Merge pull request #376 from step-security/rc-7

Release 2.7.0
Update dist
2026-08-09 13:11:02 +00:00 · 2024-01-30 12:51:16 -08:00 · 2024-01-29 12:41:26 -08:00 · 2024-01-29 12:13:17 -08:00 · 2024-01-29 12:06:18 -08:00 · 2024-01-19 21:37:42 -08:00
36 changed files with 3431 additions and 59004 deletions
@@ -22,7 +22,7 @@ jobs:
    permissions:
      contents: write
    steps:
-    - uses: step-security/harden-runner@1b05615854632b887b69ae1be8cbefe72d3ae423 # v1
+    - uses: step-security/harden-runner@eb238b55efaa70779f274895e782ed17c84f2895 # v1
      with:
        egress-policy: audit
        allowed-endpoints:
@@ -41,3 +41,9 @@ jobs:
      env:
        PAT: ${{ secrets.PAT }}
        canary: true
+
+    - name: Canary TLS test
+      uses: docker://ghcr.io/step-security/integration-test/int:latest
+      env:
+        PAT: ${{ secrets.PAT }}
+        canary-tls: true
@@ -11,7 +11,7 @@ jobs:
      pull-requests: read
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@1b05615854632b887b69ae1be8cbefe72d3ae423 # v2.6.0
+        uses: step-security/harden-runner@eb238b55efaa70779f274895e782ed17c84f2895 # v2.6.1
        with:
          disable-sudo: true
          egress-policy: block
@@ -41,7 +41,7 @@ jobs:

    steps:
    - name: Harden Runner
-      uses: step-security/harden-runner@1b05615854632b887b69ae1be8cbefe72d3ae423
+      uses: step-security/harden-runner@eb238b55efaa70779f274895e782ed17c84f2895
      with:
        egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs

@@ -17,11 +17,11 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@1b05615854632b887b69ae1be8cbefe72d3ae423 # v2.6.0
+        uses: step-security/harden-runner@eb238b55efaa70779f274895e782ed17c84f2895 # v2.6.1
        with:
          egress-policy: audit

      - name: 'Checkout Repository'
        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
      - name: 'Dependency Review'
-        uses: actions/dependency-review-action@6c5ccdad469c9f8a2996bfecaec55a631a347034 # v3.1.0
+        uses: actions/dependency-review-action@7bbfa034e752445ea40215fff1c3bf9597993d3f # v3.1.3
@@ -13,7 +13,7 @@ jobs:
    runs-on: ubuntu-latest
    steps:
    - name: Harden Runner
-      uses: step-security/harden-runner@1b05615854632b887b69ae1be8cbefe72d3ae423
+      uses: step-security/harden-runner@eb238b55efaa70779f274895e782ed17c84f2895
      with:
        egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs

@@ -22,3 +22,18 @@ jobs:
      env:
        PAT: ${{ secrets.PAT }}
        canary: true
+
+  int-tls-tests:
+    name: int tls tests
+    runs-on: ubuntu-latest
+    steps:
+    - name: Harden Runner
+      uses: step-security/harden-runner@eb238b55efaa70779f274895e782ed17c84f2895
+      with:
+        egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
+
+    - name: Canary test
+      uses: docker://ghcr.io/step-security/integration-test/int:latest
+      env:
+        PAT: ${{ secrets.PAT }}
+        canary-tls: true
@@ -25,7 +25,7 @@ jobs:
    permissions:
      contents: write
    steps:
-    - uses: step-security/harden-runner@1b05615854632b887b69ae1be8cbefe72d3ae423
+    - uses: step-security/harden-runner@eb238b55efaa70779f274895e782ed17c84f2895
      with:
        egress-policy: audit
        allowed-endpoints:
@@ -25,7 +25,7 @@ jobs:

    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@1b05615854632b887b69ae1be8cbefe72d3ae423 # v2.6.0
+        uses: step-security/harden-runner@eb238b55efaa70779f274895e782ed17c84f2895 # v2.6.1
        with:
          egress-policy: audit

@@ -13,10 +13,13 @@ concurrency:
  group: ${{ github.workflow }}
 jobs:
  test:
+    permissions:
+      checks: write
+      pull-requests: write
    runs-on: ubuntu-latest
    steps:
      - name: Harden Runner
-        uses: step-security/harden-runner@1b05615854632b887b69ae1be8cbefe72d3ae423 # v2.6.0
+        uses: step-security/harden-runner@eb238b55efaa70779f274895e782ed17c84f2895 # v2.6.1
        with:
          disable-sudo: true
          egress-policy: audit
@@ -35,3 +38,9 @@ jobs:
      - name: Run coverage
        run: npm test -- --coverage
      - uses: codecov/codecov-action@eaaf4bedf32dbdc6b720b63067d99c4d77d6047d # v3.1.4
+      - name: Publish Test Results
+        uses: step-security/publish-unit-test-result-action@v1
+        if: always()
+        with:
+          files: |
+            reports/*.xml
@@ -20,6 +20,7 @@ lib-cov

 # Coverage directory used by tools like istanbul
 coverage
+reports
 *.lcov

 # nyc test coverage
@@ -13,9 +13,9 @@

 </div>

-## GitHub Actions Runtime Security
+## Harden Github-hosted and self-hosted runners

-Harden-Runner provides runtime security for GitHub-hosted and self-hosted environments.
+Harden-Runner provides network egress filtering and runtime security for GitHub-hosted and self-hosted runners.

 For self-hosted environments, Harden-Runner supports:

@@ -26,9 +26,9 @@ For self-hosted environments, Harden-Runner supports:

 ## Explore open source projects using Harden-Runner

-| [![CISA](https://avatars.githubusercontent.com/u/18539691?s=60&v=4)](https://app.stepsecurity.io/github/cisagov/skeleton-generic/actions/runs/6199340224) | [![Microsoft](https://avatars.githubusercontent.com/u/6154722?s=60&v=4)](https://app.stepsecurity.io/github/microsoft/ebpf-for-windows/actions/runs/5559160177) | [![Google](https://avatars.githubusercontent.com/u/2810941?s=60&v=4)](https://app.stepsecurity.io/github/GoogleCloudPlatform/functions-framework-ruby/actions/runs/5546354505) | [![DataDog](https://avatars.githubusercontent.com/u/365230?s=60&v=4)](https://app.stepsecurity.io/github/DataDog/stratus-red-team/actions/runs/5387101451) | [![Intel](https://avatars.githubusercontent.com/u/17888862?s=60&v=4)](https://app.stepsecurity.io/github/intel/cve-bin-tool/actions/runs/5579910614) | [![Kubernetes](https://avatars.githubusercontent.com/u/36015203?s=60&v=4)](https://app.stepsecurity.io/github/kubernetes-sigs/cluster-api-provider-azure/actions/runs/5581511101) | [![Node.js](https://avatars.githubusercontent.com/u/9950313?s=60&v=4)](https://app.stepsecurity.io/github/nodejs/node/actions/runs/5563468674) | [![Mastercard](https://avatars.githubusercontent.com/u/1653148?s=60&v=4)](https://app.stepsecurity.io/github/Mastercard/flow/actions/runs/5542112873) |
+| [![CISA](https://avatars.githubusercontent.com/u/18539691?s=60&v=4)](https://app.stepsecurity.io/github/cisagov/skeleton-generic/actions/runs/7588528684) | [![Microsoft](https://avatars.githubusercontent.com/u/6154722?s=60&v=4)](https://app.stepsecurity.io/github/microsoft/ebpf-for-windows/actions/runs/7587031851) | [![Google](https://avatars.githubusercontent.com/u/2810941?s=60&v=4)](https://app.stepsecurity.io/github/GoogleCloudPlatform/functions-framework-ruby/actions/runs/7576989995) | [![DataDog](https://avatars.githubusercontent.com/u/365230?s=60&v=4)](https://app.stepsecurity.io/github/DataDog/stratus-red-team/actions/runs/7446169664) | [![Intel](https://avatars.githubusercontent.com/u/17888862?s=60&v=4)](https://app.stepsecurity.io/github/intel/cve-bin-tool/actions/runs/7590975903) | [![Kubernetes](https://avatars.githubusercontent.com/u/36015203?s=60&v=4)](https://app.stepsecurity.io/github/kubernetes-sigs/cluster-api-provider-azure/actions/runs/7591172950) | [![Node.js](https://avatars.githubusercontent.com/u/9950313?s=60&v=4)](https://app.stepsecurity.io/github/nodejs/node/actions/runs/7591405720) | [![Mastercard](https://avatars.githubusercontent.com/u/1653148?s=60&v=4)](https://app.stepsecurity.io/github/Mastercard/flow/actions/runs/7539664931) |
 | --------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------- |
-| **CISA**<br>[Explore](https://app.stepsecurity.io/github/cisagov/skeleton-generic/actions/runs/6199340224)                                                | **Microsoft**<br>[Explore](https://app.stepsecurity.io/github/microsoft/ebpf-for-windows/actions/runs/5559160177)                                               | **Google**<br>[Explore](https://app.stepsecurity.io/github/GoogleCloudPlatform/functions-framework-ruby/actions/runs/5546354505)                                               | **DataDog**<br>[Explore](https://app.stepsecurity.io/github/DataDog/stratus-red-team/actions/runs/5387101451)                                              | **Intel**<br>[Explore](https://app.stepsecurity.io/github/intel/cve-bin-tool/actions/runs/5579910614)                                                | **Kubernetes**<br>[Explore](https://app.stepsecurity.io/github/kubernetes-sigs/cluster-api-provider-azure/actions/runs/5581511101)                                                | **Node.js**<br>[Explore](https://app.stepsecurity.io/github/nodejs/node/actions/runs/5563468674)                                               | **Mastercard**<br>[Explore](https://app.stepsecurity.io/github/Mastercard/flow/actions/runs/5542112873)                                               |
+| **CISA**<br>[Explore](https://app.stepsecurity.io/github/cisagov/skeleton-generic/actions/runs/7588528684)                                                | **Microsoft**<br>[Explore](https://app.stepsecurity.io/github/microsoft/ebpf-for-windows/actions/runs/7587031851)                                               | **Google**<br>[Explore](https://app.stepsecurity.io/github/GoogleCloudPlatform/functions-framework-ruby/actions/runs/7576989995)                                               | **DataDog**<br>[Explore](https://app.stepsecurity.io/github/DataDog/stratus-red-team/actions/runs/7446169664)                                              | **Intel**<br>[Explore](https://app.stepsecurity.io/github/intel/cve-bin-tool/actions/runs/7590975903)                                                | **Kubernetes**<br>[Explore](https://app.stepsecurity.io/github/kubernetes-sigs/cluster-api-provider-azure/actions/runs/7591172950)                                                | **Node.js**<br>[Explore](https://app.stepsecurity.io/github/nodejs/node/actions/runs/7591405720)                                               | **Mastercard**<br>[Explore](https://app.stepsecurity.io/github/Mastercard/flow/actions/runs/7539664931)                                               |

 ## Hands-On Tutorials

@@ -47,8 +47,8 @@ Harden-Runner monitors process, file, and network activity to:

 |     | Countermeasure                                                                                                                      | Prevent Security Breach                                                                                                                                                                                                                                                                                                                             |
 | --- | ----------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| 1.  | Block egress traffic at the DNS (Layer 7) and network layers (Layers 3 and 4) to prevent exfiltration of code and CI/CD credentials | To prevent [Codecov breach](https://github.com/step-security/github-actions-goat/blob/main/docs/Vulnerabilities/ExfiltratingCICDSecrets.md) scenario                                                                                                                                                                                                |
-| 2.  | Detect if source code is being tampered during the build process to inject a backdoor                                               | To detect [SolarWinds incident](https://github.com/step-security/github-actions-goat/blob/main/docs/Vulnerabilities/TamperingDuringBuild.md) scenario                                                                                                                                                                                               |
+| 1.  | Detect anomalous traffic and block egress traffic at the DNS (Layer 7) and network layers (Layers 3 and 4) to prevent exfiltration of code and CI/CD credentials | To prevent the [Codecov breach](https://github.com/step-security/github-actions-goat/blob/main/docs/Vulnerabilities/ExfiltratingCICDSecrets.md) scenario                                                                                                                                                                                                |
+| 2.  | Detect if source code is being tampered during the build process to inject a backdoor                                               | To detect the [SolarWinds incident](https://github.com/step-security/github-actions-goat/blob/main/docs/Vulnerabilities/TamperingDuringBuild.md) scenario                                                                                                                                                                                               |
 | 3.  | Detect poisoned workflows and compromised dependencies                                                                              | To detect [Dependency confusion](https://github.com/step-security/github-actions-goat/blob/main/docs/Vulnerabilities/ExfiltratingCICDSecrets.md#dependency-confusion-attacks) and [Malicious dependencies](https://github.com/step-security/github-actions-goat/blob/main/docs/Vulnerabilities/ExfiltratingCICDSecrets.md#compromised-dependencies) |

 Read this [case study](https://infosecwriteups.com/detecting-malware-packages-in-github-actions-7b93a9985635) on how Harden-Runner detected malicious packages in the NPM registry.
@@ -57,11 +57,11 @@ Read this [case study](https://infosecwriteups.com/detecting-malware-packages-in

 ### GitHub-Hosted Runners

-1. Add `step-security/harden-runner` GitHub Action to your GitHub Actions workflow file as the first step in each job.
+1. Add the `step-security/harden-runner` GitHub Action to your GitHub Actions workflow file as the first step in each job.

   ```yaml
   steps:
-     - uses: step-security/harden-runner@1b05615854632b887b69ae1be8cbefe72d3ae423 # v2.6.0
+     - uses: step-security/harden-runner@eb238b55efaa70779f274895e782ed17c84f2895 # v2.6.1
       with:
         egress-policy: audit
   ```
@@ -72,51 +72,51 @@ Read this [case study](https://infosecwriteups.com/detecting-malware-packages-in
      <img src="images/buildlog1.png" alt="Link in build log" >
    </p>

-3. Click on the link ([example link](https://app.stepsecurity.io/github/microsoft/msquic/actions/runs/5577342236)). You will see a process monitor view of network and file events correlated with each step of the job.
+3. Click on the link ([example link](https://app.stepsecurity.io/github/microsoft/msquic/actions/runs/7588119198)). You will see a process monitor view of network and file events correlated with each step of the job.

    <p align="left">
-      <img src="images/insights-5.png" alt="Insights from harden-runner" >
+      <img src="images/insights.png" alt="Insights from harden-runner" >
    </p>

-4. Under the insights section, you'll find a Recommended Policy. You can either update your workflow file with this Policy, or alternatively, use the [Policy Store](https://docs.stepsecurity.io/harden-runner/how-tos/block-egress-traffic#2-add-the-policy-using-the-policy-store) to apply the policy without modifying the workflow file.
+4. Under the process monitor view, you'll find a recommended block policy based on outbound calls aggregated from the current and past runs of the job. You can update your workflow file with this policy, or alternatively, use the [Policy Store](https://docs.stepsecurity.io/harden-runner/how-tos/block-egress-traffic#2-add-the-policy-using-the-policy-store) to apply the policy without modifying the workflow file. From now on, any outbound calls not in the allowed list will be blocked.

    <p align="left">
-      <img src="images/rec-policy1.png" alt="Policy recommended by harden-runner" >
+      <img src="images/rec-policy.png" alt="Policy recommended by harden-runner" >
    </p>

+## Support for Self-Hosted Runners and Private Repositories
+
+Hardening for self-hosted runners and GitHub-hosted runners used in private repositories is supported with a commercial license. Check out the [documentation](https://docs.stepsecurity.io/stepsecurity-platform/billing) for more details.
+
+- To use Harden-Runner in a `Private` repository, you must install the [StepSecurity Actions Security GitHub App](https://github.com/apps/stepsecurity-actions-security).
+- This is needed to access the GitHub Actions API and to authenticate users to access the insights URL for private repositories.
+- If you use Harden-Runner GitHub Action in a private repository, the generated insights URL is NOT public. Only those who have access to the repository can view it.
+
+Read this [case study on how Kapiche uses Harden-Runner](https://www.stepsecurity.io/case-studies/kapiche/) to improve software supply chain security in their private repositories.
+
 ### Self-Hosted Actions Runner Controller (ARC) Runners

 > Explore demo workflows using self-hosted ARC Runner and ARC Harden-Runner [here](https://docs.stepsecurity.io/harden-runner/how-tos/enable-runtime-security-arc).

-Actions Runner Controller (ARC) is a Kubernetes operator that orchestrates and scales self-hosted runners for GitHub Actions.
+Actions Runner Controller (ARC) is a Kubernetes operator that orchestrates self-hosted runners for GitHub Actions.

- Instead of adding the Harden-Runner GitHub Action in each workflow, you'll need to install the ARC Harden-Runner daemonset on your Kubernetes cluster.
- Upon installation, the ARC Harden-Runner daemonset constantly monitors each workflow run; you do NOT need to add the Harden-Runner GitHub Action to each job for `audit` mode. You do need to add the Harden-Runner GitHub Action for `block` mode.
- You can access security insights and runtime detections under the `Runtime Security` tab in your dashboard.
+- Instead of adding the Harden-Runner GitHub Action in each job, you'll need to install the ARC Harden-Runner daemonset on your Kubernetes cluster.
+- Upon installation, the ARC Harden-Runner daemonset monitors all jobs run on the cluster; you do NOT need to add the Harden-Runner GitHub Action to each job for `audit` mode. You do need to add the Harden-Runner GitHub Action to jobs where you want to enable `block` mode.
+- Please email support@stepsecurity.io for instructions on how to install the ARC-Harden-Runner daemonset on your Kubernetes cluster.

 ### Self-Hosted VM Runners (e.g. on EC2)

 > Explore demo workflows using self-hosted VM Runners and Harden-Runner [here](https://docs.stepsecurity.io/harden-runner/how-tos/enable-runtime-security-vm).

- Instead of adding the Harden-Runner GitHub Action in each workflow, you'll need to install the Harden-Runner agent on your runner image (e.g. AMI). This is typically done using packer.
- The Harden-Runner agent monitors each job run on the VM, both ephemeral and persistent runners are supported; you do NOT need to add the Harden-Runner GitHub Action to each job for `audit` mode. You do need to add the Harden-Runner GitHub Action for `block` mode.
- You can access security insights and runtime detections under the `Runtime Security` tab in your dashboard.
-
-## Support for Self-Hosted Runners and Private Repositories
-
-Runtime security for self-hosted runners and private repositories are supported with a commercial license. Check out the [documentation](https://docs.stepsecurity.io/stepsecurity-platform/billing) for more details.
-
- Install the [StepSecurity Actions Security GitHub App](https://github.com/apps/stepsecurity-actions-security) to use Harden-Runner GitHub Action for `Private` repositories.
- If you use Harden-Runner GitHub Action in a private repository, the generated insights URL is NOT public.
- You need to authenticate first to access insights URL for private repository. Only those who have access to the repository can view it.
-
-Read this [case study on how Kapiche uses Harden-Runner](https://www.stepsecurity.io/case-studies/kapiche/) to improve software supply chain security in their private repositories.
+- Instead of adding the Harden-Runner GitHub Action in each job, you'll need to install the Harden-Runner agent on your runner image (e.g. AMI). This is typically done using packer or as a post-install step when using the https://github.com/philips-labs/terraform-aws-github-runner project to setup runners.
+- The Harden-Runner agent monitors all jobs run on the VM, both ephemeral and persistent runners are supported; you do NOT need to add the Harden-Runner GitHub Action to each job for `audit` mode. You do need to add the Harden-Runner GitHub Action to jobs where you want to enable `block` mode.
+- Please email support@stepsecurity.io for instructions on how to install the Harden-Runner agent on your self-hosted VM runners. This agent is different than the one used for GitHub-hosted runners.

 ## Features at a glance

 For details, check out the documentation at https://docs.stepsecurity.io

-### 👀 Monitor egress traffic
+### 👀 View outbound network traffic

 > Applies to both GitHub-hosted and self-hosted runners

@@ -124,9 +124,18 @@ Harden-Runner monitors all outbound traffic from each job at the DNS and network

 - After the workflow completes, each outbound call is correlated with each step of the job, and shown in the insights page
 - For self-hosted runners, no changes are needed to workflow files to monitor egress traffic
- A filtering (block) egress policy is suggested in the insights page based on past job runs
+- A filtering (block) egress policy is suggested in the insights page based on the current and past job runs

-### 🚦 Filter egress traffic to allowed endpoints
+### ⚠️ Detect anomalous outbound network traffic
+
+> Applies to both GitHub-hosted and self-hosted runners
+
+Harden-Runner creates a baseline of outbound traffic for each job during the first few runs that it monitors
+
+- After the baseline is created, any new outbound destinations are marked as anomalous in the insights page
+- You can view the list of all anomalous outbound network traffic in the `Runtime detections` page on the dashboard
+
+### 🚦 Filter outbound network traffic to allowed endpoints

 > Applies to both GitHub-hosted and self-hosted runners

@@ -33,7 +33,7 @@ branding:
  icon: "check-square"
  color: "green"
 runs:
-  using: "node16"
+  using: "node20"
  pre: "dist/pre/index.js"
  main: "dist/index.js"
  post: "dist/post/index.js"
@@ -2913,8 +2913,8 @@ function addSummary() {
        if (tableEntries.length === 0) {
            return;
        }
-        const insightsRow = `<h4><a href="${insights_url}">View Full Runtime Security Report & Recommended Policy</a></h4>`;
-        yield core.summary.addSeparator().addRaw(`<h2>StepSecurity Report</h2>`);
+        const insightsRow = `<p><b><a href="${insights_url}">📄 View Full Report</a></b></p>`;
+        yield core.summary.addSeparator().addRaw(`<h2>🛡 StepSecurity Report</h2>`);
        tableEntries.sort((a, b) => {
            if (a.status === "❌ Blocked" && b.status !== "❌ Blocked") {
                return -1;
@@ -2928,8 +2928,9 @@ function addSummary() {
        });
        tableEntries = tableEntries.slice(0, 3);
        yield core.summary.addRaw(`
-  <p>Preview of the network events that occurred on the GitHub-hosted runner during this workflow run.</p>
-  <h3>🌐 Network Events</h3>
+  <blockquote>
+  <p>Preview of the outbound network calls during this workflow run.</p></blockquote>
+  <h3>Network Calls</h3>
  <table>
    <thead>
      <tr>
@@ -2941,22 +2942,22 @@ function addSummary() {
    <tbody>
      ${tableEntries
            .map((entry) => `<tr>
-          <td>${entry.process}</td>
+          <td><code>${entry.process}</code></td>
          <td>${entry.domain.replace(/\.$/, "")}</td>
          <td>${entry.status}</td>
        </tr>`)
            .join("")}
      <tr>
-        <td>...</td>
-        <td>...</td>
-        <td>...</td>
+        <td><code>...</code></td>
+        <td><code>...</code></td>
+        <td><code>...</code></td>
      </tr>
    </tbody>
  </table>
  ${insightsRow}
 `);
        yield core.summary
-            .addRaw(`<p>Markdown generated by the <a href="https://github.com/step-security/harden-runner">Harden-Runner GitHub Action</a></p>`)
+            .addRaw(`<p><i>Markdown generated by the <a href="https://github.com/step-security/harden-runner">Harden-Runner GitHub Action</a>.</i></p>`)
            .addSeparator()
            .write();
    });
@@ -1,5 +1,9 @@
 /** @type {import('ts-jest/dist/types').InitialOptionsTsJest} */
 export default {
-  preset: 'ts-jest',
-  testEnvironment: 'node',
+  preset: "ts-jest",
+  testEnvironment: "node",
+  reporters: [
+    "default",
+    ["jest-junit", { outputDirectory: "reports", outputName: "report.xml" }],
+  ],
 };
@@ -1,6 +1,6 @@
 {
  "name": "step-security-harden-runner",
-  "version": "2.5.1",
+  "version": "2.7.0",
  "description": "Security agent for GitHub-hosted runner: block egress traffic & detect code overwrite to prevent breaches",
  "main": "index.js",
  "scripts": {
@@ -1,14 +1,24 @@
 import * as cp from "child_process";
+import * as fs from "fs";
 import { sleep } from "./setup";

 export function isArcRunner(): boolean {
  const runnerUserAgent = process.env["GITHUB_ACTIONS_RUNNER_EXTRA_USER_AGENT"];

+  let isARC = false;
+
  if (!runnerUserAgent) {
-    return false;
+    isARC = false;
+  } else {
+    isARC = runnerUserAgent.includes("actions-runner-controller/");
  }

-  return runnerUserAgent.includes("actions-runner-controller/");
+  return isARC || isSecondaryPod();
+}
+
+function isSecondaryPod(): boolean {
+  const workDir = "/__w";
+  return fs.existsSync(workDir);
 }

 function getRunnerTempDir(): string {
@@ -2,16 +2,21 @@ import * as core from "@actions/core";
 import * as crypto from "crypto";
 import * as fs from "fs";

-export function verifyChecksum(downloadPath: string) {
+export function verifyChecksum(downloadPath: string, is_tls: boolean) {
  const fileBuffer: Buffer = fs.readFileSync(downloadPath);
  const checksum: string = crypto
    .createHash("sha256")
    .update(fileBuffer)
    .digest("hex"); // checksum of downloaded file

-  const expectedChecksum: string =
+  let expectedChecksum: string =
    "ceb925c78e5c79af4f344f08f59bbdcf3376d20d15930a315f9b24b6c4d0328a"; // checksum for v0.13.5

+  if (is_tls) {
+    expectedChecksum =
+      "204c82116e8c0eebf5409bb2b81aa5d96fe32f0c5abc1cb0364ee70937c32056"; // checksum for tls_agent
+  }
+
  if (checksum !== expectedChecksum) {
    core.setFailed(
      `Checksum verification failed, expected ${expectedChecksum} instead got ${checksum}`
@@ -1,11 +1,7 @@
 import * as fs from "fs";
 import * as cp from "child_process";
-import * as core from "@actions/core";
 import * as common from "./common";
 import isDocker from "is-docker";
-import * as cache from "@actions/cache";
-import { cacheFile, cacheKey, isValidEvent } from "./cache";
-import path from "path";
 import { arcCleanUp, isArcRunner, removeStepPolicyFiles } from "./arc-runner";

 (async () => {
@@ -18,18 +14,6 @@ import { arcCleanUp, isArcRunner, removeStepPolicyFiles } from "./arc-runner";
    return;
  }

-  if (isValidEvent()) {
-    try {
-      const cacheResult = await cache.saveCache(
-        [path.join(__dirname, "cache.txt")],
-        cacheKey
-      );
-      console.log(cacheResult);
-    } catch (exception) {
-      console.log(exception);
-    }
-  }
-
  if (isArcRunner()) {
    console.log(`[!] ${common.ARC_RUNNER_MESSAGE}`);
    arcCleanUp();
@@ -54,8 +38,8 @@ import { arcCleanUp, isArcRunner, removeStepPolicyFiles } from "./arc-runner";
    JSON.stringify({ event: "post" })
  );

-  var doneFile = "/home/agent/done.json";
-  var counter = 0;
+  const doneFile = "/home/agent/done.json";
+  let counter = 0;
  while (true) {
    if (!fs.existsSync(doneFile)) {
      counter++;
@@ -71,7 +55,7 @@ import { arcCleanUp, isArcRunner, removeStepPolicyFiles } from "./arc-runner";
    }
  }

-  var log = "/home/agent/agent.log";
+  const log = "/home/agent/agent.log";
  if (fs.existsSync(log)) {
    console.log("log:");
    var content = fs.readFileSync(log, "utf-8");
@@ -101,9 +101,9 @@ export async function addSummary() {
    return;
  }

-  const insightsRow = `<h4><a href="${insights_url}">View Full Runtime Security Report & Recommended Policy</a></h4>`;
+  const insightsRow = `<p><b><a href="${insights_url}">📄 View Full Report</a></b></p>`;

-  await core.summary.addSeparator().addRaw(`<h2>StepSecurity Report</h2>`);
+  await core.summary.addSeparator().addRaw(`<h2>🛡 StepSecurity Report</h2>`);

  tableEntries.sort((a, b) => {
    if (a.status === "❌ Blocked" && b.status !== "❌ Blocked") {
@@ -118,8 +118,9 @@ export async function addSummary() {
  tableEntries = tableEntries.slice(0, 3);

  await core.summary.addRaw(`
-  <p>Preview of the network events that occurred on the GitHub-hosted runner during this workflow run.</p>
-  <h3>🌐 Network Events</h3>
+  <blockquote>
+  <p>Preview of the outbound network calls during this workflow run.</p></blockquote>
+  <h3>Network Calls</h3>
  <table>
    <thead>
      <tr>
@@ -132,16 +133,16 @@ export async function addSummary() {
      ${tableEntries
        .map(
          (entry) => `<tr>
-          <td>${entry.process}</td>
+          <td><code>${entry.process}</code></td>
          <td>${entry.domain.replace(/\.$/, "")}</td>
          <td>${entry.status}</td>
        </tr>`
        )
        .join("")}
      <tr>
-        <td>...</td>
-        <td>...</td>
-        <td>...</td>
+        <td><code>...</code></td>
+        <td><code>...</code></td>
+        <td><code>...</code></td>
      </tr>
    </tbody>
  </table>
@@ -150,7 +151,7 @@ export async function addSummary() {

  await core.summary
    .addRaw(
-      `<p>Markdown generated by the <a href="https://github.com/step-security/harden-runner">Harden-Runner GitHub Action</a></p>`
+      `<p><i>Markdown generated by the <a href="https://github.com/step-security/harden-runner">Harden-Runner GitHub Action</a>.</i></p>`
    )
    .addSeparator()
    .write();
@@ -0,0 +1,5 @@
+export const STEPSECURITY_ENV = "agent"; // agent or int
+
+export const STEPSECURITY_API_URL = `https://${STEPSECURITY_ENV}.api.stepsecurity.io/v1`;
+
+export const STEPSECURITY_WEB_URL = "https://app.stepsecurity.io";
@@ -9,6 +9,7 @@ export interface Configuration {
  disable_telemetry: boolean;
  disable_sudo: boolean;
  disable_file_monitoring: boolean;
+  is_github_hosted: boolean;
  private: string;
 }

@@ -1,6 +1,7 @@
 import nock from "nock";
-import { API_ENDPOINT, fetchPolicy, mergeConfigs } from "./policy-utils";
+import { fetchPolicy, mergeConfigs } from "./policy-utils";
 import { Configuration, PolicyResponse } from "./interfaces";
+import { STEPSECURITY_API_URL } from "./configs";

 test("success: fetching policy", async () => {
  let owner = "h0x0er";
@@ -14,7 +15,7 @@ test("success: fetching policy", async () => {
    disable_sudo: false,
    disable_file_monitoring: false,
  };
-  const policyScope = nock(`${API_ENDPOINT}`)
+  const policyScope = nock(`${STEPSECURITY_API_URL}`)
    .get(`/github/${owner}/actions/policies/${policyName}`)
    .reply(200, response);

@@ -37,6 +38,7 @@ test("merge configs", async () => {
    disable_sudo: false,
    disable_file_monitoring: false,
    private: "true",
+    is_github_hosted: true,
  };
  let policyResponse: PolicyResponse = {
    owner: "h0x0er",
@@ -60,6 +62,7 @@ test("merge configs", async () => {
    disable_sudo: false,
    disable_file_monitoring: false,
    private: "true",
+    is_github_hosted: true,
  };

  localConfig = mergeConfigs(localConfig, policyResponse);
@@ -1,19 +1,17 @@
 import { HttpClient } from "@actions/http-client";
 import { PolicyResponse, Configuration } from "./interfaces";
-
-export const API_ENDPOINT = "https://agent.api.stepsecurity.io/v1";
+import { STEPSECURITY_API_URL } from "./configs";

 export async function fetchPolicy(
  owner: string,
  policyName: string,
  idToken: string
 ): Promise<PolicyResponse> {
-
  if (idToken === "") {
    throw new Error("[PolicyFetch]: id-token in empty");
  }

-  let policyEndpoint = `${API_ENDPOINT}/github/${owner}/actions/policies/${policyName}`;
+  let policyEndpoint = `${STEPSECURITY_API_URL}/github/${owner}/actions/policies/${policyName}`;

  let httpClient = new HttpClient();

@@ -25,24 +23,24 @@ export async function fetchPolicy(
  let err = undefined;

  let retry = 0;
-  while(retry < 3){
-    try{
-      console.log(`Attempt: ${retry+1}`)
+  while (retry < 3) {
+    try {
+      console.log(`Attempt: ${retry + 1}`);
      response = await httpClient.getJson<PolicyResponse>(
        policyEndpoint,
        headers
      );
      break;
-    }catch(e){
-      err = e
+    } catch (e) {
+      err = e;
    }
-    retry += 1
+    retry += 1;
    await sleep(1000);
  }

-  if(response === undefined && err !== undefined){
-    throw new Error(`[Policy Fetch] ${err}`)
-  }else{
+  if (response === undefined && err !== undefined) {
+    throw new Error(`[Policy Fetch] ${err}`);
+  } else {
    return response.result;
  }
 }
@@ -19,10 +19,12 @@ import {
 } from "./cache";
 import { Configuration, PolicyResponse } from "./interfaces";
 import { fetchPolicy, mergeConfigs } from "./policy-utils";
-
+import * as cache from "@actions/cache";
 import { getCacheEntry } from "@actions/cache/lib/internal/cacheHttpClient";
 import * as utils from "@actions/cache/lib/internal/cacheUtils";
 import { isArcRunner, sendAllowedEndpoints } from "./arc-runner";
+import { STEPSECURITY_API_URL, STEPSECURITY_WEB_URL } from "./configs";
+import { isGithubHosted, isTLSEnabled } from "./tls-inspect";

 (async () => {
  try {
@@ -36,9 +38,8 @@ import { isArcRunner, sendAllowedEndpoints } from "./arc-runner";
    }

    var correlation_id = uuidv4();
-    var env = "agent";
-    var api_url = `https://${env}.api.stepsecurity.io/v1`;
-    var web_url = "https://app.stepsecurity.io";
+    var api_url = STEPSECURITY_API_URL;
+    var web_url = STEPSECURITY_WEB_URL;

    let confg: Configuration = {
      repo: process.env["GITHUB_REPOSITORY"],
@@ -52,6 +53,7 @@ import { isArcRunner, sendAllowedEndpoints } from "./arc-runner";
      disable_sudo: core.getBooleanInput("disable-sudo"),
      disable_file_monitoring: core.getBooleanInput("disable-file-monitoring"),
      private: context?.payload?.repository?.private || false,
+      is_github_hosted: isGithubHosted(),
    };

    let policyName = core.getInput("policy");
@@ -93,13 +95,20 @@ import { isArcRunner, sendAllowedEndpoints } from "./arc-runner";
      core.setFailed("disable-telemetry must be a boolean value");
    }

-    if (isValidEvent()) {
+    if (isValidEvent() && confg.egress_policy === "block") {
      try {
-        let compressionMethod: CompressionMethod =
+        const cacheResult = await cache.saveCache(
+          [path.join(__dirname, "cache.txt")],
+          cacheKey
+        );
+        console.log(cacheResult);
+      } catch (exception) {
+        console.log(exception);
+      }
+      try {
+        const compressionMethod: CompressionMethod =
          await utils.getCompressionMethod();
-
-        let cacheFilePath = path.join(__dirname, "cache.txt");
-        cacheFilePath = cacheFilePath.replace("/pre/", "/post/");
+        const cacheFilePath = path.join(__dirname, "cache.txt");
        core.info(`cacheFilePath ${cacheFilePath}`);
        const cacheEntry: ArtifactCacheEntry = await getCacheEntry(
          [cacheKey],
@@ -136,7 +145,7 @@ import { isArcRunner, sendAllowedEndpoints } from "./arc-runner";

    const runnerName = process.env.RUNNER_NAME || "";
    core.info(`RUNNER_NAME: ${runnerName}`);
-    if (!runnerName.startsWith("GitHub Actions")) {
+    if (!isGithubHosted()) {
      fs.appendFileSync(process.env.GITHUB_STATE, `selfHosted=true${EOL}`, {
        encoding: "utf8",
      });
@@ -192,18 +201,30 @@ import { isArcRunner, sendAllowedEndpoints } from "./arc-runner";
    let token = core.getInput("token");
    let auth = `token ${token}`;

-    const downloadPath: string = await tc.downloadTool(
-      "https://github.com/step-security/agent/releases/download/v0.13.5/agent_0.13.5_linux_amd64.tar.gz",
-      undefined,
-      auth
-    );
+    let downloadPath: string;
+
+    if (await isTLSEnabled(context.repo.owner)) {
+      downloadPath = await tc.downloadTool(
+        "https://packages.stepsecurity.io/github-hosted/harden-runner_1.1.0_linux_amd64.tar.gz"
+      );
+      verifyChecksum(downloadPath, true); // NOTE: verifying tls_agent's checksum, before extracting
+    } else {
+      downloadPath = await tc.downloadTool(
+        "https://github.com/step-security/agent/releases/download/v0.13.5/agent_0.13.5_linux_amd64.tar.gz",
+        undefined,
+        auth
+      );
+
+      verifyChecksum(downloadPath, false); // NOTE: verifying agent's checksum, before extracting
+    }

-    verifyChecksum(downloadPath); // NOTE: verifying agent's checksum, before extracting
    const extractPath = await tc.extractTar(downloadPath);

    let cmd = "cp",
      args = [path.join(extractPath, "agent"), "/home/agent/agent"];
+
    cp.execFileSync(cmd, args);
+
    cp.execSync("chmod +x /home/agent/agent");

    fs.writeFileSync("/home/agent/agent.json", confgStr);
@@ -245,6 +266,8 @@ import { isArcRunner, sendAllowedEndpoints } from "./arc-runner";
  } catch (error) {
    core.setFailed(error.message);
  }
+  // see https://github.com/ruby/setup-ruby/issues/543
+  process.exit(0);
 })();

 export function sleep(ms) {
@@ -0,0 +1,29 @@
+import nock from "nock";
+import { STEPSECURITY_API_URL } from "./configs";
+import { isTLSEnabled } from "./tls-inspect";
+
+test("tls-inspect enabled", async () => {
+  let owner = "h0x0er";
+  let expected = true;
+
+  const resp = nock(`${STEPSECURITY_API_URL}`)
+    .get(`/github/${owner}/actions/tls-inspection-status`)
+    .reply(200, "");
+
+  let got = await isTLSEnabled(owner);
+
+  expect(got).toEqual(expected);
+});
+
+test("tls-inspect not enabled", async () => {
+  let owner = "step-security";
+  let expected = false;
+
+  const resp = nock(`${STEPSECURITY_API_URL}`)
+    .get(`/github/${owner}/actions/tls-inspection-status`)
+    .reply(401, "");
+
+  let got = await isTLSEnabled(owner);
+
+  expect(got).toEqual(expected);
+});
@@ -0,0 +1,29 @@
+import { HttpClient } from "@actions/http-client";
+import { STEPSECURITY_API_URL } from "./configs";
+import * as core from "@actions/core";
+
+export async function isTLSEnabled(owner: string): Promise<boolean> {
+  let tlsStatusEndpoint = `${STEPSECURITY_API_URL}/github/${owner}/actions/tls-inspection-status`;
+  let httpClient = new HttpClient();
+  httpClient.requestOptions = { socketTimeout: 3 * 1000 };
+  core.info(`[!] Checking TLS_STATUS: ${owner}`);
+  let isEnabled = false;
+  try {
+    let resp = await httpClient.get(tlsStatusEndpoint);
+    if (resp.message.statusCode === 200) {
+      isEnabled = true;
+      core.info(`[!] TLS_ENABLED: ${owner}`);
+    } else {
+      core.info(`[!] TLS_NOT_ENABLED: ${owner}`);
+    }
+  } catch (e) {
+    core.info(`[!] Unable to check TLS_STATUS`);
+  }
+
+  return isEnabled;
+}
+
+export function isGithubHosted() {
+  const runnerName = process.env.RUNNER_NAME || "";
+  return runnerName.startsWith("GitHub Actions");
+}
Author	SHA1	Message	Date
Varun Sharma	63c24ba6bd	Merge pull request #376 from step-security/rc-7 Release 2.7.0	2024-01-30 12:51:16 -08:00
Varun Sharma	95691d3d1c	Update dist	2024-01-29 12:41:26 -08:00
Varun Sharma	6339621ce7	Update to node20	2024-01-29 12:13:17 -08:00
jatin	4a63cdab74	Add tls-inspection capability (#368 )	2024-01-29 12:06:18 -08:00
Varun Sharma	dece11172e	Merge pull request #372 from step-security/readme-update Readme update	2024-01-19 21:37:42 -08:00
Varun Sharma	1952f97070	Updates	2024-01-19 20:59:27 -08:00
Varun Sharma	32f00ffb1b	Update README.md	2024-01-19 20:32:54 -08:00
Varun Sharma	ea8b747819	Publish test results (#363 ) * Publish test results * Update test.yml * Update test.yml * Update test.yml * Update test.yml	2023-12-07 12:09:35 -08:00
Varun Sharma	c0db65e1f6	Merge pull request #359 from step-security/dependabot/github_actions/actions/dependency-review-action-3.1.3 Bump actions/dependency-review-action from 3.1.0 to 3.1.3	2023-11-16 15:57:05 -08:00
Varun Sharma	4151c053ff	Merge pull request #361 from step-security/dependabot/github_actions/step-security/harden-runner-2.6.1 Bump step-security/harden-runner from 2.6.0 to 2.6.1	2023-11-16 15:56:41 -08:00
dependabot[bot]	c7832c5b85	Bump step-security/harden-runner from 2.6.0 to 2.6.1 Bumps [step-security/harden-runner](https://github.com/step-security/harden-runner) from 2.6.0 to 2.6.1. - [Release notes](https://github.com/step-security/harden-runner/releases) - [Commits](https://github.com/step-security/harden-runner/compare/1b05615854632b887b69ae1be8cbefe72d3ae423...eb238b55efaa70779f274895e782ed17c84f2895) --- updated-dependencies: - dependency-name: step-security/harden-runner dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>	2023-11-16 23:22:29 +00:00
Varun Sharma	c2443b23ee	Merge pull request #360 from step-security/varunsh-coder-patch-1 Update README.md	2023-11-16 13:13:04 -08:00
Varun Sharma	c7b5834cda	Update README.md	2023-11-16 13:01:09 -08:00
Varun Sharma	eb238b55ef	Release v2.6.1 (#356 )	2023-11-16 12:43:19 -08:00
dependabot[bot]	4b019e4301	Bump actions/dependency-review-action from 3.1.0 to 3.1.3 Bumps [actions/dependency-review-action](https://github.com/actions/dependency-review-action) from 3.1.0 to 3.1.3. - [Release notes](https://github.com/actions/dependency-review-action/releases) - [Commits](https://github.com/actions/dependency-review-action/compare/6c5ccdad469c9f8a2996bfecaec55a631a347034...7bbfa034e752445ea40215fff1c3bf9597993d3f) --- updated-dependencies: - dependency-name: actions/dependency-review-action dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>	2023-11-13 23:38:15 +00:00