step-security/harden-runner
1
0
Fork 0
mirror of synced 2026-06-05 15:05:14 +00:00
Code Issues Projects Releases Packages Wiki Activity

Release v2.15.1 (#641)

Browse source
This commit is contained in:
Varun Sharma 2026-03-05 13:02:45 -08:00 • committed by GitHub
commit 58077d3c7e
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
12 changed files with 274 additions and 355 deletions
Download patch file Download diff file Expand all files Collapse all files

7
README.md
View file

@ -19,7 +19,7 @@ Corporate laptops and production servers typically have robust security monitori
Traditional security monitoring and EDR solutions are ineffective for CI/CD runners due to their ephemeral nature. These tools also lack the necessary context to correlate events with specific workflow runs in a CI/CD environment. Traditional security monitoring and EDR solutions are ineffective for CI/CD runners due to their ephemeral nature. These tools also lack the necessary context to correlate events with specific workflow runs in a CI/CD environment.
StepSecurity Harden-Runner addresses this gap by providing security monitoring tailored for CI/CD runners. This approach brings CI/CD runners under the same level of security scrutiny as other critical systems, addressing a significant gap in the software supply chain. StepSecurity Harden-Runner addresses this gap by providing security monitoring tailored for CI/CD runners, with support for Linux, Windows, and macOS runners. This approach brings CI/CD runners under the same level of security scrutiny as other critical systems, addressing a significant gap in the software supply chain.
### Harden-Runner: Security Incidents Detected ### Harden-Runner: Security Incidents Detected
- [Harden-Runner Detected the tj-actions/changed-files compromise](https://www.stepsecurity.io/blog/harden-runner-detection-tj-actions-changed-files-action-is-compromised) ([CVE-2025-30066](https://github.com/advisories/GHSA-mrrh-fwg8-r2c3)) - [Harden-Runner Detected the tj-actions/changed-files compromise](https://www.stepsecurity.io/blog/harden-runner-detection-tj-actions-changed-files-action-is-compromised) ([CVE-2025-30066](https://github.com/advisories/GHSA-mrrh-fwg8-r2c3))
@ -138,7 +138,7 @@ Explore the full feature set in the [Features Documentation](https://docs.stepse
## Trusted By and Case Studies ## Trusted By and Case Studies
Harden-Runner is trusted by over 8000 leading open-source projects and enterprises, including Microsoft, Google, Kubernetes, and more. Harden-Runner is trusted by over 11,000 leading open-source projects and enterprises, including Microsoft, Google, Kubernetes, and more.
### Trusted by ### Trusted by
@ -163,7 +163,8 @@ Harden-Runner is designed to work seamlessly across a variety of runner environm
| Environment Type | Compatibility | Audit Mode Deployment | Workflow Changes for Audit Mode | | Environment Type | Compatibility | Audit Mode Deployment | Workflow Changes for Audit Mode |
|------------------|---------------|--------------------------|-------------------| |------------------|---------------|--------------------------|-------------------|
| GitHub-hosted runners | ✅ Full support | Add Harden-Runner Action to workflow | Yes | | GitHub-hosted runners (Linux) | ✅ Full support | Add Harden-Runner Action to workflow | Yes |
| GitHub-hosted runners (Windows, macOS) | ✅ Audit mode only | Add Harden-Runner Action to workflow | Yes |
| Self-hosted VM runners | ✅ Full support | Include agent in runner image | No | | Self-hosted VM runners | ✅ Full support | Include agent in runner image | No |
| Self-hosted bare-metal runners | ✅ Full support | Install agent as a service | No | | Self-hosted bare-metal runners | ✅ Full support | Install agent as a service | No |
| Actions Runner Controller (ARC) | ✅ Full support | Deploy as DaemonSet | No | | Actions Runner Controller (ARC) | ✅ Full support | Deploy as DaemonSet | No |

1
dist/index.js vendored
View file

@ -32029,6 +32029,7 @@ const SELF_HOSTED_RUNNER_MESSAGE = "This job is running on a self-hosted runner.
const HARDEN_RUNNER_UNAVAILABLE_MESSAGE = "Sorry, we are currently experiencing issues with the Harden Runner installation process. It is currently unavailable."; const HARDEN_RUNNER_UNAVAILABLE_MESSAGE = "Sorry, we are currently experiencing issues with the Harden Runner installation process. It is currently unavailable.";
const ARC_RUNNER_MESSAGE = "Workflow is currently being executed in ARC based runner."; const ARC_RUNNER_MESSAGE = "Workflow is currently being executed in ARC based runner.";
const ARM64_RUNNER_MESSAGE = "ARM runners are not supported in the Harden-Runner community tier."; const ARM64_RUNNER_MESSAGE = "ARM runners are not supported in the Harden-Runner community tier.";
const ARM64_WINDOWS_RUNNER_MESSAGE = "Windows ARM runners are not yet supported by Harden-Runner.";
;// CONCATENATED MODULE: external "node:fs" ;// CONCATENATED MODULE: external "node:fs"
const external_node_fs_namespaceObject = require("node:fs"); const external_node_fs_namespaceObject = require("node:fs");

2
dist/index.js.map vendored
View file

File diff suppressed because one or more lines are too long

5
dist/post/index.js vendored
View file

@ -32034,6 +32034,7 @@ const SELF_HOSTED_RUNNER_MESSAGE = "This job is running on a self-hosted runner.
const HARDEN_RUNNER_UNAVAILABLE_MESSAGE = "Sorry, we are currently experiencing issues with the Harden Runner installation process. It is currently unavailable."; const HARDEN_RUNNER_UNAVAILABLE_MESSAGE = "Sorry, we are currently experiencing issues with the Harden Runner installation process. It is currently unavailable.";
const ARC_RUNNER_MESSAGE = "Workflow is currently being executed in ARC based runner."; const ARC_RUNNER_MESSAGE = "Workflow is currently being executed in ARC based runner.";
const ARM64_RUNNER_MESSAGE = "ARM runners are not supported in the Harden-Runner community tier."; const ARM64_RUNNER_MESSAGE = "ARM runners are not supported in the Harden-Runner community tier.";
const ARM64_WINDOWS_RUNNER_MESSAGE = "Windows ARM runners are not yet supported by Harden-Runner.";
// EXTERNAL MODULE: external "path" // EXTERNAL MODULE: external "path"
var external_path_ = __nccwpck_require__(6928); var external_path_ = __nccwpck_require__(6928);
@ -32350,6 +32351,10 @@ function handleWindowsCleanup() {
console.log("Windows post step already executed, skipping"); console.log("Windows post step already executed, skipping");
return; return;
} }
if (process.arch === "arm64") {
console.log(ARM64_WINDOWS_RUNNER_MESSAGE);
return;
}
const p = external_child_process_.spawn("powershell.exe", [ const p = external_child_process_.spawn("powershell.exe", [
"-NoProfile", "-NoProfile",
"-NonInteractive", "-NonInteractive",

2
dist/post/index.js.map vendored
View file

File diff suppressed because one or more lines are too long

471
dist/pre/index.js vendored
View file

File diff suppressed because one or more lines are too long

2
dist/pre/index.js.map vendored
View file

File diff suppressed because one or more lines are too long

4
osv-scanner.toml
View file

@ -9,3 +9,7 @@ reason = "Untrusted headers are not processed"
[[IgnoredVulns]] [[IgnoredVulns]]
id = "GHSA-xx4v-prfh-6cgc" id = "GHSA-xx4v-prfh-6cgc"
reason = "Untrusted headers are not processed" reason = "Untrusted headers are not processed"
[[IgnoredVulns]]
id = "GHSA-g9mf-h72j-4rw9"
reason = "undici fetch() is only used to call GitHub API; exploitation requires a malicious server"

127
package-lock.json generated
View file

@ -2673,10 +2673,11 @@
} }
}, },
"node_modules/ajv": { "node_modules/ajv": {
"version": "6.12.6", "version": "6.14.0",
"resolved": "https://registry.npmjs.org/ajv/-/ajv-6.12.6.tgz", "resolved": "https://registry.npmjs.org/ajv/-/ajv-6.14.0.tgz",
"integrity": "sha512-j3fVLgvTo527anyYyJOGTYJbG+vnnQYvE0m5mmkc1TK+nxAppkCLMIL0aZ4dblVCNoGShhm+kzE4ZUykBoMg4g==", "integrity": "sha512-IWrosm/yrn43eiKqkfkHis7QioDleaXQHdDVPKg0FSwwd/DuvyX79TZnFOnYpB7dcsFAMmtFztZuXPDvSePkFw==",
"dev": true, "dev": true,
"license": "MIT",
"dependencies": { "dependencies": {
"fast-deep-equal": "^3.1.1", "fast-deep-equal": "^3.1.1",
"fast-json-stable-stringify": "^2.0.0", "fast-json-stable-stringify": "^2.0.0",
@ -3746,18 +3747,49 @@
"integrity": "sha1-PYpcZog6FqMMqGQ+hR8Zuqd5eRc=", "integrity": "sha1-PYpcZog6FqMMqGQ+hR8Zuqd5eRc=",
"dev": true "dev": true
}, },
"node_modules/fast-xml-parser": { "node_modules/fast-uri": {
"version": "5.0.9", "version": "3.1.0",
"resolved": "https://registry.npmjs.org/fast-xml-parser/-/fast-xml-parser-5.0.9.tgz", "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.0.tgz",
"integrity": "sha512-2mBwCiuW3ycKQQ6SOesSB8WeF+fIGb6I/GG5vU5/XEptwFFhp9PE8b9O7fbs2dpq9fXn4ULR3UsfydNUCntf5A==", "integrity": "sha512-iPeeDKJSWf4IEOasVVrknXpaBV0IApz/gp7S2bb7Z4Lljbl2MGJRqInZiUrQwV16cpzw/D3S5j5Julj/gT52AA==",
"dev": true,
"funding": [
{
"type": "github",
"url": "https://github.com/sponsors/fastify"
},
{
"type": "opencollective",
"url": "https://opencollective.com/fastify"
}
],
"license": "BSD-3-Clause"
},
"node_modules/fast-xml-builder": {
"version": "1.0.0",
"resolved": "https://registry.npmjs.org/fast-xml-builder/-/fast-xml-builder-1.0.0.tgz",
"integrity": "sha512-fpZuDogrAgnyt9oDDz+5DBz0zgPdPZz6D4IR7iESxRXElrlGTRkHJ9eEt+SACRJwT0FNFrt71DFQIUFBJfX/uQ==",
"funding": [ "funding": [
{ {
"type": "github", "type": "github",
"url": "https://github.com/sponsors/NaturalIntelligence" "url": "https://github.com/sponsors/NaturalIntelligence"
} }
], ],
"license": "MIT"
},
"node_modules/fast-xml-parser": {
"version": "5.4.1",
"resolved": "https://registry.npmjs.org/fast-xml-parser/-/fast-xml-parser-5.4.1.tgz",
"integrity": "sha512-BQ30U1mKkvXQXXkAGcuyUA/GA26oEB7NzOtsxCDtyu62sjGw5QraKFhx2Em3WQNjPw9PG6MQ9yuIIgkSDfGu5A==",
"funding": [
{
"type": "github",
"url": "https://github.com/sponsors/NaturalIntelligence"
}
],
"license": "MIT",
"dependencies": { "dependencies": {
"strnum": "^2.0.5" "fast-xml-builder": "^1.0.0",
"strnum": "^2.1.2"
}, },
"bin": { "bin": {
"fxparser": "src/cli/cli.js" "fxparser": "src/cli/cli.js"
@ -6178,9 +6210,10 @@
} }
}, },
"node_modules/minimatch": { "node_modules/minimatch": {
"version": "3.1.2", "version": "3.1.5",
"resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.2.tgz", "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.5.tgz",
"integrity": "sha512-J7p63hRiAjw1NDEww1W7i37+ByIrOWO5XQQAzZ3VOcL0PNybwpfmV/N05zFAzwQ9USyEcX6t3UO+K5aqBQOIHw==", "integrity": "sha512-VgjWUsnnT6n+NUk6eZq77zeFdpW2LWDzP6zFGrCbHXiYNul5Dzqk2HHQ5uFH2DNW5Xbp8+jVzaeNt94ssEEl4w==",
"license": "ISC",
"dependencies": { "dependencies": {
"brace-expansion": "^1.1.7" "brace-expansion": "^1.1.7"
}, },
@ -6933,15 +6966,16 @@
} }
}, },
"node_modules/strnum": { "node_modules/strnum": {
"version": "2.0.5", "version": "2.2.0",
"resolved": "https://registry.npmjs.org/strnum/-/strnum-2.0.5.tgz", "resolved": "https://registry.npmjs.org/strnum/-/strnum-2.2.0.tgz",
"integrity": "sha512-YAT3K/sgpCUxhxNMrrdhtod3jckkpYwH6JAuwmUdXZsmzH1wUyzTMrrK2wYCEEqlKwrWDd35NeuUkbBy/1iK+Q==", "integrity": "sha512-Y7Bj8XyJxnPAORMZj/xltsfo55uOiyHcU2tnAVzHUnSJR/KsEX+9RoDeXEnsXtl/CX4fAcrt64gZ13aGaWPeBg==",
"funding": [ "funding": [
{ {
"type": "github", "type": "github",
"url": "https://github.com/sponsors/NaturalIntelligence" "url": "https://github.com/sponsors/NaturalIntelligence"
} }
] ],
"license": "MIT"
}, },
"node_modules/supports-color": { "node_modules/supports-color": {
"version": "7.2.0", "version": "7.2.0",
@ -6984,15 +7018,16 @@
} }
}, },
"node_modules/table/node_modules/ajv": { "node_modules/table/node_modules/ajv": {
"version": "8.11.0", "version": "8.18.0",
"resolved": "https://registry.npmjs.org/ajv/-/ajv-8.11.0.tgz", "resolved": "https://registry.npmjs.org/ajv/-/ajv-8.18.0.tgz",
"integrity": "sha512-wGgprdCvMalC0BztXvitD2hC04YffAvtsUn93JbGXYLAtCUO4xd17mCCZQxUOItiBwZvJScWo8NIvQMQ71rdpg==", "integrity": "sha512-PlXPeEWMXMZ7sPYOHqmDyCJzcfNrUr3fGNKtezX14ykXOEIvyK81d+qydx89KY5O71FKMPaQ2vBfBFI5NHR63A==",
"dev": true, "dev": true,
"license": "MIT",
"dependencies": { "dependencies": {
"fast-deep-equal": "^3.1.1", "fast-deep-equal": "^3.1.3",
"fast-uri": "^3.0.1",
"json-schema-traverse": "^1.0.0", "json-schema-traverse": "^1.0.0",
"require-from-string": "^2.0.2", "require-from-string": "^2.0.2"
"uri-js": "^4.2.2"
}, },
"funding": { "funding": {
"type": "github", "type": "github",
@ -9531,9 +9566,9 @@
"integrity": "sha512-jRR5wdylq8CkOe6hei19GGZnxM6rBGwFl3Bg0YItGDimvjGtAvdZk4Pu6Cl4u4Igsws4a1fd1Vq3ezrhn4KmFw==" "integrity": "sha512-jRR5wdylq8CkOe6hei19GGZnxM6rBGwFl3Bg0YItGDimvjGtAvdZk4Pu6Cl4u4Igsws4a1fd1Vq3ezrhn4KmFw=="
}, },
"ajv": { "ajv": {
"version": "6.12.6", "version": "6.14.0",
"resolved": "https://registry.npmjs.org/ajv/-/ajv-6.12.6.tgz", "resolved": "https://registry.npmjs.org/ajv/-/ajv-6.14.0.tgz",
"integrity": "sha512-j3fVLgvTo527anyYyJOGTYJbG+vnnQYvE0m5mmkc1TK+nxAppkCLMIL0aZ4dblVCNoGShhm+kzE4ZUykBoMg4g==", "integrity": "sha512-IWrosm/yrn43eiKqkfkHis7QioDleaXQHdDVPKg0FSwwd/DuvyX79TZnFOnYpB7dcsFAMmtFztZuXPDvSePkFw==",
"dev": true, "dev": true,
"requires": { "requires": {
"fast-deep-equal": "^3.1.1", "fast-deep-equal": "^3.1.1",
@ -10329,12 +10364,24 @@
"integrity": "sha1-PYpcZog6FqMMqGQ+hR8Zuqd5eRc=", "integrity": "sha1-PYpcZog6FqMMqGQ+hR8Zuqd5eRc=",
"dev": true "dev": true
}, },
"fast-uri": {
"version": "3.1.0",
"resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.0.tgz",
"integrity": "sha512-iPeeDKJSWf4IEOasVVrknXpaBV0IApz/gp7S2bb7Z4Lljbl2MGJRqInZiUrQwV16cpzw/D3S5j5Julj/gT52AA==",
"dev": true
},
"fast-xml-builder": {
"version": "1.0.0",
"resolved": "https://registry.npmjs.org/fast-xml-builder/-/fast-xml-builder-1.0.0.tgz",
"integrity": "sha512-fpZuDogrAgnyt9oDDz+5DBz0zgPdPZz6D4IR7iESxRXElrlGTRkHJ9eEt+SACRJwT0FNFrt71DFQIUFBJfX/uQ=="
},
"fast-xml-parser": { "fast-xml-parser": {
"version": "5.0.9", "version": "5.4.1",
"resolved": "https://registry.npmjs.org/fast-xml-parser/-/fast-xml-parser-5.0.9.tgz", "resolved": "https://registry.npmjs.org/fast-xml-parser/-/fast-xml-parser-5.4.1.tgz",
"integrity": "sha512-2mBwCiuW3ycKQQ6SOesSB8WeF+fIGb6I/GG5vU5/XEptwFFhp9PE8b9O7fbs2dpq9fXn4ULR3UsfydNUCntf5A==", "integrity": "sha512-BQ30U1mKkvXQXXkAGcuyUA/GA26oEB7NzOtsxCDtyu62sjGw5QraKFhx2Em3WQNjPw9PG6MQ9yuIIgkSDfGu5A==",
"requires": { "requires": {
"strnum": "^2.0.5" "fast-xml-builder": "^1.0.0",
"strnum": "^2.1.2"
} }
}, },
"fastq": { "fastq": {
@ -12145,9 +12192,9 @@
"dev": true "dev": true
}, },
"minimatch": { "minimatch": {
"version": "3.1.2", "version": "3.1.5",
"resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.2.tgz", "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.5.tgz",
"integrity": "sha512-J7p63hRiAjw1NDEww1W7i37+ByIrOWO5XQQAzZ3VOcL0PNybwpfmV/N05zFAzwQ9USyEcX6t3UO+K5aqBQOIHw==", "integrity": "sha512-VgjWUsnnT6n+NUk6eZq77zeFdpW2LWDzP6zFGrCbHXiYNul5Dzqk2HHQ5uFH2DNW5Xbp8+jVzaeNt94ssEEl4w==",
"requires": { "requires": {
"brace-expansion": "^1.1.7" "brace-expansion": "^1.1.7"
} }
@ -12670,9 +12717,9 @@
"dev": true "dev": true
}, },
"strnum": { "strnum": {
"version": "2.0.5", "version": "2.2.0",
"resolved": "https://registry.npmjs.org/strnum/-/strnum-2.0.5.tgz", "resolved": "https://registry.npmjs.org/strnum/-/strnum-2.2.0.tgz",
"integrity": "sha512-YAT3K/sgpCUxhxNMrrdhtod3jckkpYwH6JAuwmUdXZsmzH1wUyzTMrrK2wYCEEqlKwrWDd35NeuUkbBy/1iK+Q==" "integrity": "sha512-Y7Bj8XyJxnPAORMZj/xltsfo55uOiyHcU2tnAVzHUnSJR/KsEX+9RoDeXEnsXtl/CX4fAcrt64gZ13aGaWPeBg=="
}, },
"supports-color": { "supports-color": {
"version": "7.2.0", "version": "7.2.0",
@ -12703,15 +12750,15 @@
}, },
"dependencies": { "dependencies": {
"ajv": { "ajv": {
"version": "8.11.0", "version": "8.18.0",
"resolved": "https://registry.npmjs.org/ajv/-/ajv-8.11.0.tgz", "resolved": "https://registry.npmjs.org/ajv/-/ajv-8.18.0.tgz",
"integrity": "sha512-wGgprdCvMalC0BztXvitD2hC04YffAvtsUn93JbGXYLAtCUO4xd17mCCZQxUOItiBwZvJScWo8NIvQMQ71rdpg==", "integrity": "sha512-PlXPeEWMXMZ7sPYOHqmDyCJzcfNrUr3fGNKtezX14ykXOEIvyK81d+qydx89KY5O71FKMPaQ2vBfBFI5NHR63A==",
"dev": true, "dev": true,
"requires": { "requires": {
"fast-deep-equal": "^3.1.1", "fast-deep-equal": "^3.1.3",
"fast-uri": "^3.0.1",
"json-schema-traverse": "^1.0.0", "json-schema-traverse": "^1.0.0",
"require-from-string": "^2.0.2", "require-from-string": "^2.0.2"
"uri-js": "^4.2.2"
} }
}, },
"json-schema-traverse": { "json-schema-traverse": {

5
src/cleanup.ts
View file

@ -204,6 +204,11 @@ async function handleWindowsCleanup() {
return; return;
} }
if (process.arch === "arm64") {
console.log(common.ARM64_WINDOWS_RUNNER_MESSAGE);
return;
}
const p = cp.spawn( const p = cp.spawn(
"powershell.exe", "powershell.exe",
[ [

3
src/common.ts
View file

@ -145,3 +145,6 @@ export const ARC_RUNNER_MESSAGE =
export const ARM64_RUNNER_MESSAGE = export const ARM64_RUNNER_MESSAGE =
"ARM runners are not supported in the Harden-Runner community tier."; "ARM runners are not supported in the Harden-Runner community tier.";
export const ARM64_WINDOWS_RUNNER_MESSAGE =
"Windows ARM runners are not yet supported by Harden-Runner.";

4
src/install-agent.ts
View file

@ -5,7 +5,7 @@ import * as path from "path";
import * as fs from "fs"; import * as fs from "fs";
import { verifyChecksum } from "./checksum"; import { verifyChecksum } from "./checksum";
import { EOL } from "os"; import { EOL } from "os";
import { ARM64_RUNNER_MESSAGE } from "./common"; import { ARM64_RUNNER_MESSAGE, ARM64_WINDOWS_RUNNER_MESSAGE } from "./common";
import { chownForFolder } from "./utils"; import { chownForFolder } from "./utils";
export async function installAgent( export async function installAgent(
@ -157,7 +157,7 @@ export async function installWindowsAgent(configStr: string): Promise<boolean> {
const variant = process.arch === "x64" ? "amd64" : "arm64"; const variant = process.arch === "x64" ? "amd64" : "arm64";
if (variant === "arm64") { if (variant === "arm64") {
console.log(ARM64_RUNNER_MESSAGE); console.log(ARM64_WINDOWS_RUNNER_MESSAGE);
return false; return false;
} }