step-security/harden-runner
1
0
Fork 0
mirror of https://github.com/step-security/harden-runner.git synced 2026-06-08 21:17:05 +00:00
Code Issues Projects Releases Packages Wiki Activity
harden-runner/README.md
Varun Sharma b48b642e41
 Update README.md
2022-02-28 09:07:58 -08:00

5.2 KiB
Raw Blame History

Step Security Logo

Software Supply Chain Security

This GitHub Action can be used to prevent certain types of software supply chain attacks.

Problem

Hijacked dependencies and compromised build tools typically make outbound requests during the build process to exfiltrate data or credentials. This was the case in the Codecov breach, in the dependency confusion attacks, and the recent npm package hijacks.

Solution

First-of-its-kind patent-pending technology that automatically correlates outbound traffic with each step of a workflow.

  1. Add step-security/harden-runner to your GitHub Actions workflow file as the first step.

    steps:
  - uses: step-security/harden-runner@bdb12b622a910dfdc99a31fdfe6f45a16bc287a4 # v1
    with:
      egress-policy: audit

  2. In the workflow logs, you will see a link to security insights and recommendations.

    Link in build log

  3. Click on the link (example link). You will see outbound traffic made by each step.

    Insights from harden-runner

  4. Below the insights, you will see the recommended policy. Add the recommended outbound endpoints to your workflow file, and only traffic to these endpoints will be allowed.

    Policy recommended by harden-runner

When you use egress-policy: block mode, you can also set disable-telemetry: true to not send telemetry to the StepSecurity API.

How past attacks would have been prevented

Hands-on tutorials to learn how harden-runner would have prevented past software supply chain attacks, such as the Codecov breach.

Support for private repositories

Support for private repositories is now in Preview. Install the Harden Runner App from the Marketplace if you want to use harden-runner for Private repositories or if you want the insights to show up instantly after the workflow run completes for Public repositories. This App only needs actions: read permissions on your repositories. You can install it on selected repositories, or all repositories in your organization.

Discussions

If you have questions or ideas, please use discussions.

  1. Support for private repositories
  2. Generation of accurate SBOM (software bill of materials)
  3. SLSA Level 1
  4. Cryptographically verify tools run as part of the CI/ CD pipeline

Workflows using harden-runner

Workflows using harden-runner:

  1. https://github.com/nvm-sh/nvm/tree/master/.github/workflows (link to insights)
  2. https://github.com/microsoft/msquic/tree/main/.github/workflows (link to insights)
  3. https://github.com/Automattic/vip-go-mu-plugins/blob/master/.github/workflows/e2e.yml (link to insights)
  4. https://github.com/MTRNord/matrix-art/tree/main/.github/workflows (link to insights)
  5. https://github.com/jauderho/dockerfiles/blob/main/.github/workflows/age.yml (link to insights)

Demo Video

https://user-images.githubusercontent.com/25015917/156026587-79356450-9b35-4254-9c2e-7f2cc8d81059.mp4

FAQ

Why do I see calls to api.snapcraft.io?

During workflow runs, it was observed that unnecessary outbound calls were being made to some domains. All of the outbound calls were due to unnecessary services running on the GitHub Actions hosted-runner VM. These services have been stopped, except for snapd, which makes calls to api.snapcraft.io. You can read more about this issue here. api.snapcraft.io is not needed for your workflow, and does not need to be added to the allowed-endpoints list.