harden-runner/README.md

Harden Runner

First-of-its-kind technology that automatically discovers and correlates outbound traffic with each step of a GitHub Actions workflow.

To use this GitHub Action, add the following code to your GitHub Actions workflow file as the first step.

steps:
    - uses: step-security/harden-runner@v1
      with:
        egress-policy: audit

In the workflow logs, you should see a link to security insights and recommendations.

Click on the link (example link) to view security insights and recommended egress policy (example below).

You can then add the correlated outbound endpoints to your workflow file, and only traffic to these endpoints will be allowed, thereby reducing risk from software supply chain attacks.