Introduce GitHub Actions step-security/harden-runner step
#1063
Conversation
|
Looks good. No mutations were possible for these changes. |
2 similar comments
|
Looks good. No mutations were possible for these changes. |
|
Looks good. No mutations were possible for these changes. |
Stephan202
force-pushed
the
sschroevers/harden-runner
branch
from
58d59b8 to
ae8cc49
Compare
Stephan202
changed the title
step-security/harden-runner step in audit modestep-security/harden-runner step
|
Looks good. No mutations were possible for these changes. |
| - name: Install Harden-Runner | ||
| uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0 | ||
| with: | ||
| disable-sudo: true | ||
| egress-policy: block | ||
| allowed-endpoints: > | ||
| api.adoptium.net:443 | ||
| api.github.com:443 | ||
| bestpractices.coreinfrastructure.org:443 | ||
| blog.picnic.nl:443 | ||
| errorprone.info:443 | ||
| github.com:443 | ||
| img.shields.io:443 | ||
| index.rubygems.org:443 | ||
| jitpack.io:443 | ||
| maven.apache.org:443 | ||
| objects.githubusercontent.com:443 | ||
| pitest.org:443 | ||
| repo.maven.apache.org:443 | ||
| rubygems.org:443 | ||
| search.maven.org:443 | ||
| securityscorecards.dev:443 | ||
| sonarcloud.io:443 | ||
| www.baeldung.com:443 | ||
| www.bestpractices.dev:443 | ||
| www.youtube.com:443 | ||
| youtrack.jetbrains.com:443 |
There was a problem hiding this comment.
Quite a large list because of htmlproofer. While testing I did notice that when executed from a GitHub server (not locally), StackOverflow returns a 403. So I excluded that domain.
| - name: Install Harden-Runner | ||
| uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0 | ||
| with: | ||
| # XXX: Replace with `block` policy. | ||
| egress-policy: audit |
There was a problem hiding this comment.
Here and below: to be updated once we triggered these jobs from master. Easiest way to test.
rickie
force-pushed
the
sschroevers/harden-runner
branch
from
ae8cc49 to
e91dcc5
Compare
|
Looks good. No mutations were possible for these changes. |
|
Discussed offline: some of these we may follow-up on, others we've covered through other means. But for now we wish to merge the PR as-is. |
Stephan202
added
the
chore
See these steps for context. I noticed this feature when checking the Byte Buddy GHA setup.
Suggested commit message: