Skip to content

Commit 417be55

Browse files
jfagoagasjfagoagas
authored
feat(security): block mode for hardened runners (#10482)
1 parent f75ce7b commit 417be55

25 files changed

+315
-81
lines changed

‎.github/workflows/api-code-quality.yml‎

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -32,10 +32,15 @@ jobs:
3232
working-directory: ./api
3333

3434
steps:
35-
- name: Harden the runner (Audit all outbound calls)
35+
- name: Harden Runner
3636
uses: step-security/harden-runner@fa2e9d605c4eeb9fcad4c99c224cee0c6c7f3594 # v2.16.0
3737
with:
38-
egress-policy: audit
38+
egress-policy: block
39+
allowed-endpoints: >
40+
github.com:443
41+
pypi.org:443
42+
files.pythonhosted.org:443
43+
api.github.com:443
3944
4045
- name: Checkout repository
4146
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

‎.github/workflows/api-codeql.yml‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -41,10 +41,14 @@ jobs:
4141
- 'python'
4242

4343
steps:
44-
- name: Harden the runner (Audit all outbound calls)
44+
- name: Harden Runner
4545
uses: step-security/harden-runner@fa2e9d605c4eeb9fcad4c99c224cee0c6c7f3594 # v2.16.0
4646
with:
47-
egress-policy: audit
47+
egress-policy: block
48+
allowed-endpoints: >
49+
github.com:443
50+
api.github.com:443
51+
uploads.github.com:443
4852
4953
- name: Checkout repository
5054
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

‎.github/workflows/api-container-build-push.yml‎

Lines changed: 32 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -43,10 +43,10 @@ jobs:
4343
permissions:
4444
contents: read
4545
steps:
46-
- name: Harden the runner (Audit all outbound calls)
46+
- name: Harden Runner
4747
uses: step-security/harden-runner@fa2e9d605c4eeb9fcad4c99c224cee0c6c7f3594 # v2.16.0
4848
with:
49-
egress-policy: audit
49+
egress-policy: block
5050

5151
- name: Calculate short SHA
5252
id: set-short-sha
@@ -62,10 +62,10 @@ jobs:
6262
permissions:
6363
contents: read
6464
steps:
65-
- name: Harden the runner (Audit all outbound calls)
65+
- name: Harden Runner
6666
uses: step-security/harden-runner@fa2e9d605c4eeb9fcad4c99c224cee0c6c7f3594 # v2.16.0
6767
with:
68-
egress-policy: audit
68+
egress-policy: block
6969

7070
- name: Checkout repository
7171
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
@@ -105,10 +105,24 @@ jobs:
105105
packages: write
106106

107107
steps:
108-
- name: Harden the runner (Audit all outbound calls)
108+
- name: Harden Runner
109109
uses: step-security/harden-runner@fa2e9d605c4eeb9fcad4c99c224cee0c6c7f3594 # v2.16.0
110110
with:
111-
egress-policy: audit
111+
egress-policy: block
112+
allowed-endpoints: >
113+
github.com:443
114+
registry-1.docker.io:443
115+
auth.docker.io:443
116+
production.cloudflare.docker.com:443
117+
debian.map.fastlydns.net:80
118+
release-assets.githubusercontent.com:443
119+
pypi.org:443
120+
files.pythonhosted.org:443
121+
www.powershellgallery.com:443
122+
aka.ms:443
123+
cdn.powershellgallery.com:443
124+
_http._tcp.deb.debian.org:443
125+
powershellinfraartifacts-gkhedzdeaghdezhr.z01.azurefd.net:443
112126
113127
- name: Checkout repository
114128
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
@@ -152,11 +166,16 @@ jobs:
152166
contents: read
153167

154168
steps:
155-
- name: Harden the runner (Audit all outbound calls)
169+
- name: Harden Runner
156170
uses: step-security/harden-runner@fa2e9d605c4eeb9fcad4c99c224cee0c6c7f3594 # v2.16.0
157171
with:
158-
egress-policy: audit
159-
172+
egress-policy: block
173+
allowed-endpoints: >
174+
github.com:443
175+
release-assets.githubusercontent.com:443
176+
registry-1.docker.io:443
177+
auth.docker.io:443
178+
production.cloudflare.docker.com:443
160179
- name: Login to DockerHub
161180
uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
162181
with:
@@ -257,10 +276,12 @@ jobs:
257276
contents: read
258277

259278
steps:
260-
- name: Harden the runner (Audit all outbound calls)
279+
- name: Harden Runner
261280
uses: step-security/harden-runner@fa2e9d605c4eeb9fcad4c99c224cee0c6c7f3594 # v2.16.0
262281
with:
263-
egress-policy: audit
282+
egress-policy: block
283+
allowed-endpoints: >
284+
api.github.com:443
264285
265286
- name: Trigger API deployment
266287
uses: peter-evans/repository-dispatch@28959ce8df70de7be546dd1250a005dd32156697 # v4.0.1

‎.github/workflows/api-container-checks.yml‎

Lines changed: 24 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -27,10 +27,12 @@ jobs:
2727
contents: read
2828

2929
steps:
30-
- name: Harden the runner (Audit all outbound calls)
30+
- name: Harden Runner
3131
uses: step-security/harden-runner@fa2e9d605c4eeb9fcad4c99c224cee0c6c7f3594 # v2.16.0
3232
with:
33-
egress-policy: audit
33+
egress-policy: block
34+
allowed-endpoints: >
35+
github.com:443
3436
3537
- name: Checkout repository
3638
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
@@ -70,10 +72,28 @@ jobs:
7072
pull-requests: write
7173

7274
steps:
73-
- name: Harden the runner (Audit all outbound calls)
75+
- name: Harden Runner
7476
uses: step-security/harden-runner@fa2e9d605c4eeb9fcad4c99c224cee0c6c7f3594 # v2.16.0
7577
with:
76-
egress-policy: audit
78+
egress-policy: block
79+
allowed-endpoints: >
80+
api.github.com:443
81+
mirror.gcr.io:443
82+
check.trivy.dev:443
83+
github.com:443
84+
registry-1.docker.io:443
85+
auth.docker.io:443
86+
production.cloudflare.docker.com:443
87+
debian.map.fastlydns.net:80
88+
release-assets.githubusercontent.com:443
89+
pypi.org:443
90+
files.pythonhosted.org:443
91+
www.powershellgallery.com:443
92+
aka.ms:443
93+
cdn.powershellgallery.com:443
94+
_http._tcp.deb.debian.org:443
95+
powershellinfraartifacts-gkhedzdeaghdezhr.z01.azurefd.net:443
96+
7797
7898
- name: Checkout repository
7999
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

‎.github/workflows/api-security.yml‎

Lines changed: 10 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -32,10 +32,18 @@ jobs:
3232
working-directory: ./api
3333

3434
steps:
35-
- name: Harden the runner (Audit all outbound calls)
35+
- name: Harden Runner
3636
uses: step-security/harden-runner@fa2e9d605c4eeb9fcad4c99c224cee0c6c7f3594 # v2.16.0
3737
with:
38-
egress-policy: audit
38+
egress-policy: block
39+
allowed-endpoints: >
40+
pypi.org:443
41+
files.pythonhosted.org:443
42+
github.com:443
43+
auth.safetycli.com:443
44+
pyup.io:443
45+
data.safetycli.com:443
46+
api.github.com:443
3947
4048
- name: Checkout repository
4149
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

‎.github/workflows/api-tests.yml‎

Lines changed: 13 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -75,10 +75,21 @@ jobs:
7575
--health-retries 5
7676
7777
steps:
78-
- name: Harden the runner (Audit all outbound calls)
78+
- name: Harden Runner
7979
uses: step-security/harden-runner@fa2e9d605c4eeb9fcad4c99c224cee0c6c7f3594 # v2.16.0
8080
with:
81-
egress-policy: audit
81+
egress-policy: block
82+
allowed-endpoints: >
83+
github.com:443
84+
pypi.org:443
85+
files.pythonhosted.org:443
86+
cli.codecov.io:443
87+
keybase.io:443
88+
ingest.codecov.io:443
89+
storage.googleapis.com:443
90+
o26192.ingest.us.sentry.io:443
91+
api.github.com:443
92+
8293
8394
- name: Checkout repository
8495
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

‎.github/workflows/backport.yml‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -27,10 +27,12 @@ jobs:
2727
pull-requests: write
2828

2929
steps:
30-
- name: Harden the runner (Audit all outbound calls)
30+
- name: Harden Runner
3131
uses: step-security/harden-runner@fa2e9d605c4eeb9fcad4c99c224cee0c6c7f3594 # v2.16.0
3232
with:
33-
egress-policy: audit
33+
egress-policy: block
34+
allowed-endpoints: >
35+
api.github.com:443
3436
3537
- name: Check labels
3638
id: label_check

‎.github/workflows/ci-zizmor.yml‎

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -33,10 +33,15 @@ jobs:
3333
actions: read
3434

3535
steps:
36-
- name: Harden the runner (Audit all outbound calls)
36+
- name: Harden Runner
3737
uses: step-security/harden-runner@fa2e9d605c4eeb9fcad4c99c224cee0c6c7f3594 # v2.16.0
3838
with:
39-
egress-policy: audit
39+
egress-policy: block
40+
allowed-endpoints: >
41+
github.com:443
42+
ghcr.io:443
43+
pkg-containers.githubusercontent.com:443
44+
api.github.com:443
4045
4146
- name: Checkout repository
4247
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

‎.github/workflows/find-secrets.yml‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -22,10 +22,14 @@ jobs:
2222
contents: read
2323

2424
steps:
25-
- name: Harden the runner (Audit all outbound calls)
25+
- name: Harden Runner
2626
uses: step-security/harden-runner@fa2e9d605c4eeb9fcad4c99c224cee0c6c7f3594 # v2.16.0
2727
with:
28-
egress-policy: audit
28+
egress-policy: block
29+
allowed-endpoints: >
30+
github.com:443
31+
ghcr.io:443
32+
pkg-containers.githubusercontent.com:443
2933
3034
- name: Checkout repository
3135
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

‎.github/workflows/mcp-container-build-push.yml‎

Lines changed: 25 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -42,10 +42,10 @@ jobs:
4242
permissions:
4343
contents: read
4444
steps:
45-
- name: Harden the runner (Audit all outbound calls)
45+
- name: Harden Runner
4646
uses: step-security/harden-runner@fa2e9d605c4eeb9fcad4c99c224cee0c6c7f3594 # v2.16.0
4747
with:
48-
egress-policy: audit
48+
egress-policy: block
4949

5050
- name: Calculate short SHA
5151
id: set-short-sha
@@ -103,10 +103,19 @@ jobs:
103103
contents: read
104104
packages: write
105105
steps:
106-
- name: Harden the runner (Audit all outbound calls)
106+
- name: Harden Runner
107107
uses: step-security/harden-runner@fa2e9d605c4eeb9fcad4c99c224cee0c6c7f3594 # v2.16.0
108108
with:
109-
egress-policy: audit
109+
egress-policy: block
110+
allowed-endpoints: >
111+
github.com:443
112+
registry-1.docker.io:443
113+
auth.docker.io:443
114+
production.cloudflare.docker.com:443
115+
ghcr.io:443
116+
pkg-containers.githubusercontent.com:443
117+
files.pythonhosted.org:443
118+
pypi.org:443
110119
111120
- name: Checkout repository
112121
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
@@ -152,10 +161,16 @@ jobs:
152161
contents: read
153162

154163
steps:
155-
- name: Harden the runner (Audit all outbound calls)
164+
- name: Harden Runner
156165
uses: step-security/harden-runner@fa2e9d605c4eeb9fcad4c99c224cee0c6c7f3594 # v2.16.0
157166
with:
158-
egress-policy: audit
167+
egress-policy: block
168+
allowed-endpoints: >
169+
registry-1.docker.io:443
170+
auth.docker.io:443
171+
production.cloudflare.docker.com:443
172+
github.com:443
173+
release-assets.githubusercontent.com:443
159174
160175
- name: Login to DockerHub
161176
uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
@@ -257,10 +272,12 @@ jobs:
257272
contents: read
258273

259274
steps:
260-
- name: Harden the runner (Audit all outbound calls)
275+
- name: Harden Runner
261276
uses: step-security/harden-runner@fa2e9d605c4eeb9fcad4c99c224cee0c6c7f3594 # v2.16.0
262277
with:
263-
egress-policy: audit
278+
egress-policy: block
279+
allowed-endpoints: >
280+
api.github.com:443
264281
265282
- name: Trigger MCP deployment
266283
uses: peter-evans/repository-dispatch@28959ce8df70de7be546dd1250a005dd32156697 # v4.0.1

0 commit comments

Comments
 (0)