update agent

.github/workflows/code-review.yml

@@ -0,0 +1,23 @@
+name: Code Review
+on:
+  pull_request:
+permissions:
+  contents: read
+jobs:
+  code-review:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: read
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@5c7944e73c4c2a096b17a9cb74d65b6c2bbafbde # v2.9.1
+        with:
+          disable-sudo: true
+          egress-policy: block
+          allowed-endpoints: >
+            api.github.com:443
+            int.api.stepsecurity.io:443
+
+      - name: Code Review
+        uses: step-security/ai-codewise@int

.github/workflows/runs-on.yml

@@ -2,8 +2,7 @@ name: RunsOn Tests
 
 on: 
   workflow_dispatch:
-  pull_request:
-  
+
 permissions:
   contents: read
 
@@ -12,7 +11,7 @@ jobs:
     runs-on:
       - runs-on=${{ github.run_id }}
       - runner=2cpu-linux-x64
-      - image=ubuntu22-stepsecurity-x64
+      - image=ubuntu24-stepsecurity-x64
     steps:
       - name: Harden Runner
         uses: step-security/harden-runner@rc
@@ -41,7 +40,7 @@ jobs:
     runs-on:
       - runs-on=${{ github.run_id }}
       - runner=2cpu-linux-x64
-      - image=ubuntu22-stepsecurity-x64
+      - image=ubuntu24-stepsecurity-x64
     steps:
       - name: Harden Runner
         uses: step-security/harden-runner@rc

.github/workflows/test.yml

@@ -44,32 +44,3 @@ jobs:
         with:
           files: |
             reports/*.xml
-
-  build-check:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Harden Runner
-        uses: step-security/harden-runner@5c7944e73c4c2a096b17a9cb74d65b6c2bbafbde # v2.9.1
-        with:
-          disable-sudo: true
-          egress-policy: audit
-          allowed-endpoints: >
-            github.com:443
-            registry.npmjs.org:443
-
-      - name: Checkout
-        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
-      - name: Install Dependencies
-        run: npm ci
-      - name: Run build
-        run: npm run build
-      - name: Check for changes in dist
-        run: |
-          if [[ `git status --porcelain dist` ]]; then
-            echo "Changes detected in dist directory after build:"
-            git status --porcelain dist
-            git diff dist
-            exit 1
-          else
-            echo "No changes in dist directory - build is clean"
-          fi

README.md

@@ -24,14 +24,12 @@ StepSecurity Harden-Runner addresses this gap by providing security monitoring t
 
 - [Harden-Runner Detected the tj-actions/changed-files compromise](https://www.stepsecurity.io/blog/harden-runner-detection-tj-actions-changed-files-action-is-compromised) ([CVE-2025-30066](https://github.com/advisories/GHSA-mrrh-fwg8-r2c3))
 - [Harden-Runner Detected a CI/CD Supply Chain Attack in Google’s Open-Source Project Flank](https://www.stepsecurity.io/case-studies/flank)
-- [Harden-Runner Detected the NX Build System compromise](https://www.stepsecurity.io/blog/supply-chain-security-alert-popular-nx-build-system-package-compromised-with-data-stealing-malware)
 - [Harden-Runner Detected a CI/CD Supply Chain Attack in Microsoft’s Open-Source Project Azure Karpenter Provider in Real-Time](https://www.stepsecurity.io/case-studies/azure-karpenter-provider)
 - [Harden-Runner Detected Anomalous Traffic to api.ipify.org Across Multiple Customers](https://www.stepsecurity.io/blog/harden-runner-detects-anomalous-traffic-to-api-ipify-org-across-multiple-customers)  
-- [Harden-Runner Detected an Unexpected Microsoft Defender Installation on GitHub-Hosted Ubuntu Runners](https://www.stepsecurity.io/blog/how-stepsecurity-harden-runner-detected-unexpected-microsoft-defender-installation-on-github-hosted-ubuntu-runners)
-- [Harden-Runner Flagged an Anomalous Outbound Call, Leading to a Docker Documentation Update](https://www.stepsecurity.io/blog/harden-runner-flags-anomalous-outbound-call-leading-to-docker-documentation-update)
+- [Harden-Runner Flagged an Anomalous Outbound Call, Leading to a Docker Documentation Update](https://www.stepsecurity.io/blog/harden-runner-flags-anomalous-outbound-call-leading-to-docker-documentation-update)  
 
 ### See It in Action
-Harden-Runner secures over **8 million CI/CD workflow runs every week**, protecting thousands of pipelines, including those from popular open-source projects by **Microsoft, Google, and CISA**. See how top projects are using Harden-Runner and explore the insights:  
+Harden-Runner secures over **a million CI/CD workflow runs every week**, protecting thousands of pipelines, including those from popular open-source projects by **Microsoft, Google, and CISA**. See how top projects are using Harden-Runner and explore the insights:  
 ➡️ [Who's using Harden-Runner?](https://docs.stepsecurity.io/whos-using-harden-runner)
 
 ## Quick Links
@@ -137,7 +135,7 @@ Explore the full feature set in the [Features Documentation](https://docs.stepse
 
 ## Trusted By and Case Studies
 
-Harden-Runner is trusted by over 8000 leading open-source projects and enterprises, including Microsoft, Google, Kubernetes, and more.
+Harden-Runner is trusted by over 6000 leading open-source projects and enterprises, including Microsoft, Google, Kubernetes, and more.
 
 ### Trusted by
 

package.json

@@ -26,7 +26,7 @@
     "@actions/cache": "^4.0.0",
     "@actions/core": "^1.5.0",
     "@actions/exec": "^1.1.0",
-    "@actions/github": "^6.0.1",
+    "@actions/github": "^5.0.0",
     "@actions/http-client": "^2.0.1",
     "@actions/tool-cache": "^1.7.1",
     "@babel/helpers": "^7.26.10",
@@ -40,7 +40,7 @@
     "@types/node": "^16.9.0",
     "@typescript-eslint/eslint-plugin": "^6.1.0",
     "@typescript-eslint/parser": "^6.1.0",
-    "@vercel/ncc": "^0.38.3",
+    "@vercel/ncc": "^0.30.0",
     "eslint": "^7.32.0",
     "eslint-config-google": "^0.14.0",
     "jest": "^29.3.1",

src/checksum.ts

@@ -4,8 +4,8 @@ import * as fs from "fs";
 
 const CHECKSUMS = {
   tls: {
-    amd64: "2430b850e0e4d67a2f3b626f02d2827226ee16406da6af0c47ae7b18e18bd2b8", // v1.6.23
-    arm64: "a3c89271e697ab39557ba8011cac7a2df690b5d27b4584d5d5abdf8845a6ce6c",
+    amd64: "5c02a40df6e2c926c92ffc6bf02ca8a301649d44541ca57e40a87948fb0d3f2e", // v1.6.18
+    arm64: "b953784a468343c44a1a3ef4ec984c738a9a1e84aaf6932a2bb9dbf7ac7eab29",
   },
   non_tls: {
     amd64: "336093af8ebe969567b66fd035af3bd4f7e1c723ce680d6b4b5b2a1f79bc329e", // v0.14.2

src/common.ts

@@ -1,6 +1,6 @@
 import * as core from "@actions/core";
 import * as fs from "fs";
-import { STEPSECURITY_API_URL, STEPSECURITY_WEB_URL } from "./configs";
+import { STEPSECURITY_WEB_URL } from "./configs";
 
 export function printInfo(web_url) {
   console.log(
@@ -59,12 +59,14 @@ export async function addSummary() {
     return;
   }
 
-  const correlation_id = process.env.STATE_correlation_id;
-  if (!correlation_id) {
+  const web_url = STEPSECURITY_WEB_URL;
+  const insights_url = `${web_url}/github/${process.env["GITHUB_REPOSITORY"]}/actions/runs/${process.env["GITHUB_RUN_ID"]}`;
+
+  const log = "/home/agent/agent.log";
+  if (!fs.existsSync(log)) {
     return;
   }
 
-
   let needsSubscription = false;
   try {
     let data = fs.readFileSync("/home/agent/annotation.log", "utf8");
@@ -94,33 +96,73 @@ export async function addSummary() {
     return;
   }
 
-  // Extract owner and repo from GITHUB_REPOSITORY (format: owner/repo)
-  const [owner, repo] = process.env["GITHUB_REPOSITORY"]?.split("/") || [];
-  const run_id = process.env["GITHUB_RUN_ID"];
-  
-  if (!owner || !repo || !run_id || !correlation_id) {
+  const content = fs.readFileSync(log, "utf-8");
+  const lines = content.split("\n");
+
+  let tableEntries = [];
+
+  for (const line of lines) {
+    processLogLine(line, tableEntries);
+  }
+
+  if (tableEntries.length === 0) {
     return;
   }
 
-  // Fetch job summary from API
-  const apiUrl = `${STEPSECURITY_API_URL}/github/${owner}/${repo}/actions/runs/${run_id}/correlation/${correlation_id}/job-markdown-summary`;
-  
-  try {
-    const response = await fetch(apiUrl);
-    if (!response.ok) {
-      console.error(`Failed to fetch job summary: ${response.status} ${response.statusText}`);
-      return;
+  const insightsRow = `<p><b><a href="${insights_url}">📄 View Full Report</a></b></p>`;
+
+  await core.summary.addSeparator().addRaw(`<h2>🛡 StepSecurity Report</h2>`);
+
+  tableEntries.sort((a, b) => {
+    if (a.status === "❌ Blocked" && b.status !== "❌ Blocked") {
+      return -1;
+    } else if (a.status !== "❌ Blocked" && b.status === "❌ Blocked") {
+      return 1;
+    } else {
+      return 0;
     }
-    
-    const markdownSummary = await response.text();
-    
-    // Render the markdown summary using core.summary.addRaw
-    await core.summary.addRaw(markdownSummary).write();
-    return;
-  } catch (error) {
-    console.error(`Error fetching job summary: ${error}`);
-    return;
-  }
+  });
+
+  tableEntries = tableEntries.slice(0, 3);
+
+  await core.summary.addRaw(`
+  <blockquote>
+  <p>Preview of the outbound network calls during this workflow run.</p></blockquote>
+  <h3>Network Calls</h3>
+  <table>
+    <thead>
+      <tr>
+        <th>Process</th>
+        <th>Destination</th>
+        <th>Status</th>
+      </tr>
+    </thead>
+    <tbody>
+      ${tableEntries
+        .map(
+          (entry) => `<tr>
+          <td><code>${entry.process}</code></td>
+          <td>${entry.domain.replace(/\.$/, "")}</td>
+          <td>${entry.status}</td>
+        </tr>`
+        )
+        .join("")}
+      <tr>
+        <td><code>...</code></td>
+        <td><code>...</code></td>
+        <td><code>...</code></td>
+      </tr>
+    </tbody>
+  </table>
+  ${insightsRow}
+`);
+
+  await core.summary
+    .addRaw(
+      `<p><i>Markdown generated by the <a href="https://github.com/step-security/harden-runner">Harden-Runner GitHub Action</a>.</i></p>`
+    )
+    .addSeparator()
+    .write();
 }
 
 export const STATUS_HARDEN_RUNNER_UNAVAILABLE = "409";

src/install-agent.ts

@@ -25,9 +25,7 @@ export async function installAgent(
 
   if (isTLS) {
     downloadPath = await tc.downloadTool(
-      `https://github.com/step-security/agent-ebpf/releases/download/v1.6.23/harden-runner_1.6.23_linux_${variant}.tar.gz`,
-      undefined,
-      auth
+      `https://packages.stepsecurity.io/github-hosted/harden-runner_1.6.18_linux_${variant}.tar.gz`
     );
   } else {
     if (variant === "arm64") {

src/policy-utils.ts

@@ -39,12 +39,7 @@ export async function fetchPolicy(
   }
 
   if (response === undefined && err !== undefined) {
-    // Preserve the original error's statusCode if it exists
-    const error = new Error(`[Policy Fetch] ${err}`);
-    if (err.statusCode !== undefined) {
-      (error as any).statusCode = err.statusCode;
-    }
-    throw error;
+    throw new Error(`[Policy Fetch] ${err}`);
   } else {
     return response.result;
   }
@@ -75,7 +70,7 @@ export function mergeConfigs(
   return localConfig;
 }
 
-function sleep(ms: number) {
+function sleep(ms) {
   return new Promise((resolve) => {
     setTimeout(resolve, ms);
   });

src/setup.ts

@@ -85,18 +85,7 @@ interface MonitorResponse {
         confg = mergeConfigs(confg, result);
       } catch (err) {
         core.info(`[!] ${err}`);
-        // Only fail the job if ID token is not available
-        if (err.message && err.message.includes('Unable to get ACTIONS_ID_TOKEN_REQUEST')) {
-          core.setFailed('Policy store requires id-token write permission as it uses OIDC to fetch the policy from StepSecurity API. Please add "id-token: write" to your job permissions.');
-        } else {
-          // Handle different HTTP status codes
-          if (err.statusCode >= 400 && err.statusCode < 500) {
-            core.error('Policy not found');
-          } else {
-            core.error(`Unexpected error occurred: ${err}. Falling back to egress policy audit`);
-            confg.egress_policy = 'audit';
-          }
-        }
+        core.setFailed(err);
       }
     }
     fs.appendFileSync(
@@ -244,7 +233,7 @@ interface MonitorResponse {
     }
 
     let _http = new httpm.HttpClient();
-    let statusCode: number | undefined;
+    let statusCode;
     _http.requestOptions = { socketTimeout: 3 * 1000 };
     let addSummary = "false";
     try {
@@ -282,13 +271,6 @@ interface MonitorResponse {
         encoding: "utf8",
       }
     );
-    fs.appendFileSync(
-      process.env.GITHUB_STATE,
-      `correlation_id=${correlation_id}${EOL}`,
-      {
-        encoding: "utf8",
-      }
-    );
 
     console.log(`Step Security Job Correlation ID: ${correlation_id}`);
     if (String(statusCode) === common.STATUS_HARDEN_RUNNER_UNAVAILABLE) {
@@ -337,7 +319,7 @@ interface MonitorResponse {
   process.exit(0);
 })();
 
-export function sleep(ms: number) {
+export function sleep(ms) {
   return new Promise((resolve) => {
     setTimeout(resolve, ms);
   });