Harden-Runner

Harden-Runner secures CI/CD workflows by controlling network access and monitoring activities on GitHub-hosted and self-hosted runners. It blocks unauthorized network traffic and detects unusual activity to protect against potential threats. The name "Harden-Runner" comes from its purpose: strengthening the security of the runners used in GitHub Actions workflows.

Quick Links

• Getting Started Guide
• Why Use Harden-Runner
• Features and Capabilities
• Case Studies and Trusted Projects
• How It Works
• Known Limitations
• Join the Discussions

---

Introduction

Learn how Harden-Runner works through the video below, which shows how it detected a supply chain attack on a Google open-source project.

Harden-Runner is trusted by leading projects across industries. For example, it has also been used to secure the Azure Karpenter Provider, helping Microsoft improve the security of its open-source ecosystem.Read the full case study →

---

Getting Started

This guide walks you through the steps to set up and use Harden-Runner in your CI/CD workflows.

Prerequisites

Before you begin, ensure you have the following:

• GitHub account
• GitHub-hosted runner environment
• StepSecurity account

Step 1: Add Harden-Runner to Your Workflow

To integrate Harden-Runner, follow these steps:

• Open your GitHub Actions workflow file (e.g., .github/workflows/<workflow-name>.yml).
• Add the following code as the first step in each job:

  steps:
    - uses: step-security/harden-runner@446798f8213ac2e75931c1b0769676d927801858 # v2.10.0
      with:
        egress-policy: audit
  
  

Tip: Automate this step by pasting your workflow into the StepSecurity online tool

Click to view the full Getting Started Guide

Step 2: Access Security Insights

Run your workflow. Once completed:

• Review the workflow logs and the job markdown summary.
• Look for a link to security insights and recommendations.

  

• Click on the provided link (e.g., example link) to access the Process Monitor View, which displays:
  • Network events: Outbound network calls correlated with each step.
  • File events: File writes tracked during the job.

    

Step 3: Apply the Recommended Policy

On the Recommended Policy tab in the insights dashboard:

• Review the suggested block policy, which is generated based on outbound calls from current and past runs.
• You can:
  • Add this policy directly to your workflow file, or
  • Use the Policy Store to apply the policy without modifying your workflow file.

  

Step 4: Block Unauthorized Outbound Calls

Once the policy is applied:

• Outbound calls not on the allowed list will be blocked.
• This ensures that only trusted endpoints are accessible, preventing potential security risks.

---

Why Choose Harden-Runner?

• Prevent Exfiltration: Prevent the exfiltration of CI/CD secrets and source code.
• Detect Tampering: Identify source code modifications during builds.
• Anomaly Detection: Spot unusual dependencies and workflow behaviors.
• Simplify Permissions: Determine the minimum required GITHUB_TOKEN permissions.

---

Features

Harden-Runner offers a comprehensive suite of features to enhance the security of your CI/CD workflows, available in two tiers: Community (Free) and Enterprise (Paid).

Community (Free)

• Block Network Egress Traffic with Domain Allowlist: Control outbound network traffic by specifying allowed domains, preventing unauthorized data exfiltration.
• Detect Compromised Packages, Dependencies & Build Tools: Identify and mitigate risks from malicious or vulnerable components in your build process.
• Detect Modification of Source Code: Monitor and alert on unauthorized changes to your source code during the CI/CD pipeline.
• Disable Sudo Access: Restrict the use of superuser privileges in your workflows to minimize security risks.
• Insights Page for CI/CD Runs: Access detailed reports and analytics for each CI/CD run to monitor security events and compliance.

Enterprise (Paid)

Includes all features in the Community tier, plus:

• Support for Private Repositories: Extend Harden-Runner's security capabilities to your private GitHub repositories.
• Support for Self-Hosted Runners: Apply security controls and monitoring to self-hosted GitHub Actions runners.
• View Outbound GitHub API calls at the Job Level: Monitor HTTPS requests to GitHub APIs
• Determine Minimum GITHUB_TOKEN Permissions: Monitor outbound HTTPS requests to GitHub APIs to recommend the least-privilege permissions needed for your workflows, enhancing security by reducing unnecessary access.
• View the Name and Path of Every File Written During the Build Process: Gain visibility into every file written to the build environment, including the ability to correlate file writes with processes, ensuring complete transparency.
• View Process Names and Arguments: Monitor every process executed during the build process, along with its arguments, and navigate the process tree to detect suspicious activities.

For a detailed comparison and more information, please visit our Pricing Page.

Explore the full feature set in the Features Documentation.

---

Trusted By and Case Studies

Harden-Runner is trusted by over 5000 leading open-source projects and enterprises, including Microsoft, Google, Kubernetes, and more.

Trusted by

CISA Explore	Microsoft Explore	Google Explore	DataDog Explore	Intel Explore	Kubernetes Explore	Node.js Explore	AWS Explore

Case Studies

• Harden-Runner Detects CI/CD Supply Chain Attack in Google’s Open-Source Project Flank
• StepSecurity Detects CI/CD Supply Chain Attack in Microsoft’s Open-Source Project Azure Karpenter Provider in Real-Time
• How Coveo Strengthened GitHub Actions Security with StepSecurity
• Hashgraph Achieves Comprehensive CI/CD Security Without Compromising Development Speed
• Kapiche secures their GitHub Actions software supply chain with Harden-Runner
• Arcjet Enhances CI/CD Security with Harden-Runner

---

How It Works

Want to know the technical details? Dive into the architecture of Harden-Runner and its integrations for GitHub-hosted and self-hosted runners in our How It Works Documentation.

---

Limitations

While Harden-Runner offers powerful features, there are certain limitations based on the environment, such as OS support. See the complete list in Known Limitations.

---

Discussions

Join the conversation! For questions, ideas, or feedback, visit our Discussions Page.

For enterprise support, email support@stepsecurity.io. Interested in using Harden-Runner in other CI/CD platforms? Reach out to interest@stepsecurity.io.

---

License

Harden-Runner is open source. See the LICENSE file for details.