Skip to content

Commit a24669b

Browse files
franzramadhanclaude
franzramadhan
and
claude
authored
ci: add harden-runner to GitHub Actions workflows (#129)
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
1 parent 8c34b22 commit a24669b

15 files changed

Lines changed: 112 additions & 0 deletions

‎.github/workflows/build_server.yml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,10 @@ jobs:
2727
env:
2828
ARTIFACTS: server/dist/reearth_*.*
2929
steps:
30+
- name: Harden Runner
31+
uses: step-security/harden-runner@fe104658747b27e96e4f7e80cd0a94068e53901d # v2.16.1
32+
with:
33+
egress-policy: audit
3034
- name: Checkout
3135
uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
3236
with:
@@ -93,6 +97,10 @@ jobs:
9397
run:
9498
working-directory: server
9599
steps:
100+
- name: Harden Runner
101+
uses: step-security/harden-runner@fe104658747b27e96e4f7e80cd0a94068e53901d # v2.16.1
102+
with:
103+
egress-policy: audit
96104
- name: Checkout
97105
uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2.7.0
98106
- uses: actions/create-github-app-token@d72941d797fd3113feb6b93fd0dec494b13a2547 # v1.12.0

‎.github/workflows/build_web.yml‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,10 @@ jobs:
3030
env:
3131
NODE_OPTIONS: "--max-old-space-size=8192"
3232
steps:
33+
- name: Harden Runner
34+
uses: step-security/harden-runner@fe104658747b27e96e4f7e80cd0a94068e53901d # v2.16.1
35+
with:
36+
egress-policy: audit
3337
- uses: actions/setup-node@3235b876344d2a9aa001b8d1453c930bba69e610 # v3.9.1
3438
with:
3539
node-version: lts/*
@@ -65,6 +69,10 @@ jobs:
6569
env:
6670
ARTIFACT: reearth-web_${{ github.event.inputs.name }}.tar.gz
6771
steps:
72+
- name: Harden Runner
73+
uses: step-security/harden-runner@fe104658747b27e96e4f7e80cd0a94068e53901d # v2.16.1
74+
with:
75+
egress-policy: audit
6876
- uses: actions/create-github-app-token@d72941d797fd3113feb6b93fd0dec494b13a2547 # v1.12.0
6977
id: app-token
7078
with:
@@ -106,6 +114,10 @@ jobs:
106114
run:
107115
working-directory: server
108116
steps:
117+
- name: Harden Runner
118+
uses: step-security/harden-runner@fe104658747b27e96e4f7e80cd0a94068e53901d # v2.16.1
119+
with:
120+
egress-policy: audit
109121
- name: Checkout
110122
uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
111123
- name: Set up QEMU
@@ -173,6 +185,10 @@ jobs:
173185
run:
174186
working-directory: server
175187
steps:
188+
- name: Harden Runner
189+
uses: step-security/harden-runner@fe104658747b27e96e4f7e80cd0a94068e53901d # v2.16.1
190+
with:
191+
egress-policy: audit
176192
- name: Checkout
177193
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
178194
- name: Set up QEMU
@@ -226,6 +242,10 @@ jobs:
226242
env:
227243
ARTIFACT: reearth-web_${{ github.event.inputs.new_tag }}.tar.gz
228244
steps:
245+
- name: Harden Runner
246+
uses: step-security/harden-runner@fe104658747b27e96e4f7e80cd0a94068e53901d # v2.16.1
247+
with:
248+
egress-policy: audit
229249
- name: Fetch reearth-web release
230250
uses: dsaltares/fetch-gh-release-asset@master
231251
with:

‎.github/workflows/ci.yml‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,10 @@ jobs:
1010
web: ${{ steps.web.outputs.any_changed }}
1111
server: ${{ steps.server.outputs.any_changed }}
1212
steps:
13+
- name: Harden Runner
14+
uses: step-security/harden-runner@fe104658747b27e96e4f7e80cd0a94068e53901d # v2.16.1
15+
with:
16+
egress-policy: audit
1317
- uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
1418
with:
1519
fetch-depth: 0
@@ -52,6 +56,10 @@ jobs:
5256
- ci-server
5357
if: '!failure()'
5458
steps:
59+
- name: Harden Runner
60+
uses: step-security/harden-runner@fe104658747b27e96e4f7e80cd0a94068e53901d # v2.16.1
61+
with:
62+
egress-policy: audit
5563
- run: echo OK
5664
ci-collect-info:
5765
name: Collect information
@@ -64,6 +72,10 @@ jobs:
6472
new_tag_short: ${{ steps.info.outputs.new_tag_short || 'blank' }}
6573
name: ${{ steps.info.outputs.name || 'blank' }}
6674
steps:
75+
- name: Harden Runner
76+
uses: step-security/harden-runner@fe104658747b27e96e4f7e80cd0a94068e53901d # v2.16.1
77+
with:
78+
egress-policy: audit
6779
- name: checkout
6880
uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
6981
- name: Fetch tags
@@ -102,6 +114,10 @@ jobs:
102114
runs-on: ubuntu-latest
103115
if: ${{!failure() && needs.ci-web.result == 'success' && github.event_name == 'push' && (github.ref_name == 'main' || github.ref_name == 'release' || startsWith(github.ref_name, 'release/'))}}
104116
steps:
117+
- name: Harden Runner
118+
uses: step-security/harden-runner@fe104658747b27e96e4f7e80cd0a94068e53901d # v2.16.1
119+
with:
120+
egress-policy: audit
105121
- name: Dispatch Web Build
106122
uses: benc-uk/workflow-dispatch@e2e5e9a103e331dad343f381a29e654aea3cf8fc # v1.2.4
107123
with:
@@ -121,6 +137,10 @@ jobs:
121137
runs-on: ubuntu-latest
122138
if: ${{!failure() && needs.ci-server.result == 'success' && github.event_name == 'push' && (github.ref_name == 'main' || github.ref_name == 'release' || startsWith(github.ref_name, 'release/'))}}
123139
steps:
140+
- name: Harden Runner
141+
uses: step-security/harden-runner@fe104658747b27e96e4f7e80cd0a94068e53901d # v2.16.1
142+
with:
143+
egress-policy: audit
124144
- name: Dispatch Server Build
125145
uses: benc-uk/workflow-dispatch@e2e5e9a103e331dad343f381a29e654aea3cf8fc # v1.2.4
126146
with:

‎.github/workflows/ci_docker_build_push.yml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,10 @@ jobs:
2828
run:
2929
working-directory: server
3030
steps:
31+
- name: Harden Runner
32+
uses: step-security/harden-runner@fe104658747b27e96e4f7e80cd0a94068e53901d # v2.16.1
33+
with:
34+
egress-policy: audit
3135
- name: Checkout
3236
uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2.7.0
3337
- name: Set up QEMU
@@ -97,6 +101,10 @@ jobs:
97101
run:
98102
working-directory: web
99103
steps:
104+
- name: Harden Runner
105+
uses: step-security/harden-runner@fe104658747b27e96e4f7e80cd0a94068e53901d # v2.16.1
106+
with:
107+
egress-policy: audit
100108
- name: Checkout
101109
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
102110
- name: Set up QEMU

‎.github/workflows/ci_server.yml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,10 @@ jobs:
77
runs-on: ubuntu-latest
88
if: github.event_name != 'push' || !startsWith(github.event.head_commit.message, 'v')
99
steps:
10+
- name: Harden Runner
11+
uses: step-security/harden-runner@fe104658747b27e96e4f7e80cd0a94068e53901d # v2.16.1
12+
with:
13+
egress-policy: audit
1014
- name: checkout
1115
uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
1216
- name: set up
@@ -29,6 +33,10 @@ jobs:
2933
ports:
3034
- 27017:27017
3135
steps:
36+
- name: Harden Runner
37+
uses: step-security/harden-runner@fe104658747b27e96e4f7e80cd0a94068e53901d # v2.16.1
38+
with:
39+
egress-policy: audit
3240
- name: checkout
3341
uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
3442
- name: set up

‎.github/workflows/ci_web.yml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,10 @@ jobs:
99
run:
1010
working-directory: web
1111
steps:
12+
- name: Harden Runner
13+
uses: step-security/harden-runner@fe104658747b27e96e4f7e80cd0a94068e53901d # v2.16.1
14+
with:
15+
egress-policy: audit
1216
- uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
1317
- uses: actions/setup-node@3235b876344d2a9aa001b8d1453c930bba69e610 # v3.9.1
1418
with:

‎.github/workflows/deploiy_aws.yml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,10 @@ jobs:
2424
name: Deploy server to AWS
2525
runs-on: ubuntu-latest
2626
steps:
27+
- name: Harden Runner
28+
uses: step-security/harden-runner@fe104658747b27e96e4f7e80cd0a94068e53901d # v2.16.1
29+
with:
30+
egress-policy: audit
2731
- name: Configure AWS credentials
2832
uses: aws-actions/configure-aws-credentials@5fd3084fc36e372ff1fff382a39b10d03659f355 # v2.2.0
2933
with:
@@ -45,6 +49,10 @@ jobs:
4549
name: Deploy web to AWS
4650
runs-on: ubuntu-latest
4751
steps:
52+
- name: Harden Runner
53+
uses: step-security/harden-runner@fe104658747b27e96e4f7e80cd0a94068e53901d # v2.16.1
54+
with:
55+
egress-policy: audit
4856
- name: Configure AWS credentials
4957
uses: aws-actions/configure-aws-credentials@5fd3084fc36e372ff1fff382a39b10d03659f355 # v2.2.0
5058
with:

‎.github/workflows/deploy_server_nightly.yml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,10 @@ jobs:
1313
contents: read
1414
id-token: write
1515
steps:
16+
- name: Harden Runner
17+
uses: step-security/harden-runner@fe104658747b27e96e4f7e80cd0a94068e53901d # v2.16.1
18+
with:
19+
egress-policy: audit
1620
- uses: google-github-actions/auth@6fc4af4b145ae7821d527454aa9bd537d1f2dc5f # v2.1.7
1721
with:
1822
service_account: ${{ secrets.GC_SA_EMAIL }}

‎.github/workflows/deploy_web_nightly.yml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,10 @@ jobs:
1313
contents: read
1414
id-token: write
1515
steps:
16+
- name: Harden Runner
17+
uses: step-security/harden-runner@fe104658747b27e96e4f7e80cd0a94068e53901d # v2.16.1
18+
with:
19+
egress-policy: audit
1620
- uses: google-github-actions/auth@6fc4af4b145ae7821d527454aa9bd537d1f2dc5f # v2.1.7
1721
with:
1822
service_account: ${{ secrets.GC_SA_EMAIL }}

‎.github/workflows/e2e.yml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,10 @@ jobs:
1313
run:
1414
working-directory: web
1515
steps:
16+
- name: Harden Runner
17+
uses: step-security/harden-runner@fe104658747b27e96e4f7e80cd0a94068e53901d # v2.16.1
18+
with:
19+
egress-policy: audit
1620
- uses: actions/setup-node@3235b876344d2a9aa001b8d1453c930bba69e610 # v3.9.1
1721
with:
1822
node-version: lts/*
@@ -63,6 +67,10 @@ jobs:
6367
- e2e
6468
runs-on: ubuntu-latest
6569
steps:
70+
- name: Harden Runner
71+
uses: step-security/harden-runner@fe104658747b27e96e4f7e80cd0a94068e53901d # v2.16.1
72+
with:
73+
egress-policy: audit
6674
- name: Slack Notification
6775
uses: Gamesight/slack-workflow-status@master
6876
if: always()

0 commit comments

Comments
 (0)