Add mac and windows changes by h0x0er · Pull Request #638 · step-security/harden-runner

h0x0er · 2026-02-20T08:44:43Z

No description provided.

macos-cleanup

Add combined windows and macos changes

Copilot

Pull request overview

This pull request adds support for macOS and Windows runners to the harden-runner GitHub Action, which previously only supported Ubuntu (Linux). The changes refactor platform-specific logic into separate modules and add installation and cleanup handlers for the new platforms.

Changes:

Added utils.ts module with platform-agnostic helper functions
Implemented installMacosAgent and installWindowsAgent functions for platform-specific agent installation
Added platform-specific cleanup handlers (handleMacosCleanup, handleWindowsCleanup, handleLinuxCleanup)
Updated checksum verification to support multiple platforms
Fixed typo: confgStr → configStr

Reviewed changes

Copilot reviewed 7 out of 13 changed files in this pull request and generated 14 comments.

Show a summary per file

File	Description
src/utils.ts	New file with platform-agnostic utility functions (isPlatformSupported, chownForFolder, isAgentInstalled, getAnnotationLogs)
src/setup.ts	Added platform-specific agent installation logic with switch statement; fixed typo; moved chownForFolder to utils
src/install-agent.ts	Added installMacosAgent and installWindowsAgent functions; updated installAgent to return boolean on checksum failure
src/index.ts	Updated platform check to use isPlatformSupported function
src/common.ts	Updated message constant and getAnnotationLogs usage for multi-platform support
src/cleanup.ts	Refactored cleanup logic into platform-specific handlers; improved code style
src/checksum.ts	Added platform-specific checksum verification; changed return type to boolean
dist/pre/index.js	Rebuilt distribution file (with bundler issues)
dist/post/index.js	Rebuilt distribution file (with bundler issues)
dist/index.js	Rebuilt distribution file (with bundler issues)

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-02-20T22:40:49Z

src/install-agent.ts

+
+  const variant = process.arch === "x64" ? "amd64" : "arm64";
+  if (variant === "arm64") {
+    console.log(ARM64_RUNNER_MESSAGE);


There's inconsistent use of console.log and core.info throughout the codebase. For instance, line 159 uses console.log(ARM64_RUNNER_MESSAGE) while other informational messages use core.info(). Consider using core.info() consistently for informational messages to maintain consistency with the rest of the codebase and to leverage GitHub Actions' logging features.

Suggested change

console.log(ARM64_RUNNER_MESSAGE);

core.info(ARM64_RUNNER_MESSAGE);

Copilot · 2026-02-20T22:40:49Z

src/utils.ts

+export function chownForFolder(newOwner: string, target: string) {
+  let cmd = "sudo";
+  let args = ["chown", "-R", newOwner, target];
+  cp.execFileSync(cmd, args);


The chownForFolder function references 'cp' which is imported as an alias for 'child_process', but in the transpiled dist files (dist/index.js:31899, dist/pre/index.js:85168, dist/post/index.js:31904), it results in 'cp.execFileSync' which will cause a ReferenceError since 'cp' is not defined in the global scope. The bundler is not correctly handling the import alias. Consider using 'external_child_process_' in the dist files or ensuring the build process correctly transpiles this reference.

Suggested change

cp.execFileSync(cmd, args);

const childProcess = require("child_process");

childProcess.execFileSync(cmd, args);

Copilot · 2026-02-20T22:40:50Z

src/setup.ts

+        logFile = "/home/agent/agent.log";
+
+        cp.execSync("sudo mkdir -p /home/agent");
+        chownForFolder(process.env.USER, "/home/agent");


The chownForFolder function is called with process.env.USER without checking if it's defined. If the USER environment variable is not set, this will pass undefined to the chownForFolder function, which could result in unexpected behavior. Consider adding a check or using a fallback value.

Suggested change

chownForFolder(process.env.USER, "/home/agent");

const userForChown = process.env.USER || process.env.SUDO_USER;

if (userForChown) {

chownForFolder(userForChown, "/home/agent");

} else {

core.warning(

"Unable to determine user for chown; skipping ownership change for /home/agent"

);

}

Copilot · 2026-02-20T22:40:50Z

src/install-agent.ts

+    // Create working directory
+    core.info("Creating /opt/step-security directory...");
+    cp.execSync("sudo mkdir -p /opt/step-security");
+    chownForFolder(process.env.USER, "/opt/step-security");


The chownForFolder function is called with process.env.USER without checking if it's defined. If the USER environment variable is not set, this will pass undefined to the chownForFolder function, which could result in unexpected behavior. Consider adding a check or using a fallback value.

Copilot · 2026-02-20T22:40:50Z

src/cleanup.ts

+      return;
+    }
+
+    const pid = parseInt(fs.readFileSync(pidFile, "utf8").trim());


The parseInt() call could return NaN if the PID file contains invalid data. When NaN is passed to process.kill(), it will throw an error. Consider adding validation to check if the parsed PID is a valid number before attempting to use it.

Suggested change

const pid = parseInt(fs.readFileSync(pidFile, "utf8").trim());

const pid = parseInt(fs.readFileSync(pidFile, "utf8").trim(), 10);

if (Number.isNaN(pid)) {

console.log("Invalid PID in PID file. Agent may not be running.");

fs.unlinkSync(pidFile);

return;

}

Copilot · 2026-02-20T22:40:51Z

src/utils.ts

+export function chownForFolder(newOwner: string, target: string) {
+  let cmd = "sudo";
+  let args = ["chown", "-R", newOwner, target];
+  cp.execFileSync(cmd, args);
+}


The chownForFolder function executes sudo chown with user-provided parameters (newOwner and target). While process.env.USER is typically safe, consider validating the target path to prevent potential command injection or unauthorized file access if this function is ever called with untrusted input.

Copilot · 2026-02-20T22:40:51Z

src/cleanup.ts

+      console.log("PID file cleaned up");
+    }
+  } catch (error) {
+    console.log("warning: error stopping agent process:", error.message);


The error.message property is accessed without checking if error is an Error instance. In TypeScript, caught errors have type 'unknown', so accessing .message directly could cause a runtime error if the thrown value is not an Error object. Consider using type guards or optional chaining.

Suggested change

console.log("warning: error stopping agent process:", error.message);

if (error instanceof Error) {

console.log("warning: error stopping agent process:", error.message);

} else {

console.log("warning: error stopping agent process:", error);

}

Copilot · 2026-02-20T22:40:52Z

src/checksum.ts

+  switch (platform) {
+    case "linux":
+      expectedChecksum = isTLS
+        ? CHECKSUMS["tls"][variant]
+        : CHECKSUMS["non_tls"][variant];
+      break;
+    case "darwin":
+      expectedChecksum = CHECKSUMS["darwin"];
+      break;
+    case "win32":
+      expectedChecksum = CHECKSUMS["windows"][variant];
+      break;
+    default:
+      console.log(`Unsupported platform: ${platform}`);
+      return false;
  }


If the variant is not found in the CHECKSUMS object (e.g., CHECKSUMS["non_tls"]["arm64"] is undefined), expectedChecksum will be undefined or an empty string, which will cause the checksum verification to fail without a clear error message. Consider adding explicit checks for undefined expectedChecksum values and providing a more informative error message indicating that the variant is not supported.

Copilot · 2026-02-20T22:40:52Z

src/cleanup.ts

+  } catch (error) {
+    console.log("Warning: Could not fetch system log stream:", error.message);


The error.message property is accessed without checking if error is an Error instance. In TypeScript, caught errors have type 'unknown', so accessing .message directly could cause a runtime error if the thrown value is not an Error object. Consider using type guards or optional chaining.

Suggested change

} catch (error) {

console.log("Warning: Could not fetch system log stream:", error.message);

} catch (error: unknown) {

const message =

error instanceof Error ? error.message : String(error);

console.log("Warning: Could not fetch system log stream:", message);

Copilot · 2026-02-20T22:40:52Z

src/cleanup.ts

+      process.kill(pid, "SIGKILL");
+      console.log("agent process terminated forcefully");


On Windows, SIGINT and SIGKILL signals are emulated by Node.js and may not behave as expected. SIGINT might not work reliably for graceful shutdown, and SIGKILL terminates the Node.js process itself rather than the target process. Consider using taskkill or other Windows-specific process termination methods for more reliable process management on Windows.

Suggested change

process.kill(pid, "SIGKILL");

console.log("agent process terminated forcefully");

if (process.platform === "win32") {

try {

cp.execSync(`taskkill /PID ${pid} /T /F`);

console.log("agent process terminated forcefully via taskkill");

} catch (taskkillError) {

console.log(

"warning: failed to terminate agent process via taskkill:",

(taskkillError as Error).message

);

}

} else {

process.kill(pid, "SIGKILL");

console.log("agent process terminated forcefully");

}

varunsh-coder · 2026-02-22T05:57:53Z

src/install-agent.ts

+    core.info(
+      `Copying Installer from ${installerSourcePath} to /opt/step-security...`
+    );
+    cp.execSync(`cp "${installerSourcePath}" /opt/step-security/`);


cp.execSync(cp "${installerSourcePath}" /opt/step-security/);

Would be slightly safer as cp.execFileSync("cp", [installerSourcePath, "/opt/step-security/"]) to avoid any shell interpretation. The path comes from tc.extractTar
so it's likely safe, but execFileSync is the pattern used elsewhere in this codebase.

h0x0er and others added 9 commits February 2, 2026 15:04

combined windows and macos changes

ef9c637

Read platform specific annotation-logs & added post-step check in

ac14194

macos-cleanup

addressed comments

6061152

updated macos-installer download-url

9a13b2d

Fixed verifyChecksum logic and updated macos checksum

e823d39

wait for done.json only if agent is installed

ec2fee9

Merge pull request step-security#634 from h0x0er/jatin/winmac

bc79194

Add combined windows and macos changes

add windows and macos support

5d1eb77

build changes

25b1b6b

varunsh-coder requested a review from Copilot February 20, 2026 22:35

Copilot started reviewing on behalf of varunsh-coder February 20, 2026 22:35 View session

Copilot AI reviewed Feb 20, 2026

View reviewed changes

varunsh-coder reviewed Feb 22, 2026

View reviewed changes

h0x0er added 2 commits February 22, 2026 13:07

use agent from prod-releases & resolved comments

0d7fdc0

bump agent-macos installer to v0.0.4

853e846

varunsh-coder merged commit 9da995c into step-security:rc-35 Feb 24, 2026
3 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add mac and windows changes#638

Add mac and windows changes#638
varunsh-coder merged 11 commits intostep-security:rc-35from
h0x0er:rc-35

h0x0er commented Feb 20, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Feb 20, 2026

Uh oh!

Copilot AI Feb 20, 2026

Uh oh!

Copilot AI Feb 20, 2026

Uh oh!

Copilot AI Feb 20, 2026

Uh oh!

Copilot AI Feb 20, 2026

Uh oh!

Copilot AI Feb 20, 2026

Uh oh!

Copilot AI Feb 20, 2026

Uh oh!

Copilot AI Feb 20, 2026

Uh oh!

Copilot AI Feb 20, 2026

Uh oh!

Copilot AI Feb 20, 2026

Uh oh!

varunsh-coder Feb 22, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

	console.log(ARM64_RUNNER_MESSAGE);
	core.info(ARM64_RUNNER_MESSAGE);

	cp.execFileSync(cmd, args);
	const childProcess = require("child_process");
	childProcess.execFileSync(cmd, args);

-        chownForFolder(process.env.USER, "/home/agent");
+        const userForChown = process.env.USER || process.env.SUDO_USER;
+        if (userForChown) {
+          chownForFolder(userForChown, "/home/agent");
+        } else {
+          core.warning(
+            "Unable to determine user for chown; skipping ownership change for /home/agent"
+          );
+        }

-    const pid = parseInt(fs.readFileSync(pidFile, "utf8").trim());
+    const pid = parseInt(fs.readFileSync(pidFile, "utf8").trim(), 10);
+    if (Number.isNaN(pid)) {
+      console.log("Invalid PID in PID file. Agent may not be running.");
+      fs.unlinkSync(pidFile);
+      return;
+    }

		} catch (error) {
		console.log("Warning: Could not fetch system log stream:", error.message);

-  } catch (error) {
-    console.log("Warning: Could not fetch system log stream:", error.message);
+  } catch (error: unknown) {
+    const message =
+      error instanceof Error ? error.message : String(error);
+    console.log("Warning: Could not fetch system log stream:", message);

		process.kill(pid, "SIGKILL");
		console.log("agent process terminated forcefully");

Conversation

h0x0er commented Feb 20, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Feb 20, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 20, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 20, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 20, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 20, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 20, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 20, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 20, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 20, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 20, 2026

Choose a reason for hiding this comment

Uh oh!

varunsh-coder Feb 22, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants