Release v2.2.0 (#245)

Author: varunsh-coder

dist/index.js

@@ -61033,8 +61033,10 @@ function addSummary() {
         }
     });
 }
+const STATUS_HARDEN_RUNNER_UNAVAILABLE = "409";
 const CONTAINER_MESSAGE = "This job is running in a container. Harden Runner does not run in a container as it needs sudo access to run. This job will not be monitored.";
 const UBUNTU_MESSAGE = "This job is not running in a GitHub Actions Hosted Runner Ubuntu VM. Harden Runner is only supported on Ubuntu VM. This job will not be monitored.";
+const HARDEN_RUNNER_UNAVAILABLE_MESSAGE = "Sorry, we are currently experiencing issues with the Harden Runner installation process. It is currently unavailable.";
 
 ;// CONCATENATED MODULE: external "node:fs"
 const external_node_fs_namespaceObject = require("node:fs");
@@ -61199,6 +61201,11 @@ var cleanup_awaiter = (undefined && undefined.__awaiter) || function (thisArg, _
         console.log(CONTAINER_MESSAGE);
         return;
     }
+    if (String(process.env.STATE_monitorStatusCode) ===
+        STATUS_HARDEN_RUNNER_UNAVAILABLE) {
+        console.log(HARDEN_RUNNER_UNAVAILABLE_MESSAGE);
+        return;
+    }
     external_fs_.writeFileSync("/home/agent/post_event.json", JSON.stringify({ event: "post" }));
     var doneFile = "/home/agent/done.json";
     var counter = 0;

dist/index.js.map

@@ -14163,8 +14163,10 @@ function addSummary() {
         }
     });
 }
+const STATUS_HARDEN_RUNNER_UNAVAILABLE = "409";
 const CONTAINER_MESSAGE = "This job is running in a container. Harden Runner does not run in a container as it needs sudo access to run. This job will not be monitored.";
 const UBUNTU_MESSAGE = "This job is not running in a GitHub Actions Hosted Runner Ubuntu VM. Harden Runner is only supported on Ubuntu VM. This job will not be monitored.";
+const HARDEN_RUNNER_UNAVAILABLE_MESSAGE = "Sorry, we are currently experiencing issues with the Harden Runner installation process. It is currently unavailable.";
 
 // EXTERNAL MODULE: ./node_modules/@actions/tool-cache/lib/tool-cache.js
 var tool_cache = __nccwpck_require__(7784);
@@ -14179,7 +14181,7 @@ function verifyChecksum(downloadPath) {
     const checksum = external_crypto_.createHash("sha256")
         .update(fileBuffer)
         .digest("hex"); // checksum of downloaded file
-    const expectedChecksum = "79f397360470d6e42c73d6c9c5cf485ac9982e56e3e3fdd07f66c59cda4388c8"; // checksum for v0.12.1
+    const expectedChecksum = "10fd5587cfeba6aac4125be78ee32f60d5e780de10929f454525670c4c16935d"; // checksum for v0.12.2
     if (checksum !== expectedChecksum) {
         lib_core.setFailed(`Checksum verification failed, expected ${expectedChecksum} instead got ${checksum}`);
     }
@@ -14354,7 +14356,6 @@ var setup_awaiter = (undefined && undefined.__awaiter) || function (thisArg, _ar
         var env = "agent";
         var api_url = `https://${env}.api.stepsecurity.io/v1`;
         var web_url = "https://app.stepsecurity.io";
-        console.log(`Step Security Job Correlation ID: ${correlation_id}`);
         const confg = {
             repo: process.env["GITHUB_REPOSITORY"],
             run_id: process.env["GITHUB_RUN_ID"],
@@ -14368,6 +14369,33 @@ var setup_awaiter = (undefined && undefined.__awaiter) || function (thisArg, _ar
             disable_file_monitoring: lib_core.getBooleanInput("disable-file-monitoring"),
             private: github.context.payload.repository.private,
         };
+        if (confg.egress_policy !== "audit" && confg.egress_policy !== "block") {
+            lib_core.setFailed("egress-policy must be either audit or block");
+        }
+        if (confg.egress_policy === "block" && confg.allowed_endpoints === "") {
+            lib_core.warning("egress-policy is set to block (default) and allowed-endpoints is empty. No outbound traffic will be allowed for job steps.");
+        }
+        if (confg.disable_telemetry !== true && confg.disable_telemetry !== false) {
+            lib_core.setFailed("disable-telemetry must be a boolean value");
+        }
+        let _http = new lib.HttpClient();
+        let statusCode;
+        _http.requestOptions = { socketTimeout: 3 * 1000 };
+        try {
+            const resp = yield _http.get(`${api_url}/github/${process.env["GITHUB_REPOSITORY"]}/actions/runs/${process.env["GITHUB_RUN_ID"]}/monitor`);
+            statusCode = resp.message.statusCode; // adding error code to check whether agent is getting installed or not.
+            external_fs_.appendFileSync(process.env.GITHUB_STATE, `monitorStatusCode=${statusCode}${external_os_.EOL}`, {
+                encoding: "utf8",
+            });
+        }
+        catch (e) {
+            console.log(`error in connecting to ${api_url}: ${e}`);
+        }
+        console.log(`Step Security Job Correlation ID: ${correlation_id}`);
+        if (String(statusCode) === STATUS_HARDEN_RUNNER_UNAVAILABLE) {
+            console.log(HARDEN_RUNNER_UNAVAILABLE_MESSAGE);
+            return;
+        }
         if (isValidEvent()) {
             try {
                 const cacheEntry = yield getCacheEntry([cacheKey], [cacheFile], {
@@ -14386,37 +14414,13 @@ var setup_awaiter = (undefined && undefined.__awaiter) || function (thisArg, _ar
                 }
             }
         }
-        if (confg.egress_policy !== "audit" && confg.egress_policy !== "block") {
-            lib_core.setFailed("egress-policy must be either audit or block");
-        }
-        if (confg.egress_policy === "block" && confg.allowed_endpoints === "") {
-            lib_core.warning("egress-policy is set to block (default) and allowed-endpoints is empty. No outbound traffic will be allowed for job steps.");
-        }
-        if (confg.disable_telemetry !== true && confg.disable_telemetry !== false) {
-            lib_core.setFailed("disable-telemetry must be a boolean value");
-        }
-        if (!confg.disable_telemetry) {
-            let _http = new lib.HttpClient();
-            _http.requestOptions = { socketTimeout: 3 * 1000 };
-            try {
-                const resp = yield _http.get(`${api_url}/github/${process.env["GITHUB_REPOSITORY"]}/actions/runs/${process.env["GITHUB_RUN_ID"]}/monitor`);
-                if (resp.message.statusCode === 200) {
-                    external_fs_.appendFileSync(process.env.GITHUB_STATE, `monitorStatusCode=${resp.message.statusCode}${external_os_.EOL}`, {
-                        encoding: "utf8",
-                    });
-                }
-            }
-            catch (e) {
-                console.log(`error in connecting to ${api_url}: ${e}`);
-            }
-        }
         const confgStr = JSON.stringify(confg);
         external_child_process_.execSync("sudo mkdir -p /home/agent");
         external_child_process_.execSync("sudo chown -R $USER /home/agent");
         // Note: to avoid github rate limiting
         let token = lib_core.getInput("token");
         let auth = `token ${token}`;
-        const downloadPath = yield tool_cache.downloadTool("https://github.com/step-security/agent/releases/download/v0.12.1/agent_0.12.1_linux_amd64.tar.gz", undefined, auth);
+        const downloadPath = yield tool_cache.downloadTool("https://github.com/step-security/agent/releases/download/v0.12.2/agent_0.12.2_linux_amd64.tar.gz", undefined, auth);
         verifyChecksum(downloadPath); // NOTE: verifying agent's checksum, before extracting
         const extractPath = yield tool_cache.extractTar(downloadPath);
         if (!confg.disable_telemetry || confg.egress_policy === "audit") {

dist/post/index.js

@@ -1,6 +1,6 @@
 {
   "name": "step-security-harden-runner",
-  "version": "2.1.0",
+  "version": "2.2.0",
   "description": "Security agent for GitHub-hosted runner to monitor the build process",
   "main": "index.js",
   "scripts": {

dist/post/index.js.map

@@ -10,7 +10,7 @@ export function verifyChecksum(downloadPath: string) {
     .digest("hex"); // checksum of downloaded file
 
   const expectedChecksum: string =
-    "79f397360470d6e42c73d6c9c5cf485ac9982e56e3e3fdd07f66c59cda4388c8"; // checksum for v0.12.1
+    "10fd5587cfeba6aac4125be78ee32f60d5e780de10929f454525670c4c16935d"; // checksum for v0.12.2
 
   if (checksum !== expectedChecksum) {
     core.setFailed(

dist/pre/index.js

@@ -17,6 +17,14 @@ import path from "path";
     return;
   }
 
+  if (
+    String(process.env.STATE_monitorStatusCode) ===
+    common.STATUS_HARDEN_RUNNER_UNAVAILABLE
+  ) {
+    console.log(common.HARDEN_RUNNER_UNAVAILABLE_MESSAGE);
+    return;
+  }
+
   fs.writeFileSync(
     "/home/agent/post_event.json",
     JSON.stringify({ event: "post" })

dist/pre/index.js.map

@@ -21,16 +21,19 @@ export async function addSummary() {
         "StepSecurity Harden-Runner",
         { width: "200" }
       )
-      .addLink(
-        "View security insights and recommended policy",
-        insights_url
-      )
+      .addLink("View security insights and recommended policy", insights_url)
       .addSeparator()
       .write();
   }
 }
+
+export const STATUS_HARDEN_RUNNER_UNAVAILABLE = "409";
+
 export const CONTAINER_MESSAGE =
   "This job is running in a container. Harden Runner does not run in a container as it needs sudo access to run. This job will not be monitored.";
 
 export const UBUNTU_MESSAGE =
   "This job is not running in a GitHub Actions Hosted Runner Ubuntu VM. Harden Runner is only supported on Ubuntu VM. This job will not be monitored.";
+
+export const HARDEN_RUNNER_UNAVAILABLE_MESSAGE =
+  "Sorry, we are currently experiencing issues with the Harden Runner installation process. It is currently unavailable.";