Security agent for GitHub-hosted runner

Harden-Runner GitHub Action installs a security agent on the GitHub-hosted runner (Ubuntu VM) to

1. Monitor the build process
2. Prevent exfiltration of credentials
3. Detect compromised dependencies or build tools

Why

Hijacked dependencies and compromised build tools typically make outbound requests to exfiltrate data or credentials, or may modify source code, dependencies, or artifacts during the build.

Harden-Runner automatically correlates outbound traffic, file modifications, and process activity with each step of a workflow. You can also set a policy to restrict outbound traffic.

Check out the hands-on tutorials to learn how Harden-Runner would have prevented past supply chain attacks and read this blog post on how Harden-Runner detected malicious packages.

How

1. Add step-security/harden-runner to your GitHub Actions workflow file as the first step in each job. In the pre step, the GitHub Actions installs a daemon that monitors process, file, and network activity.

   steps:
     - uses: step-security/harden-runner@9b0655f430fba8c7001d4e38f8d4306db5c6e0ab # v1
       with:
         egress-policy: audit

2. In the workflow logs, you will see a link to security insights and recommendations.

3. Click on the link (example link). You will see a process monitor view of what activities happened as part of each step. This currently includes the programs that made outbound calls and did file writes to source code or dependencies.

4. Below the insights, you will see the recommended policy. Add the recommended outbound endpoints to your workflow file, and only traffic to these endpoints will be allowed.

When you use egress-policy: block mode, you can also set disable-telemetry: true to not send telemetry to the StepSecurity API.

Support for private repositories

Install the Harden Runner App if you want to use harden-runner for Private repositories. This App only needs actions: read permissions on your repositories. You can install it on selected repositories, or all repositories in your organization.

Discussions

If you have questions or ideas, please use discussions.

1. Support for private repositories
2. Generation of accurate SBOM (software bill of materials)
3. SLSA Level 1
4. Cryptographically verify tools run as part of the CI/ CD pipeline
5. Automatic signing

Limitations

1. Harden-Runner GitHub Action only works for GitHub-hosted runners. Self-hosted runners are not supported.
2. Only Ubuntu VM is supported. Windows and MacOS GitHub-hosted runners are not supported. There is a discussion about that here.
3. Harden-Runner is not supported when job is run in a container as it needs sudo access on the Ubuntu VM to run.

Testimonials

I think this is a great idea and for the threat model of build-time, an immediate network egress request monitoring makes a lot of sense - Liran Tal, GitHub Star, and Author of Essential Node.js Security

Harden-Runner strikes an elegant balance between ease-of-use, maintainability, and mitigation that I intend to apply to all of my 300+ npm packages. I look forward to the tool’s improvement over time - Jordan Harband, Open Source Maintainer

Harden runner from Step security is such a nice solution, it is another piece of the puzzle in helping treat the CI environment like production and solving supply chain security. I look forward to seeing it evolve. - Cam Parry, Senior Site Reliability Engineer, Kapiche

Workflows using harden-runner

Some important workflows using harden-runner:

	Repository	Link to insights
1.	nvm-sh/nvm	Link to insights
2.	yannickcr/eslint-plugin-react	Link to insights
3.	microsoft/msquic	Link to insights
4.	ossf/scorecard	Link to insights
5.	Automattic/vip-go-mu-plugins	Link to insights

1-minute Demo Video

harden-runner.mp4