](https://avatars.githubusercontent.com/u/365230?s=60&v=4)](https://app.stepsecurity.io/github/DataDog/stratus-red-team/actions/runs/5387101451) | [![Intel](https://avatars.githubusercontent.com/u/17888862?s=60&v=4)](https://app.stepsecurity.io/github/intel/cve-bin-tool/actions/runs/5579910614) | [![Kubernetes](https://avatars.githubusercontent.com/u/36015203?s=60&v=4)](https://app.stepsecurity.io/github/kubernetes-sigs/cluster-api-provider-azure/actions/runs/5581511101) | [![Node.js](https://avatars.githubusercontent.com/u/9950313?s=60&v=4)](https://app.stepsecurity.io/github/nodejs/node/actions/runs/5563468674) | [![Mastercard](https://avatars.githubusercontent.com/u/1653148?s=60&v=4)](https://app.stepsecurity.io/github/Mastercard/flow/actions/runs/5542112873) |
-| --------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------- |
-| **CISA**<br>[Explore](https://app.stepsecurity.io/github/cisagov/skeleton-generic/actions/runs/6199340224)                                                | **Microsoft**<br>[Explore](https://app.stepsecurity.io/github/microsoft/ebpf-for-windows/actions/runs/5559160177)                                               | **Google**<br>[Explore](https://app.stepsecurity.io/github/GoogleCloudPlatform/functions-framework-ruby/actions/runs/5546354505)                                               | **DataDog**<br>[Explore](https://app.stepsecurity.io/github/DataDog/stratus-red-team/actions/runs/5387101451)                                              | **Intel**<br>[Explore](https://app.stepsecurity.io/github/intel/cve-bin-tool/actions/runs/5579910614)                                                | **Kubernetes**<br>[Explore](https://app.stepsecurity.io/github/kubernetes-sigs/cluster-api-provider-azure/actions/runs/5581511101)                                                | **Node.js**<br>[Explore](https://app.stepsecurity.io/github/nodejs/node/actions/runs/5563468674)                                               | **Mastercard**<br>[Explore](https://app.stepsecurity.io/github/Mastercard/flow/actions/runs/5542112873)                                               |
+<a href="https://youtu.be/Yz72qAOrN9s" target="_blank"><img src="images/case-study-thumbnail1.png" alt="Harden-Runner detected supply chain attack in a Google open-source project" title="This case study video shows how StepSecurity Harden-Runner detected a CI/CD supply chain attack in real-time in Google’s open-source project Flank"></a>
 
-## Hands-On Tutorials
+## 3,500+ open source projects use Harden-Runner
 
-You can use [GitHub Actions Goat](https://github.com/step-security/github-actions-goat) to try Harden-Runner. You only need a GitHub Account and a web browser.
+Harden-Runner is trusted by leading open source projects and enterprises to secure their CI/CD pipelines.
 
-Hands-on Tutorials for GitHub Actions Runtime Security:
+### Trusted by
 
-1. [Filter Egress Network Traffic](https://github.com/step-security/github-actions-goat/blob/main/docs/Solutions/RestrictOutboundTraffic.md)
-2. [Detect File Tampering](https://github.com/step-security/github-actions-goat/blob/main/docs/Solutions/MonitorSourceCode.md)
 
-## Why
+| [![CISA](https://avatars.githubusercontent.com/u/18539691?s=60&v=4)](https://app.stepsecurity.io/github/cisagov/skeleton-generic/actions/runs/9947319332?jobid=27479776091&tab=network-events) | [![Microsoft](https://avatars.githubusercontent.com/u/6154722?s=60&v=4)](https://app.stepsecurity.io/github/microsoft/ebpf-for-windows/actions/runs/7587031851) | [![Google](https://avatars.githubusercontent.com/u/2810941?s=60&v=4)](https://app.stepsecurity.io/github/GoogleCloudPlatform/functions-framework-ruby/actions/runs/7576989995) | [![DataDog](https://avatars.githubusercontent.com/u/365230?s=60&v=4)](https://app.stepsecurity.io/github/DataDog/stratus-red-team/actions/runs/7446169664) | [![Intel](https://avatars.githubusercontent.com/u/17888862?s=60&v=4)](https://app.stepsecurity.io/github/intel/cve-bin-tool/actions/runs/7590975903) | [![Kubernetes](https://avatars.githubusercontent.com/u/36015203?s=60&v=4)](https://app.stepsecurity.io/github/kubernetes-sigs/cluster-api-provider-azure/actions/runs/7591172950) | [![Node.js](https://avatars.githubusercontent.com/u/9950313?s=60&v=4)](https://app.stepsecurity.io/github/nodejs/node/actions/runs/7591405720) | [![AWS](https://avatars.githubusercontent.com/u/2232217?s=60&v=4)](https://app.stepsecurity.io/github/aws/aperf/actions/runs/7631366761) |
+| --------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------- |
+| **CISA**<br>[Explore](https://app.stepsecurity.io/github/cisagov/skeleton-generic/actions/runs/9947319332?jobid=27479776091&tab=network-events)                                                | **Microsoft**<br>[Explore](https://app.stepsecurity.io/github/microsoft/ebpf-for-windows/actions/runs/7587031851)                                               | **Google**<br>[Explore](https://app.stepsecurity.io/github/GoogleCloudPlatform/functions-framework-ruby/actions/runs/7576989995)                                               | **DataDog**<br>[Explore](https://app.stepsecurity.io/github/DataDog/stratus-red-team/actions/runs/7446169664)                                              | **Intel**<br>[Explore](https://app.stepsecurity.io/github/intel/cve-bin-tool/actions/runs/7590975903)                                                | **Kubernetes**<br>[Explore](https://app.stepsecurity.io/github/kubernetes-sigs/cluster-api-provider-azure/actions/runs/7591172950)                                                | **Node.js**<br>[Explore](https://app.stepsecurity.io/github/nodejs/node/actions/runs/7591405720)                                               | **AWS**<br>[Explore](https://app.stepsecurity.io/github/aws/aperf/actions/runs/7631366761)                                               |
 
-Compromised workflows, dependencies, and build tools typically make outbound calls to exfiltrate credentials, or may tamper source code, dependencies, or artifacts during the build.
+### Case Studies
+
+- [Harden-Runner Detects CI/CD Supply Chain Attack in Google’s Open-Source Project Flank](https://www.stepsecurity.io/case-studies/flank)
+- [Kapiche secures their GitHub Actions software supply chain with Harden-Runner](https://www.stepsecurity.io/case-studies/kapiche)
+- [Arcjet Enhances CI/CD Security with Harden-Runner](https://www.stepsecurity.io/case-studies/arcjet)
+
+
+## Why use Harden-Runner
+
+There are two main threats from compromised workflows, dependencies, and build tools in a CI/CD environment:
+
+1. Exfiltration of CI/CD credentials and source code
+2. Tampering of source code, dependencies, or artifacts during the build to inject a backdoor
 
 Harden-Runner monitors process, file, and network activity to:
 
-|     | Countermeasure                                                                                                                      | Prevent Security Breach                                                                                                                                                                                                                                                                                                                             |
-| --- | ----------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| 1.  | Block egress traffic at the DNS (Layer 7) and network layers (Layers 3 and 4) to prevent exfiltration of code and CI/CD credentials | To prevent [Codecov breach](https://github.com/step-security/github-actions-goat/blob/main/docs/Vulnerabilities/ExfiltratingCICDSecrets.md) scenario                                                                                                                                                                                                |
-| 2.  | Detect if source code is being tampered during the build process to inject a backdoor                                               | To detect [SolarWinds incident](https://github.com/step-security/github-actions-goat/blob/main/docs/Vulnerabilities/TamperingDuringBuild.md) scenario                                                                                                                                                                                               |
-| 3.  | Detect poisoned workflows and compromised dependencies                                                                              | To detect [Dependency confusion](https://github.com/step-security/github-actions-goat/blob/main/docs/Vulnerabilities/ExfiltratingCICDSecrets.md#dependency-confusion-attacks) and [Malicious dependencies](https://github.com/step-security/github-actions-goat/blob/main/docs/Vulnerabilities/ExfiltratingCICDSecrets.md#compromised-dependencies) |
+|     | Countermeasure                                                                                                                                                    | Prevent Security Breach                                                                                                                                                                                                                                                                                                                                       |
+| --- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| 1.  | Monitor and block outbound network traffic at the DNS, HTTPS (Layer 7), and network layers (Layers 3 and 4) to prevent exfiltration of code and CI/CD credentials | To prevent the [Codecov breach](https://github.com/step-security/github-actions-goat/blob/main/docs/Vulnerabilities/ExfiltratingCICDSecrets.md) scenario                                                                                                                                                                                                      |
+| 2.  | Detect if source code is being tampered during the build process to inject a backdoor                                                                             | To detect the [XZ Utils](https://www.stepsecurity.io/blog/analysis-of-backdoored-xz-utils-build-process-with-harden-runner) and [SolarWinds incident](https://github.com/step-security/github-actions-goat/blob/main/docs/Vulnerabilities/TamperingDuringBuild.md) scenarios                                                                                  |
+| 3.  | Detect poisoned workflows and compromised dependencies that exhibit suspicious behavior                                                                           | To detect [Dependency confusion](https://github.com/step-security/github-actions-goat/blob/main/docs/Vulnerabilities/ExfiltratingCICDSecrets.md#dependency-confusion-attacks) and [Malicious dependencies](https://github.com/step-security/github-actions-goat/blob/main/docs/Vulnerabilities/ExfiltratingCICDSecrets.md#compromised-dependencies) scenarios |
+| 4.  | Determine minimum GITHUB_TOKEN permissions by monitoring HTTPS calls to GitHub APIs                                                                               | To set [minimum GITHUB_TOKEN permissions](https://www.stepsecurity.io/blog/determine-minimum-github-token-permissions-using-ebpf-with-stepsecurity-harden-runner) to reduce the impact of exfiltration                                                                                                                                                                                                                                                                                  |
 
-Read this [case study](https://infosecwriteups.com/detecting-malware-packages-in-github-actions-7b93a9985635) on how Harden-Runner detected malicious packages in the NPM registry.
+## Getting Started
 
-## How
+### Hardening GitHub-Hosted Runners
 
-### GitHub-Hosted Runners
-
-1. Add `step-security/harden-runner` GitHub Action to your GitHub Actions workflow file as the first step in each job.
+1. Add the `step-security/harden-runner` GitHub Action to your GitHub Actions workflow file as the first step in each job. You can automate adding Harden-Runner Action to your workflow file by pasting your workflow in the [StepSecurity online tool](https://app.stepsecurity.io/secureworkflow).
 
    ```yaml
    steps:
-     - uses: step-security/harden-runner@1b05615854632b887b69ae1be8cbefe72d3ae423 # v2.6.0
+     - uses: step-security/harden-runner@17d0e2bd7d51742c71671bd19fa12bdc9d40a3d6 # v2.8.1
        with:
          egress-policy: audit
    ```
@@ -72,51 +111,64 @@ Read this [case study](https://infosecwriteups.com/detecting-malware-packages-in
       <img src="images/buildlog1.png" alt="Link in build log" >
     </p>
 
-3. Click on the link ([example link](https://app.stepsecurity.io/github/microsoft/msquic/actions/runs/5577342236)). You will see a process monitor view of network and file events correlated with each step of the job.
+3. Click on the link ([example link](https://app.stepsecurity.io/github/step-security/github-actions-goat/actions/runs/7704454287)). You will see a process monitor view of network and file events correlated with each step of the job.
 
     <p align="left">
-      <img src="images/insights-5.png" alt="Insights from harden-runner" >
+      <img src="images/network-events1.png" alt="Insights from harden-runner" >
     </p>
 
-4. Under the insights section, you'll find a Recommended Policy. You can either update your workflow file with this Policy, or alternatively, use the [Policy Store](https://docs.stepsecurity.io/harden-runner/how-tos/block-egress-traffic#2-add-the-policy-using-the-policy-store) to apply the policy without modifying the workflow file.
+4. In the `Recommended Policy` tab, you'll find a recommended block policy based on outbound calls aggregated from the current and past runs of the job. You can update your workflow file with this policy, or alternatively, use the [Policy Store](https://docs.stepsecurity.io/harden-runner/how-tos/block-egress-traffic#2-add-the-policy-using-the-policy-store) to apply the policy without modifying the workflow file. From now on, any outbound calls not in the allowed list will be blocked.
 
     <p align="left">
-      <img src="images/rec-policy1.png" alt="Policy recommended by harden-runner" >
+      <img src="images/recommended-policy1.png" alt="Policy recommended by harden-runner" >
     </p>
 
-### Self-Hosted Actions Runner Controller (ARC) Runners
+#### Hands-On Tutorials
+
+You can use [GitHub Actions Goat](https://github.com/step-security/github-actions-goat) to try Harden-Runner. You only need a GitHub Account and a web browser.
+
+Hands-on Tutorials for GitHub Actions Runtime Security:
+
+1. [Filter Egress Network Traffic](https://github.com/step-security/github-actions-goat/blob/main/docs/Solutions/RestrictOutboundTraffic.md)
+2. [Detect File Tampering](https://github.com/step-security/github-actions-goat/blob/main/docs/Solutions/MonitorSourceCode.md)
+
+### Support for Private Repositories
+
+Hardening of runners used in private repositories is supported with a commercial license. Check out the [documentation](https://docs.stepsecurity.io/stepsecurity-platform/billing) for more details.
+
+- To use Harden-Runner in a `Private` repository, you must install the [StepSecurity GitHub App](https://github.com/apps/stepsecurity-actions-security).
+- This is needed to access the GitHub Actions API and to authenticate users to access the dashboard for private repositories.
+- If you use Harden-Runner GitHub Action in a private repository, the generated insights URL is NOT public. Only those who have access to the repository can view it.
+
+Read this [case study on how Kapiche uses Harden-Runner](https://www.stepsecurity.io/case-studies/kapiche/) to improve software supply chain security in their private repositories.
+
+### Hardening Self-Hosted Runners
+
+Hardening of self-hosted runners is supported with a commercial license. Check out the [documentation](https://docs.stepsecurity.io/stepsecurity-platform/billing) for more details. For hardening of self-hosted runners you must install the [StepSecurity GitHub App](https://github.com/apps/stepsecurity-actions-security).
+
+#### Self-Hosted Actions Runner Controller (ARC) Runners
 
 > Explore demo workflows using self-hosted ARC Runner and ARC Harden-Runner [here](https://docs.stepsecurity.io/harden-runner/how-tos/enable-runtime-security-arc).
 
-Actions Runner Controller (ARC) is a Kubernetes operator that orchestrates and scales self-hosted runners for GitHub Actions.
+Actions Runner Controller (ARC) is a Kubernetes operator that orchestrates self-hosted runners for GitHub Actions.
 
-- Instead of adding the Harden-Runner GitHub Action in each workflow, you'll need to install the ARC Harden-Runner daemonset on your Kubernetes cluster.
-- Upon installation, the ARC Harden-Runner daemonset constantly monitors each workflow run; you do NOT need to add the Harden-Runner GitHub Action to each job for `audit` mode. You do need to add the Harden-Runner GitHub Action for `block` mode.
-- You can access security insights and runtime detections under the `Runtime Security` tab in your dashboard.
+- Instead of adding the Harden-Runner GitHub Action in each job, you'll need to install the ARC Harden-Runner daemonset on your Kubernetes cluster.
+- Upon installation, the ARC Harden-Runner daemonset monitors all jobs run on the cluster; you do NOT need to add the Harden-Runner GitHub Action to each job for `audit` mode. You do need to add the Harden-Runner GitHub Action to jobs where you want to enable `block` mode.
+- The instructions for installing the ARC-Harden-Runner daemonset are shown in the dashboard. To enable access to these instructions, please email support@stepsecurity.io.
 
-### Self-Hosted VM Runners (e.g. on EC2)
+#### Self-Hosted VM Runners (e.g. on EC2)
 
 > Explore demo workflows using self-hosted VM Runners and Harden-Runner [here](https://docs.stepsecurity.io/harden-runner/how-tos/enable-runtime-security-vm).
 
-- Instead of adding the Harden-Runner GitHub Action in each workflow, you'll need to install the Harden-Runner agent on your runner image (e.g. AMI). This is typically done using packer.
-- The Harden-Runner agent monitors each job run on the VM, both ephemeral and persistent runners are supported; you do NOT need to add the Harden-Runner GitHub Action to each job for `audit` mode. You do need to add the Harden-Runner GitHub Action for `block` mode.
-- You can access security insights and runtime detections under the `Runtime Security` tab in your dashboard.
-
-## Support for Self-Hosted Runners and Private Repositories
-
-Runtime security for self-hosted runners and private repositories are supported with a commercial license. Check out the [documentation](https://docs.stepsecurity.io/stepsecurity-platform/billing) for more details.
-
-- Install the [StepSecurity Actions Security GitHub App](https://github.com/apps/stepsecurity-actions-security) to use Harden-Runner GitHub Action for `Private` repositories.
-- If you use Harden-Runner GitHub Action in a private repository, the generated insights URL is NOT public.
-- You need to authenticate first to access insights URL for private repository. Only those who have access to the repository can view it.
-
-Read this [case study on how Kapiche uses Harden-Runner](https://www.stepsecurity.io/case-studies/kapiche/) to improve software supply chain security in their private repositories.
+- Instead of adding the Harden-Runner GitHub Action in each job, you'll need to install the Harden-Runner agent on your runner image (e.g. AMI). This is typically done using packer or as a post-install step when using the https://github.com/philips-labs/terraform-aws-github-runner project to setup runners.
+- The Harden-Runner agent monitors all jobs run on the VM, both ephemeral and persistent runners are supported; you do NOT need to add the Harden-Runner GitHub Action to each job for `audit` mode. You do need to add the Harden-Runner GitHub Action to jobs where you want to enable `block` mode.
+- The instructions for installing the Harden-Runner agent on your self-hosted VM runners are shown in the dashboard. To enable access to these instructions, please email support@stepsecurity.io. This agent is different than the one used for GitHub-hosted runners.
 
 ## Features at a glance
 
 For details, check out the documentation at https://docs.stepsecurity.io
 
-### 👀 Monitor egress traffic
+### View outbound network traffic at the job level
 
 > Applies to both GitHub-hosted and self-hosted runners
 
@@ -124,37 +176,120 @@ Harden-Runner monitors all outbound traffic from each job at the DNS and network
 
 - After the workflow completes, each outbound call is correlated with each step of the job, and shown in the insights page
 - For self-hosted runners, no changes are needed to workflow files to monitor egress traffic
-- A filtering (block) egress policy is suggested in the insights page based on past job runs
+- A filtering (block) egress policy is suggested in the insights page based on the current and past job runs
 
-### 🚦 Filter egress traffic to allowed endpoints
+  <p align="left">
+        <img src="images/network-events1.png" alt="Insights from harden-runner" >
+  </p>
+
+### View outbound network traffic at the organization level
 
 > Applies to both GitHub-hosted and self-hosted runners
 
-Once allowed endpoints are set in the policy in the workflow file, or in the [Policy Store](https://docs.stepsecurity.io/harden-runner/how-tos/block-egress-traffic#2-add-the-policy-using-the-policy-store)
+You can view all unique network destinations from all workflow runs in your organization on the `Runtime Security` tab.
+
+- The `All Observed Endpoints` menu provides a detailed list of all network destinations contacted by your Actions runners.
+- For each listed endpoint, the `View Sample Workflow Runs` option enables you to examine individual GitHub Actions workflow runs that interacted with the endpoint.
+
+For more details refer [Unified Network Egress View: Centralize GitHub Actions Network Destinations for Your Enterprise](https://www.stepsecurity.io/blog/unified-network-egress-view-centralize-github-actions-network-destinations-for-your-enterprise)
+
+<p align="left">
+  <img src="images/org-level.png" width="400" alt="View outbound network traffic at the organization level" >
+</p>
+
+### View outbound HTTPS traffic at the job level
+
+> Applies to GitHub-hosted and self-hosted VM runners
+
+Harden-Runner can monitor outbound HTTPS requests. This feature is supported with a commercial license.
+
+- HTTPS events are monitored using eBPF (no MITM proxy is used)
+- If a HTTP PUT/ POST/ PATCH call is made to GitHub APIs to a HTTP Path with a different organization than where the workflow is running, the call is marked as anomalous
+- As of now, only HTTPS calls to `github.com`, `api.github.com`, `*.pkg.github.com`, and `ghcr.io` hosts are monitoried.
+
+<p align="left">
+  <img src="images/https-events.png" alt="View outbound HTTPS traffic at the job level" >
+</p>
+
+### Detect anomalous outbound network traffic
+
+> Applies to both GitHub-hosted and self-hosted runners
+
+You can detect suspicious/ anomalous traffic using this feature even in `egress-policy:audit` mode.
+
+- Anomaly detection feature creates a machine learning model of outbound network calls by analyzing the historical data of the same workflow in previous runs
+- After the baseline is created, any anomalous outbound destinations are marked as anomalous in the insights page, and real-time alerts are triggered
+- You can view the list of all anomalous outbound network traffic in the `Runtime detections` page on the dashboard
+
+For more details, refer to [Anomalous Outbound Call Detection Using Machine Learning](https://www.stepsecurity.io/blog/announcing-anomalous-outbound-call-detection-using-machine-learning)
+
+### Filter outbound network traffic to allowed endpoints
+
+> Applies to both GitHub-hosted and self-hosted runners
+
+You can see recommended egress block policy in the `Recommendations` tab for each job. This is based on observed traffic across multiple runs of the job.
+
+  <p align="left">
+        <img src="images/recommended-policy1.png" alt="Policy recommended by harden-runner" >
+  </p>
+
+Once you set these allowed endpoints in the workflow file, or in the [Policy Store](https://docs.stepsecurity.io/harden-runner/how-tos/block-egress-traffic#2-add-the-policy-using-the-policy-store) and switch to using `egress-policy:block`
 
 - Harden-Runner blocks egress traffic at the DNS (Layer 7) and network layers (Layers 3 and 4)
 - It blocks DNS exfiltration, where attacker tries to send data out using DNS resolution
 - Wildcard domains are supported, e.g. you can add `*.data.mcr.microsoft.com:443` to the allowed list, and egress traffic will be allowed to `eastus.data.mcr.microsoft.com:443` and `westus.data.mcr.microsoft.com:443`
 
 <p align="left">
-  <img src="images/blocked-outbound-call-2.png" alt="Policy recommended by harden-runner" >
+  <img src="images/blocked-outbound-call-3.png" alt="Policy recommended by harden-runner" >
 </p>
 
-### 🤖 Select GitHub Actions with Confidence
+### Determine minimum GITHUB_TOKEN permissions using Harden-Runner
+
+> Applies to GitHub-hosted runners
+
+Harden-Runner monitors outbound HTTPS requests using eBPF and uses the PATHs and VERBs of these HTTPS calls to recommend the minimum GITHUB_TOKEN permissions for each job in your workflow. This feature is supported with a commercial license.
+
+- GITHUB_TOKEN is an automatically generated secret used to authenticate to GitHub APIs from GitHub Actions workflows.
+- Harden-Runner can monitor the VERBs (e.g., `GET`, `POST`) and PATHs (e.g., `/repos/owner/repo/issues`) for calls made to the GitHub APIs from the runner.
+- Each GitHub Actions API call requires a corresponding GITHUB_TOKEN permission. For instance, a GET request to the `/repos/org/repo/info/refs?service=git-upload-pack` endpoint requires the `contents: read` permission.
+- The recommendation for the minimum GITHUB_TOKEN permissions are show in the `Recommendations` tab.
+
+For more details, refer to [Determine Minimum GITHUB_TOKEN Permissions Using eBPF with Harden-Runner.
+](https://www.stepsecurity.io/blog/determine-minimum-github-token-permissions-using-ebpf-with-stepsecurity-harden-runner)
+
+<p align="left">
+  <img src="images/token-perms-recommendation.png" alt="View recommendation for minimum GITHUB_TOKEN permissions" >
+</p>
+
+### View the name and path of every file written during the build process
 
 > Applies to both GitHub-hosted and self-hosted runners
 
-Before integrating a GitHub Action into your workflow, evaluate its network activity.
+View the name and path of every file that was written during the build process. This feature is supported with a commercial license.
 
-- Access network behavior data for hundreds of GitHub Actions, compiled from thousands of workflow runs that use Harden-Runner in public repositories
-- Search for a GitHub Action and view a comprehensive report of its outbound network traffic
-- Use this insight to make educated choices about incorporating GitHub Actions into your projects
+- Harden-Runner tracks every file written to the GitHub Actions working directory during the build process.
+- In the insights page in the `File Write Events` tab you can see a file explorer view of each file that was written to.
+- Clicking on any file reveals a list of processes that wrote to it, providing complete transparency.
 
 <p align="left">
-  <img src="images/network-behavior.png" alt="Networking behavior of an Action" >
+  <img src="images/file-write-events.png" alt="View the name and path of every file written during the build process" >
 </p>
 
-### 📁 Detect tampering of source code during build
+### View process names and arguments
+
+> Applies to both GitHub-hosted and self-hosted runners
+
+View process names, PIDs, and process arguments. This feature is supported with a commercial license.
+
+- Harden-Runner tracks every process that is run during the build process.
+- Clicking on any process ID (PID) in the network events, file events, or HTTPS events shows the process that caused the event, along with the process arguments.
+- You can walk up the process tree by clicking `View Parent Process` to understand the build process and detect suspicious activity.
+
+<p align="left">
+  <img src="images/process-events-3.png" alt="View process names and arguments" >
+</p>
+
+### Detect tampering of source code during build
 
 > Applies to both GitHub-hosted and self-hosted runners
 
@@ -166,10 +301,10 @@ Harden-Runner monitors file writes and can detect if a file is overwritten.
 - For self-hosted runners, no changes are needed to workflow files for file monitoring
 
 <p align="left">
-  <img src="images/file-overwritten.png" alt="Policy recommended by harden-runner" >
+  <img src="images/file-events.png" alt="Policy recommended by harden-runner" >
 </p>
 
-### 🚫 Run your job without sudo access
+### Run your job without sudo access
 
 > Applies to GitHub-hosted runners
 
@@ -180,14 +315,18 @@ GitHub-hosted runner uses passwordless sudo for running jobs.
   recommendation to disable sudo in the insights page
 - When you set `disable-sudo` to `true`, the job steps run without sudo access to the GitHub-hosted Ubuntu VM
 
-### 🔔 Get security alerts
+  <p align="left">
+        <img src="images/recommended-policy1.png" alt="Policy recommended by harden-runner" >
+  </p>
+
+### Get real-time security alerts
 
 > Applies to both GitHub-hosted and self-hosted runners
 
-Install the [StepSecurity Actions Security GitHub App](https://github.com/apps/stepsecurity-actions-security) to get security alerts.
+Install the [StepSecurity GitHub App](https://github.com/apps/stepsecurity-actions-security) to get security alerts/ notifications.
 
-- Email and Slack notifications are supported
-- Notifications are sent when outbound traffic is blocked or source code is overwritten
+- Email, Slack, and Teams notifications are supported
+- Notifications are sent when anomalous outbound network/ HTTPS traffic is detected, outbound traffic is blocked, or source code is overwritten
 - Notifications are not repeated for the same alert for a given workflow
 
 ## Discussions

jest.config.ts

@@ -1,5 +1,9 @@
 /** @type {import('ts-jest/dist/types').InitialOptionsTsJest} */
 export default {
-  preset: 'ts-jest',
-  testEnvironment: 'node',
+  preset: "ts-jest",
+  testEnvironment: "node",
+  reporters: [
+    "default",
+    ["jest-junit", { outputDirectory: "reports", outputName: "report.xml" }],
+  ],
 };

package.json

@@ -1,6 +1,6 @@
 {
   "name": "step-security-harden-runner",
-  "version": "2.6.1",
+  "version": "2.7.0",
   "description": "Security agent for GitHub-hosted runner: block egress traffic & detect code overwrite to prevent breaches",
   "main": "index.js",
   "scripts": {
@@ -26,27 +26,27 @@
     "@actions/cache": "^3.1.4",
     "@actions/core": "^1.5.0",
     "@actions/exec": "^1.1.0",
-    "@actions/github": "^6.0.0",
-    "@actions/tool-cache": "^2.0.1",
+    "@actions/github": "^5.0.0",
+    "@actions/http-client": "^2.0.1",
+    "@actions/tool-cache": "^1.7.1",
     "ansi-regex": ">=5.0.1",
-    "axios": "^1.6.1",
     "is-docker": "^3.0.0",
     "node-fetch": ">=3.2.0",
-    "uuid": "^9.0.1"
+    "uuid": "^8.3.2"
   },
   "devDependencies": {
-    "@types/jest": "^29.5.8",
-    "@types/node": "^20.9.0",
+    "@types/jest": "^27.5.2",
+    "@types/node": "^16.9.0",
     "@typescript-eslint/eslint-plugin": "^6.1.0",
     "@typescript-eslint/parser": "^6.1.0",
-    "@vercel/ncc": "0.38.0",
-    "eslint": "^8.53.0",
+    "@vercel/ncc": "^0.30.0",
+    "eslint": "^7.32.0",
     "eslint-config-google": "^0.14.0",
     "jest": "^29.3.1",
     "jest-junit": ">=13.0.0",
     "nock": "^13.3.0",
     "ts-jest": "^29.0.3",
     "ts-node": "^10.9.1",
-    "typescript": "^5.2.2"
+    "typescript": "^4.3.5"
   }
 }

src/checksum.ts

@@ -2,15 +2,34 @@ import * as core from "@actions/core";
 import * as crypto from "crypto";
 import * as fs from "fs";
 
-export function verifyChecksum(downloadPath: string) {
+const CHECKSUMS = {
+  tls: {
+    amd64: "0bd500769646f0a90c0dfe9ac59699d5165bed549a9870c031b861146af337b2", // v1.3.2
+    arm64: "c2448ac205fd90f46abba31c13cf34c3b997824881502f736315fb08ac0a5a5c",
+  },
+  non_tls: {
+    amd64: "a9f1842e3d7f3d38c143dbe8ffe1948e6c8173cd04da072d9f9d128bb400844a", // v0.13.7
+  },
+};
+
+export function verifyChecksum(
+  downloadPath: string,
+  isTLS: boolean,
+  variant: string
+) {
   const fileBuffer: Buffer = fs.readFileSync(downloadPath);
   const checksum: string = crypto
     .createHash("sha256")
     .update(fileBuffer)
     .digest("hex"); // checksum of downloaded file
 
-  const expectedChecksum: string =
-    "ceb925c78e5c79af4f344f08f59bbdcf3376d20d15930a315f9b24b6c4d0328a"; // checksum for v0.13.5
+  let expectedChecksum: string = "";
+
+  if (isTLS) {
+    expectedChecksum = CHECKSUMS["tls"][variant];
+  } else {
+    expectedChecksum = CHECKSUMS["non_tls"][variant];
+  }
 
   if (checksum !== expectedChecksum) {
     core.setFailed(

src/cleanup.ts

@@ -5,6 +5,8 @@ import isDocker from "is-docker";
 import { arcCleanUp, isArcRunner, removeStepPolicyFiles } from "./arc-runner";
 
 (async () => {
+  console.log("[harden-runner] post-step");
+
   if (process.platform !== "linux") {
     console.log(common.UBUNTU_MESSAGE);
     return;
@@ -25,6 +27,10 @@ import { arcCleanUp, isArcRunner, removeStepPolicyFiles } from "./arc-runner";
     return;
   }
 
+  if (process.env.STATE_isTLS === "false" && process.arch === "arm64") {
+    return;
+  }
+
   if (
     String(process.env.STATE_monitorStatusCode) ===
     common.STATUS_HARDEN_RUNNER_UNAVAILABLE
@@ -62,6 +68,13 @@ import { arcCleanUp, isArcRunner, removeStepPolicyFiles } from "./arc-runner";
     console.log(content);
   }
 
+  const daemonLog = "/home/agent/daemon.log";
+  if (fs.existsSync(daemonLog)) {
+    console.log("daemonLog:");
+    var content = fs.readFileSync(daemonLog, "utf-8");
+    console.log(content);
+  }
+
   var status = "/home/agent/agent.status";
   if (fs.existsSync(status)) {
     console.log("status:");

src/common.ts

@@ -1,5 +1,6 @@
 import * as core from "@actions/core";
 import * as fs from "fs";
+import { STEPSECURITY_WEB_URL } from "./configs";
 
 export function printInfo(web_url) {
   console.log(
@@ -34,8 +35,15 @@ export const processLogLine = (
     if (matches) {
       const [ipAddress, domain, pid, process] = matches.slice(1);
 
-      // Check if all values are non-empty
-      if (pid && process && domain && ipAddress) {
+      // Check if all values are non-empty and domain does not end with specified patterns
+      if (
+        pid &&
+        process &&
+        domain &&
+        ipAddress &&
+        !domain.endsWith(".actions.githubusercontent.com.") &&
+        !domain.endsWith(".blob.core.windows.net.")
+      ) {
         const status = ipAddress.startsWith("54.185.253.63")
           ? "❌ Blocked"
           : "✅ Allowed";
@@ -47,11 +55,11 @@ export const processLogLine = (
 };
 
 export async function addSummary() {
-  if (process.env.STATE_monitorStatusCode !== "200") {
+  if (process.env.STATE_addSummary !== "true") {
     return;
   }
 
-  const web_url = "https://app.stepsecurity.io";
+  const web_url = STEPSECURITY_WEB_URL;
   const insights_url = `${web_url}/github/${process.env["GITHUB_REPOSITORY"]}/actions/runs/${process.env["GITHUB_RUN_ID"]}`;
 
   const log = "/home/agent/agent.log";
@@ -172,4 +180,7 @@ export const HARDEN_RUNNER_UNAVAILABLE_MESSAGE =
   "Sorry, we are currently experiencing issues with the Harden Runner installation process. It is currently unavailable.";
 
 export const ARC_RUNNER_MESSAGE =
-  "Workflow is currently being executed in ARC based runner";
+  "Workflow is currently being executed in ARC based runner.";
+
+export const ARM64_RUNNER_MESSAGE =
+  "ARM runners are not supported in the Harden-Runner community tier.";

src/configs.ts

@@ -0,0 +1,5 @@
+export const STEPSECURITY_ENV = "agent"; // agent or int
+
+export const STEPSECURITY_API_URL = `https://${STEPSECURITY_ENV}.api.stepsecurity.io/v1`;
+
+export const STEPSECURITY_WEB_URL = "https://app.stepsecurity.io";

src/index.ts

@@ -1,8 +1,11 @@
 import * as common from "./common";
 import * as core from "@actions/core";
 import isDocker from "is-docker";
+import { STEPSECURITY_WEB_URL } from "./configs";
 
 (async () => {
+  console.log("[harden-runner] main-step");
+
   if (process.platform !== "linux") {
     console.log(common.UBUNTU_MESSAGE);
     return;
@@ -20,6 +23,10 @@ import isDocker from "is-docker";
     return;
   }
 
+  if (process.env.STATE_isTLS === "false" && process.arch === "arm64") {
+    return;
+  }
+
   if (
     core.getBooleanInput("disable-telemetry") &&
     core.getInput("egress-policy") === "block"
@@ -28,7 +35,7 @@ import isDocker from "is-docker";
       "Telemetry will not be sent to StepSecurity API as disable-telemetry is set to true"
     );
   } else {
-    var web_url = "https://app.stepsecurity.io";
+    var web_url = STEPSECURITY_WEB_URL;
     common.printInfo(web_url);
   }
 })();

src/install-agent.ts

@@ -0,0 +1,65 @@
+import * as tc from "@actions/tool-cache";
+import * as core from "@actions/core";
+import * as cp from "child_process";
+import * as path from "path";
+import * as fs from "fs";
+import { verifyChecksum } from "./checksum";
+import { EOL } from "os";
+import { ARM64_RUNNER_MESSAGE } from "./common";
+
+export async function installAgent(
+  isTLS: boolean,
+  configStr: string
+): Promise<boolean> {
+  // Note: to avoid github rate limiting
+  const token = core.getInput("token", { required: true });
+  const auth = `token ${token}`;
+
+  const variant = process.arch === "x64" ? "amd64" : "arm64";
+
+  let downloadPath: string;
+
+  fs.appendFileSync(process.env.GITHUB_STATE, `isTLS=${isTLS}${EOL}`, {
+    encoding: "utf8",
+  });
+
+  if (isTLS) {
+    downloadPath = await tc.downloadTool(
+      `https://packages.stepsecurity.io/github-hosted/harden-runner_1.3.2_linux_${variant}.tar.gz`
+    );
+  } else {
+    if (variant === "arm64") {
+      console.log(ARM64_RUNNER_MESSAGE);
+      return false;
+    }
+    downloadPath = await tc.downloadTool(
+      "https://github.com/step-security/agent/releases/download/v0.13.7/agent_0.13.7_linux_amd64.tar.gz",
+      undefined,
+      auth
+    );
+  }
+
+  verifyChecksum(downloadPath, isTLS, variant);
+
+  const extractPath = await tc.extractTar(downloadPath);
+
+  let cmd = "cp",
+    args = [path.join(extractPath, "agent"), "/home/agent/agent"];
+
+  cp.execFileSync(cmd, args);
+
+  cp.execSync("chmod +x /home/agent/agent");
+
+  fs.writeFileSync("/home/agent/agent.json", configStr);
+
+  cmd = "sudo";
+  args = [
+    "cp",
+    path.join(__dirname, "agent.service"),
+    "/etc/systemd/system/agent.service",
+  ];
+  cp.execFileSync(cmd, args);
+  cp.execSync("sudo systemctl daemon-reload");
+  cp.execSync("sudo service agent start", { timeout: 15000 });
+  return true;
+}

src/interfaces.ts

@@ -9,7 +9,10 @@ export interface Configuration {
   disable_telemetry: boolean;
   disable_sudo: boolean;
   disable_file_monitoring: boolean;
+  is_github_hosted: boolean;
   private: string;
+  is_debug: boolean;
+  one_time_key: string;
 }
 
 export interface PolicyResponse {

src/policy-utils.test.ts

@@ -1,6 +1,7 @@
 import nock from "nock";
-import { API_ENDPOINT, fetchPolicy, mergeConfigs } from "./policy-utils";
+import { fetchPolicy, mergeConfigs } from "./policy-utils";
 import { Configuration, PolicyResponse } from "./interfaces";
+import { STEPSECURITY_API_URL } from "./configs";
 
 test("success: fetching policy", async () => {
   let owner = "h0x0er";
@@ -14,7 +15,7 @@ test("success: fetching policy", async () => {
     disable_sudo: false,
     disable_file_monitoring: false,
   };
-  const policyScope = nock(`${API_ENDPOINT}`)
+  const policyScope = nock(`${STEPSECURITY_API_URL}`)
     .get(`/github/${owner}/actions/policies/${policyName}`)
     .reply(200, response);
 
@@ -37,6 +38,9 @@ test("merge configs", async () => {
     disable_sudo: false,
     disable_file_monitoring: false,
     private: "true",
+    is_github_hosted: true,
+    is_debug: false,
+    one_time_key: "",
   };
   let policyResponse: PolicyResponse = {
     owner: "h0x0er",
@@ -60,6 +64,9 @@ test("merge configs", async () => {
     disable_sudo: false,
     disable_file_monitoring: false,
     private: "true",
+    is_github_hosted: true,
+    is_debug: false,
+    one_time_key: "",
   };
 
   localConfig = mergeConfigs(localConfig, policyResponse);

src/policy-utils.ts

@@ -1,19 +1,17 @@
 import { HttpClient } from "@actions/http-client";
 import { PolicyResponse, Configuration } from "./interfaces";
-
-export const API_ENDPOINT = "https://agent.api.stepsecurity.io/v1";
+import { STEPSECURITY_API_URL } from "./configs";
 
 export async function fetchPolicy(
   owner: string,
   policyName: string,
   idToken: string
 ): Promise<PolicyResponse> {
-
   if (idToken === "") {
     throw new Error("[PolicyFetch]: id-token in empty");
   }
 
-  let policyEndpoint = `${API_ENDPOINT}/github/${owner}/actions/policies/${policyName}`;
+  let policyEndpoint = `${STEPSECURITY_API_URL}/github/${owner}/actions/policies/${policyName}`;
 
   let httpClient = new HttpClient();
 
@@ -25,24 +23,24 @@ export async function fetchPolicy(
   let err = undefined;
 
   let retry = 0;
-  while(retry < 3){
-    try{
-      console.log(`Attempt: ${retry+1}`)
+  while (retry < 3) {
+    try {
+      console.log(`Attempt: ${retry + 1}`);
       response = await httpClient.getJson<PolicyResponse>(
         policyEndpoint,
         headers
       );
       break;
-    }catch(e){
-      err = e
+    } catch (e) {
+      err = e;
     }
-    retry += 1
+    retry += 1;
     await sleep(1000);
   }
 
-  if(response === undefined && err !== undefined){
-    throw new Error(`[Policy Fetch] ${err}`)
-  }else{
+  if (response === undefined && err !== undefined) {
+    throw new Error(`[Policy Fetch] ${err}`);
+  } else {
     return response.result;
   }
 }

src/setup.ts

@@ -1,12 +1,10 @@
 import * as core from "@actions/core";
 import * as cp from "child_process";
 import * as fs from "fs";
-import axios from "axios";
+import * as httpm from "@actions/http-client";
 import * as path from "path";
 import { v4 as uuidv4 } from "uuid";
 import * as common from "./common";
-import * as tc from "@actions/tool-cache";
-import { verifyChecksum } from "./checksum";
 import isDocker from "is-docker";
 import { context } from "@actions/github";
 import { EOL } from "os";
@@ -23,9 +21,20 @@ import * as cache from "@actions/cache";
 import { getCacheEntry } from "@actions/cache/lib/internal/cacheHttpClient";
 import * as utils from "@actions/cache/lib/internal/cacheUtils";
 import { isArcRunner, sendAllowedEndpoints } from "./arc-runner";
+import { STEPSECURITY_API_URL, STEPSECURITY_WEB_URL } from "./configs";
+import { isGithubHosted, isTLSEnabled } from "./tls-inspect";
+import { installAgent } from "./install-agent";
+
+interface MonitorResponse {
+  runner_ip_address?: string;
+  one_time_key?: string;
+  monitoring_started?: boolean;
+}
 
 (async () => {
   try {
+    console.log("[harden-runner] pre-step");
+
     if (process.platform !== "linux") {
       console.log(common.UBUNTU_MESSAGE);
       return;
@@ -36,9 +45,8 @@ import { isArcRunner, sendAllowedEndpoints } from "./arc-runner";
     }
 
     var correlation_id = uuidv4();
-    var env = "agent";
-    var api_url = `https://${env}.api.stepsecurity.io/v1`;
-    var web_url = "https://app.stepsecurity.io";
+    var api_url = STEPSECURITY_API_URL;
+    var web_url = STEPSECURITY_WEB_URL;
 
     let confg: Configuration = {
       repo: process.env["GITHUB_REPOSITORY"],
@@ -52,8 +60,27 @@ import { isArcRunner, sendAllowedEndpoints } from "./arc-runner";
       disable_sudo: core.getBooleanInput("disable-sudo"),
       disable_file_monitoring: core.getBooleanInput("disable-file-monitoring"),
       private: context?.payload?.repository?.private || false,
+      is_github_hosted: isGithubHosted(),
+      is_debug: core.isDebug(),
+      one_time_key: "",
     };
 
+    let policyName = core.getInput("policy");
+    if (policyName !== "") {
+      console.log(`Fetching policy from API with name: ${policyName}`);
+      try {
+        let idToken: string = await core.getIDToken();
+        let result: PolicyResponse = await fetchPolicy(
+          context.repo.owner,
+          policyName,
+          idToken
+        );
+        confg = mergeConfigs(confg, result);
+      } catch (err) {
+        core.info(`[!] ${err}`);
+        core.setFailed(err);
+      }
+    }
     fs.appendFileSync(
       process.env.GITHUB_STATE,
       `disableSudo=${confg.disable_sudo}${EOL}`,
@@ -127,7 +154,7 @@ import { isArcRunner, sendAllowedEndpoints } from "./arc-runner";
 
     const runnerName = process.env.RUNNER_NAME || "";
     core.info(`RUNNER_NAME: ${runnerName}`);
-    if (!runnerName.startsWith("GitHub Actions")) {
+    if (!isGithubHosted()) {
       fs.appendFileSync(process.env.GITHUB_STATE, `selfHosted=true${EOL}`, {
         encoding: "utf8",
       });
@@ -149,18 +176,23 @@ import { isArcRunner, sendAllowedEndpoints } from "./arc-runner";
       }
       return;
     }
-    //return;
 
+    let _http = new httpm.HttpClient();
     let statusCode;
-    //_http.requestOptions = { socketTimeout: 3 * 1000 };
+    _http.requestOptions = { socketTimeout: 3 * 1000 };
+    let addSummary = "false";
     try {
-      const resp = await axios.get(
+      const monitorRequestData = {
+        correlation_id: correlation_id,
+        job: process.env["GITHUB_JOB"],
+      };
+      const resp = await _http.postJson<MonitorResponse>(
         `${api_url}/github/${process.env["GITHUB_REPOSITORY"]}/actions/runs/${process.env["GITHUB_RUN_ID"]}/monitor`,
-        { timeout: 3000 }
+        monitorRequestData
       );
 
-      statusCode = resp.status; // adding error code to check whether agent is getting installed or not.
-      console.log(`statuscode: ${statusCode}`);
+      const responseData = resp.result;
+      statusCode = resp.statusCode; // adding error code to check whether agent is getting installed or not.
       fs.appendFileSync(
         process.env.GITHUB_STATE,
         `monitorStatusCode=${statusCode}${EOL}`,
@@ -168,81 +200,68 @@ import { isArcRunner, sendAllowedEndpoints } from "./arc-runner";
           encoding: "utf8",
         }
       );
+
+      if (statusCode === 200 && responseData) {
+        console.log(`Runner IP Address: ${responseData.runner_ip_address}`);
+        confg.one_time_key = responseData.one_time_key;
+        addSummary = responseData.monitoring_started ? "true" : "false";
+      }
     } catch (e) {
       console.log(`error in connecting to ${api_url}: ${e}`);
     }
-    //return;
+    fs.appendFileSync(
+      process.env.GITHUB_STATE,
+      `addSummary=${addSummary}${EOL}`,
+      {
+        encoding: "utf8",
+      }
+    );
+
     console.log(`Step Security Job Correlation ID: ${correlation_id}`);
     if (String(statusCode) === common.STATUS_HARDEN_RUNNER_UNAVAILABLE) {
       console.log(common.HARDEN_RUNNER_UNAVAILABLE_MESSAGE);
       return;
     }
-    //return;
+
     const confgStr = JSON.stringify(confg);
     cp.execSync("sudo mkdir -p /home/agent");
     cp.execSync("sudo chown -R $USER /home/agent");
 
-    // Note: to avoid github rate limiting
-    let token = core.getInput("token");
-    let auth = `token ${token}`;
+    let isTLS = await isTLSEnabled(context.repo.owner);
 
-    const downloadPath: string = await tc.downloadTool(
-      "https://github.com/step-security/agent/releases/download/v0.13.5/agent_0.13.5_linux_amd64.tar.gz",
-      undefined,
-      auth
-    );
+    const agentInstalled = await installAgent(isTLS, confgStr);
 
-    verifyChecksum(downloadPath); // NOTE: verifying agent's checksum, before extracting
-    const extractPath = await tc.extractTar(downloadPath);
-    //return;
-    let cmd = "cp",
-      args = [path.join(extractPath, "agent"), "/home/agent/agent"];
-    cp.execFileSync(cmd, args);
-    cp.execSync("chmod +x /home/agent/agent");
-
-    fs.writeFileSync("/home/agent/agent.json", confgStr);
-
-    cmd = "sudo";
-    args = [
-      "cp",
-      path.join(__dirname, "agent.service"),
-      "/etc/systemd/system/agent.service",
-    ];
-    cp.execFileSync(cmd, args);
-    cp.execSync("sudo systemctl daemon-reload");
-    cp.execSync("sudo service agent start", { timeout: 15000 });
-
-    // Check that the file exists locally
-    var statusFile = "/home/agent/agent.status";
-    var logFile = "/home/agent/agent.log";
-    var counter = 0;
-    await sleep(5000);
-    while (true) {
-      if (!fs.existsSync(statusFile)) {
-        counter++;
-        if (counter > 30) {
-          console.log("timed out");
-          if (fs.existsSync(logFile)) {
-            var content = fs.readFileSync(logFile, "utf-8");
-            console.log(content);
+    if (agentInstalled) {
+      // Check that the file exists locally
+      var statusFile = "/home/agent/agent.status";
+      var logFile = "/home/agent/agent.log";
+      var counter = 0;
+      while (true) {
+        if (!fs.existsSync(statusFile)) {
+          counter++;
+          if (counter > 30) {
+            console.log("timed out");
+            if (fs.existsSync(logFile)) {
+              var content = fs.readFileSync(logFile, "utf-8");
+              console.log(content);
+            }
+            break;
           }
+          await sleep(300);
+        } // The file *does* exist
+        else {
+          // Read the file
+          var content = fs.readFileSync(statusFile, "utf-8");
+          console.log(content);
           break;
         }
-        console.log("sleeping");
-        await sleep(300);
-      } // The file *does* exist
-      else {
-        // Read the file
-        var content = fs.readFileSync(statusFile, "utf-8");
-        console.log(content);
-        break;
       }
     }
   } catch (error) {
     core.setFailed(error.message);
   }
-  console.log("method done");
-  return;
+  // see https://github.com/ruby/setup-ruby/issues/543
+  process.exit(0);
 })();
 
 export function sleep(ms) {

src/tls-inspect.test.ts

@@ -0,0 +1,29 @@
+import nock from "nock";
+import { STEPSECURITY_API_URL } from "./configs";
+import { isTLSEnabled } from "./tls-inspect";
+
+test("tls-inspect enabled", async () => {
+  let owner = "h0x0er";
+  let expected = true;
+
+  const resp = nock(`${STEPSECURITY_API_URL}`)
+    .get(`/github/${owner}/actions/tls-inspection-status`)
+    .reply(200, "");
+
+  let got = await isTLSEnabled(owner);
+
+  expect(got).toEqual(expected);
+});
+
+test("tls-inspect not enabled", async () => {
+  let owner = "step-security";
+  let expected = false;
+
+  const resp = nock(`${STEPSECURITY_API_URL}`)
+    .get(`/github/${owner}/actions/tls-inspection-status`)
+    .reply(401, "");
+
+  let got = await isTLSEnabled(owner);
+
+  expect(got).toEqual(expected);
+});

src/tls-inspect.ts

@@ -0,0 +1,29 @@
+import { HttpClient } from "@actions/http-client";
+import { STEPSECURITY_API_URL } from "./configs";
+import * as core from "@actions/core";
+
+export async function isTLSEnabled(owner: string): Promise<boolean> {
+  let tlsStatusEndpoint = `${STEPSECURITY_API_URL}/github/${owner}/actions/tls-inspection-status`;
+  let httpClient = new HttpClient();
+  httpClient.requestOptions = { socketTimeout: 3 * 1000 };
+  core.info(`[!] Checking TLS_STATUS: ${owner}`);
+  let isEnabled = false;
+  try {
+    let resp = await httpClient.get(tlsStatusEndpoint);
+    if (resp.message.statusCode === 200) {
+      isEnabled = true;
+      core.info(`[!] TLS_ENABLED: ${owner}`);
+    } else {
+      core.info(`[!] TLS_NOT_ENABLED: ${owner}`);
+    }
+  } catch (e) {
+    core.info(`[!] Unable to check TLS_STATUS`);
+  }
+
+  return isEnabled;
+}
+
+export function isGithubHosted() {
+  const runnerEnvironment = process.env.RUNNER_ENVIRONMENT || "";
+  return runnerEnvironment === "github-hosted";
+}