mirror of
https://github.com/step-security/harden-runner.git
synced 2026-06-07 16:47:07 +00:00
The bravo agent authenticates to the backend using a per-job one_time_key issued by the /monitor endpoint and stored in DynamoDB keyed by correlation_id. Without it the presigned-URL request (and all telemetry endpoints via sendApiRequest) get rejected, so detection events never upload and insights never appear. For third-party runners, override correlation_id to RUNNER_NAME before the monitor call so the key stored in DDB matches the one the bravo agent will use when requesting presigned URLs. Drop the random api_key and customer field — when OneTimeKey is present the agent uses x-one-time-key header, not vm-api-key. |
||
|---|---|---|
| .. | ||
| post | ||
| pre | ||
| index.js | ||
| index.js.map | ||
| sourcemap-register.js | ||