update agent

Feature/custom property skip

dist/pre/index.js

@@ -85248,7 +85248,7 @@ function addSummary() {
     });
 }
 const STATUS_HARDEN_RUNNER_UNAVAILABLE = "409";
-const CONTAINER_MESSAGE = "This job is running in a container. Harden Runner does not run in a container as it needs sudo access to run. This job will not be monitored.";
+const CONTAINER_MESSAGE = "This job is running in a container. Such jobs can be monitored by installing Harden Runner in a custom VM image for GitHub-hosted runners.";
 const UBUNTU_MESSAGE = "This job is not running in a GitHub Actions Hosted Runner Ubuntu VM. Harden Runner is only supported on Ubuntu VM. This job will not be monitored.";
 const SELF_HOSTED_RUNNER_MESSAGE = "This job is running on a self-hosted runner.";
 const HARDEN_RUNNER_UNAVAILABLE_MESSAGE = "Sorry, we are currently experiencing issues with the Harden Runner installation process. It is currently unavailable.";
@@ -85495,8 +85495,8 @@ var external_crypto_ = __nccwpck_require__(6982);
 
 const CHECKSUMS = {
     tls: {
-        amd64: "2430b850e0e4d67a2f3b626f02d2827226ee16406da6af0c47ae7b18e18bd2b8",
-        arm64: "a3c89271e697ab39557ba8011cac7a2df690b5d27b4584d5d5abdf8845a6ce6c",
+        amd64: "d92e2d3ad0d451dfddc082c10690fb69472df9e45f6d9b37b0e6fe374bd6569f",
+        arm64: "84ff11038212d5143447619a3b5457b58dd196cad94f987154f11bd6cd6a5fb0",
     },
     non_tls: {
         amd64: "336093af8ebe969567b66fd035af3bd4f7e1c723ce680d6b4b5b2a1f79bc329e", // v0.14.2
@@ -85549,7 +85549,7 @@ function installAgent(isTLS, configStr) {
             encoding: "utf8",
         });
         if (isTLS) {
-            downloadPath = yield tool_cache.downloadTool(`https://github.com/step-security/agent-ebpf/releases/download/v1.6.23/harden-runner_1.6.23_linux_${variant}.tar.gz`, undefined, auth);
+            downloadPath = yield tool_cache.downloadTool(`https://github.com/step-security/agent-ebpf/releases/download/v1.7.12/harden-runner_1.7.12_linux_${variant}.tar.gz`, undefined, auth);
         }
         else {
             if (variant === "arm64") {
@@ -85609,9 +85609,14 @@ var setup_awaiter = (undefined && undefined.__awaiter) || function (thisArg, _ar
 
 
 (() => setup_awaiter(void 0, void 0, void 0, function* () {
-    var _a, _b;
+    var _a, _b, _c, _d;
     try {
         console.log("[harden-runner] pre-step");
+        const customProperties = ((_b = (_a = github.context === null || github.context === void 0 ? void 0 : github.context.payload) === null || _a === void 0 ? void 0 : _a.repository) === null || _b === void 0 ? void 0 : _b.custom_properties) || {};
+        if (customProperties["skip-harden-runner"] === "true") {
+            console.log("Skipping harden-runner: custom property 'skip-harden-runner' is set to 'true'");
+            return;
+        }
         if (process.platform !== "linux") {
             console.log(UBUNTU_MESSAGE);
             return;
@@ -85635,7 +85640,7 @@ var setup_awaiter = (undefined && undefined.__awaiter) || function (thisArg, _ar
             disable_sudo: lib_core.getBooleanInput("disable-sudo"),
             disable_sudo_and_containers: lib_core.getBooleanInput("disable-sudo-and-containers"),
             disable_file_monitoring: lib_core.getBooleanInput("disable-file-monitoring"),
-            private: ((_b = (_a = github.context === null || github.context === void 0 ? void 0 : github.context.payload) === null || _a === void 0 ? void 0 : _a.repository) === null || _b === void 0 ? void 0 : _b.private) || false,
+            private: ((_d = (_c = github.context === null || github.context === void 0 ? void 0 : github.context.payload) === null || _c === void 0 ? void 0 : _c.repository) === null || _d === void 0 ? void 0 : _d.private) || false,
             is_github_hosted: isGithubHosted(),
             is_debug: lib_core.isDebug(),
             one_time_key: "",
@@ -85758,12 +85763,34 @@ var setup_awaiter = (undefined && undefined.__awaiter) || function (thisArg, _ar
                 encoding: "utf8",
             });
             lib_core.info(SELF_HOSTED_RUNNER_MESSAGE);
+            // Install agent for self-hosted runner (only if not already installed)
+            if (!external_fs_.existsSync("/home/agent/agent.status")) {
+                yield installAgentForSelfHosted(github.context.repo.owner);
+            }
+            else {
+                console.log("Agent already installed for self-hosted runner, skipping installation");
+            }
             if (confg.egress_policy === "block") {
                 sendAllowedEndpoints(confg.allowed_endpoints);
                 yield setup_sleep(5000);
             }
             return;
         }
+        if (isGithubHosted() && process.env.STEP_SECURITY_HARDEN_RUNNER === "true") {
+            external_fs_.appendFileSync(process.env.GITHUB_STATE, `customVMImage=true${external_os_.EOL}`, {
+                encoding: "utf8",
+            });
+            lib_core.info("This job is running on a custom VM image with Harden Runner installed.");
+            if (confg.egress_policy === "block") {
+                sendAllowedEndpoints(confg.allowed_endpoints);
+                yield setup_sleep(5000);
+            }
+            return;
+        }
+        if (isGithubHosted() && external_fs_.existsSync("/home/agent/agent.status")) {
+            console.log("Agent already installed, skipping installation");
+            return;
+        }
         let _http = new lib.HttpClient();
         let statusCode;
         _http.requestOptions = { socketTimeout: 3 * 1000 };
@@ -85847,6 +85874,59 @@ function chownForFolder(newOwner, target) {
     let args = ["chown", "-R", newOwner, target];
     external_child_process_.execFileSync(cmd, args);
 }
+function installAgentForSelfHosted(owner) {
+    return setup_awaiter(this, void 0, void 0, function* () {
+        try {
+            console.log("Installing Harden Runner agent for self-hosted runner");
+            // Determine TLS support
+            let isTLS = yield isTLSEnabled(owner);
+            if (!isTLS) {
+                console.log("TLS is not enabled for this organization. Agent installation skipped for self-hosted runner.");
+                return;
+            }
+            // Create self-hosted specific config
+            const selfHostedConfig = {
+                customer: owner,
+                working_directory: process.env.GITHUB_WORKSPACE,
+                api_key: v4()
+            };
+            const selfHostedConfigStr = JSON.stringify(selfHostedConfig);
+            // Create /home/agent directory
+            external_child_process_.execSync("sudo mkdir -p /home/agent");
+            chownForFolder(process.env.USER, "/home/agent");
+            // Install the agent
+            const agentInstalled = yield installAgent(isTLS, selfHostedConfigStr);
+            if (agentInstalled) {
+                // Wait for agent.status file
+                var statusFile = "/home/agent/agent.status";
+                var logFile = "/home/agent/agent.log";
+                var counter = 0;
+                while (true) {
+                    if (!external_fs_.existsSync(statusFile)) {
+                        counter++;
+                        if (counter > 30) {
+                            console.log("timed out");
+                            if (external_fs_.existsSync(logFile)) {
+                                var content = external_fs_.readFileSync(logFile, "utf-8");
+                                console.log(content);
+                            }
+                            break;
+                        }
+                        yield setup_sleep(300);
+                    }
+                    else {
+                        var content = external_fs_.readFileSync(statusFile, "utf-8");
+                        console.log(content);
+                        break;
+                    }
+                }
+            }
+        }
+        catch (error) {
+            console.log(`Failed to install agent for self-hosted runner: ${error.message}`);
+        }
+    });
+}
 
 })();
 

docs/limitations.md

@@ -3,7 +3,7 @@
 ### GitHub-Hosted Runners
 
 * Only Ubuntu VM is supported. Windows and MacOS GitHub-hosted runners are not supported. There is a discussion about that [here](https://github.com/step-security/harden-runner/discussions/121).
-* Harden-Runner is not supported when [job is run in a container](https://docs.github.com/en/actions/using-jobs/running-jobs-in-a-container) as it needs sudo access on the Ubuntu VM to run. It can be used to monitor jobs that use containers to run steps. The limitation is if the entire job is run in a container. That is not common for GitHub Actions workflows, as most of them run directly on `ubuntu-latest`. Note: This is not a limitation for Self-Hosted runners.
+* Harden-Runner is not supported when [job is run in a container](https://docs.github.com/en/actions/using-jobs/running-jobs-in-a-container) with built-in labels such as `ubuntu-latest`, as it needs sudo access on the Ubuntu VM to run. The limitation is if the entire job is run in a container. However, such jobs can be monitored when using custom VM images with GitHub-hosted runners. This is also not a limitation for Self-Hosted runners.
 
 ### Self-Hosted Actions Runner Controller (ARC) Runners
 

src/checksum.ts

@@ -4,8 +4,8 @@ import * as fs from "fs";
 
 const CHECKSUMS = {
   tls: {
-    amd64: "2430b850e0e4d67a2f3b626f02d2827226ee16406da6af0c47ae7b18e18bd2b8", // v1.6.23
-    arm64: "a3c89271e697ab39557ba8011cac7a2df690b5d27b4584d5d5abdf8845a6ce6c",
+    amd64: "d92e2d3ad0d451dfddc082c10690fb69472df9e45f6d9b37b0e6fe374bd6569f", // v1.7.12
+    arm64: "84ff11038212d5143447619a3b5457b58dd196cad94f987154f11bd6cd6a5fb0",
   },
   non_tls: {
     amd64: "336093af8ebe969567b66fd035af3bd4f7e1c723ce680d6b4b5b2a1f79bc329e", // v0.14.2

src/cleanup.ts

@@ -4,9 +4,16 @@ import * as common from "./common";
 import isDocker from "is-docker";
 import { isARCRunner } from "./arc-runner";
 import { isGithubHosted } from "./tls-inspect";
+import { context } from "@actions/github";
 (async () => {
   console.log("[harden-runner] post-step");
 
+  const customProperties = context?.payload?.repository?.custom_properties || {};
+  if (customProperties["skip-harden-runner"] === "true") {
+    console.log("Skipping harden-runner: custom property 'skip-harden-runner' is set to 'true'");
+    return;
+  }
+
   if (process.platform !== "linux") {
     console.log(common.UBUNTU_MESSAGE);
     return;
@@ -25,6 +32,10 @@ import { isGithubHosted } from "./tls-inspect";
     return;
   }
 
+  if (process.env.STATE_customVMImage === "true") {
+    return;
+  }
+
   if (process.env.STATE_isTLS === "false" && process.arch === "arm64") {
     return;
   }
@@ -37,6 +48,11 @@ import { isGithubHosted } from "./tls-inspect";
     return;
   }
 
+  if (isGithubHosted() && fs.existsSync("/home/agent/post_event.json")) {
+    console.log("Post step already executed, skipping");
+    return;
+  }
+
   fs.writeFileSync(
     "/home/agent/post_event.json",
     JSON.stringify({ event: "post" })

src/common.ts

@@ -126,7 +126,7 @@ export async function addSummary() {
 export const STATUS_HARDEN_RUNNER_UNAVAILABLE = "409";
 
 export const CONTAINER_MESSAGE =
-  "This job is running in a container. Harden Runner does not run in a container as it needs sudo access to run. This job will not be monitored.";
+  "This job is running in a container. Such jobs can be monitored by installing Harden Runner in a custom VM image for GitHub-hosted runners.";
 
 export const UBUNTU_MESSAGE =
   "This job is not running in a GitHub Actions Hosted Runner Ubuntu VM. Harden Runner is only supported on Ubuntu VM. This job will not be monitored.";

src/index.ts

@@ -3,9 +3,16 @@ import * as core from "@actions/core";
 import isDocker from "is-docker";
 import { STEPSECURITY_WEB_URL } from "./configs";
 import { isGithubHosted } from "./tls-inspect";
+import { context } from "@actions/github";
 (async () => {
   console.log("[harden-runner] main-step");
 
+  const customProperties = context?.payload?.repository?.custom_properties || {};
+  if (customProperties["skip-harden-runner"] === "true") {
+    console.log("Skipping harden-runner: custom property 'skip-harden-runner' is set to 'true'");
+    return;
+  }
+
   if (process.platform !== "linux") {
     console.log(common.UBUNTU_MESSAGE);
     return;

src/install-agent.ts

@@ -25,7 +25,7 @@ export async function installAgent(
 
   if (isTLS) {
     downloadPath = await tc.downloadTool(
-      `https://github.com/step-security/agent-ebpf/releases/download/v1.6.23/harden-runner_1.6.23_linux_${variant}.tar.gz`,
+      `https://github.com/step-security/agent-ebpf/releases/download/v1.7.12/harden-runner_1.7.12_linux_${variant}.tar.gz`,
       undefined,
       auth
     );

src/setup.ts

@@ -39,6 +39,12 @@ interface MonitorResponse {
   try {
     console.log("[harden-runner] pre-step");
 
+    const customProperties = context?.payload?.repository?.custom_properties || {};
+    if (customProperties["skip-harden-runner"] === "true") {
+      console.log("Skipping harden-runner: custom property 'skip-harden-runner' is set to 'true'");
+      return;
+    }
+
     if (process.platform !== "linux") {
       console.log(common.UBUNTU_MESSAGE);
       return;
@@ -236,6 +242,13 @@ interface MonitorResponse {
 
       core.info(common.SELF_HOSTED_RUNNER_MESSAGE);
 
+      // Install agent for self-hosted runner (only if not already installed)
+      if (!fs.existsSync("/home/agent/agent.status")) {
+        await installAgentForSelfHosted(context.repo.owner);
+      } else {
+        console.log("Agent already installed for self-hosted runner, skipping installation");
+      }
+
       if (confg.egress_policy === "block") {
         sendAllowedEndpoints(confg.allowed_endpoints);
         await sleep(5000);
@@ -243,6 +256,25 @@ interface MonitorResponse {
       return;
     }
 
+    if (isGithubHosted() && process.env.STEP_SECURITY_HARDEN_RUNNER === "true") {
+      fs.appendFileSync(process.env.GITHUB_STATE, `customVMImage=true${EOL}`, {
+        encoding: "utf8",
+      });
+
+      core.info("This job is running on a custom VM image with Harden Runner installed.");
+
+      if (confg.egress_policy === "block") {
+        sendAllowedEndpoints(confg.allowed_endpoints);
+        await sleep(5000);
+      }
+      return;
+    }
+
+    if (isGithubHosted() && fs.existsSync("/home/agent/agent.status")) {
+      console.log("Agent already installed, skipping installation");
+      return;
+    }
+
     let _http = new httpm.HttpClient();
     let statusCode: number | undefined;
     _http.requestOptions = { socketTimeout: 3 * 1000 };
@@ -348,3 +380,59 @@ function chownForFolder(newOwner: string, target: string) {
   let args = ["chown", "-R", newOwner, target];
   cp.execFileSync(cmd, args);
 }
+
+async function installAgentForSelfHosted(owner: string) {
+  try {
+    console.log("Installing Harden Runner agent for self-hosted runner");
+
+    // Determine TLS support
+    let isTLS = await isTLSEnabled(owner);
+
+    if (!isTLS) {
+      console.log("TLS is not enabled for this organization. Agent installation skipped for self-hosted runner.");
+      return;
+    }
+
+    // Create self-hosted specific config
+    const selfHostedConfig = {
+      customer: owner,
+      working_directory: process.env.GITHUB_WORKSPACE,
+      api_key: uuidv4()
+    };
+    const selfHostedConfigStr = JSON.stringify(selfHostedConfig);
+
+    // Create /home/agent directory
+    cp.execSync("sudo mkdir -p /home/agent");
+    chownForFolder(process.env.USER, "/home/agent");
+
+    // Install the agent
+    const agentInstalled = await installAgent(isTLS, selfHostedConfigStr);
+
+    if (agentInstalled) {
+      // Wait for agent.status file
+      var statusFile = "/home/agent/agent.status";
+      var logFile = "/home/agent/agent.log";
+      var counter = 0;
+      while (true) {
+        if (!fs.existsSync(statusFile)) {
+          counter++;
+          if (counter > 30) {
+            console.log("timed out");
+            if (fs.existsSync(logFile)) {
+              var content = fs.readFileSync(logFile, "utf-8");
+              console.log(content);
+            }
+            break;
+          }
+          await sleep(300);
+        } else {
+          var content = fs.readFileSync(statusFile, "utf-8");
+          console.log(content);
+          break;
+        }
+      }
+    }
+  } catch (error) {
+    console.log(`Failed to install agent for self-hosted runner: ${error.message}`);
+  }
+}