Repository navigation
ci(harden-runner): Add caller-configurable egress inputs and enforce block mode - #100
Merged
Merged
Conversation
…inputs Expose egress-policy (string, default "audit") and allowed-endpoints (string, default empty) workflow_call inputs in all four reusable workflows and wire them into the step-security/harden-runner step. Audit remains the non-removable floor: no input can disable harden-runner. Callers may opt into block mode by passing egress-policy: block together with allowed-endpoints. The smoke workflow passes egress-policy: audit explicitly so CI exercises the input plumbing path. The five files form one behavioral unit: actionlint validates the smoke workflow's with: keys against the locally referenced reusable workflows' input definitions. Signed-off-by: Yunseo Kim <git@yunseo.kim>
Add a "Harden Runner in Reusable Workflows" subsection under Runner Security explaining why harden-runner must live inside the reusable workflow: a caller job using jobs.<id>.uses cannot define steps, and each job runs on a fresh ephemeral VM so harden-runner only monitors the job it executes in. Document the new egress-policy and allowed-endpoints inputs (audit as the floor, block opt-in), the Policy Store behavior where the calling repository's policy applies to a called reusable workflow, and notes for callers outside the organization. Update the stale v2.21.1 example pins to v2.22.2 to match the workflows, and append GitHub and StepSecurity reference links. Signed-off-by: Yunseo Kim <git@yunseo.kim>
Add the two new caller-facing inputs to the Dependency Review and Scorecard Available Inputs tables, and to the OSV Scanner Standard Defaults list, noting that audit is the minimum floor and allowed-endpoints only takes effect with egress-policy: block. Signed-off-by: Yunseo Kim <git@yunseo.kim>
Document the DCO sign-off requirement (git commit -s, enforced by the lefthook commit-msg hook) and the preference for heredoc commit bodies over repeated -m flags. Signed-off-by: Yunseo Kim <git@yunseo.kim>
Switch this repository's three caller workflows (dependency-review, osv-scanner-smoke, scorecard) from audit to egress-policy: block with allowed-endpoints allowlists derived from months of accumulated audit baseline data in the StepSecurity dashboard. dependency-review allows both api.securityscorecards.dev (the host the action currently queries, per its source) and api.scorecard.dev (forward-looking, in case the action migrates to the current OpenSSF Scorecard API host that scorecard-action already uses for publishing). Signed-off-by: Yunseo Kim <git@yunseo.kim>
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
There was a problem hiding this comment.
1 issue found across 10 files
Confidence score: 3/5
- In
.github/workflows/scorecard.yml, theUpload artifactstep can fail in block mode becauseallowed-endpointsomits the artifact storage endpoints. Add the required endpoints to the allowlist.
Prompt for AI agents (unresolved issues)
Check if these issues are valid — if so, understand the root cause of each and fix them. When an issue isn't valid or won't be fixed in this PR, reply in its thread with the reason and then resolve the thread. If appropriate, use sub-agents to investigate and fix each issue separately.
<file name=".github/workflows/scorecard.yml">
<violation number="1" location=".github/workflows/scorecard.yml:38">
P2: The `allowed-endpoints` list omits the artifact storage endpoints that `actions/upload-artifact` needs, and `upload-artifact` is enabled by default here. In block mode, the "Upload artifact" step in `scorecard-reusable.yml` can fail on `main` after merge. This caller runs only on push, schedule, and branch-protection events, so PR CI will not exercise this change. Confirm the allowlist against an audit run of this job, or add the artifact endpoints before switching to `block`.</violation>
</file>
Reply with feedback, questions, or to request a fix.
View guided diff | Turn on auto-fix | Re-trigger cubic
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Reusable workflows previously hardcoded
step-security/harden-runnertoegress-policy: auditwith no way for callers to opt into block mode. This PR:egress-policy(string, default"audit") andallowed-endpoints(string, default empty)workflow_callinputs to all four reusable workflows (OSV Scanner PR/Full, Dependency Review, Scorecard) and wires them into the harden-runner step. Audit remains the non-removable floor; no input can disable harden-runner.dependency-review.yml,osv-scanner-smoke.yml,scorecard.yml) toegress-policy: blockwith allowlists derived from months of accumulated audit baseline data in the StepSecurity dashboard.jobs.<id>.uses:caller job cannot definesteps:, and harden-runner monitors only the runner VM of the job it executes in) indocs/security/workflow-hardening.md, including Policy Store behavior (the calling repository's policy applies to a called reusable workflow) and notes for cross-organization callers. New inputs are also documented inREADME.md.AGENTS.mdaddition documenting commit conventions (DCO sign-off, heredoc bodies) as a separate commit.How to test: this PR itself is the runtime gate.
osv-scanner-smoke.ymltriggers on changes to.github/workflows/osv-scanner-*.yml, so thepr-smokejob runs the reusable workflow end-to-end in block mode; the StepSecurity dashboard should show the run with blocked-endpoint telemetry and no unexpected egress.Related Issues
Change Type
Changelog
egress-policy/allowed-endpointsinputs so consumer repositories can opt into harden-runner block mode; audit remains the default floor.Changelog update:
CHANGELOG.md[Unreleased]updatedCHANGELOG.md)Checklist
General
type(scope): SummaryCI/Workflow Changes (if applicable)
If this PR modifies GitHub Actions workflows or CI/CD configuration, it must comply with our
Supply Chain Integrity requirements:
uses:references are pinned to full 40-character commit SHAs (with# vX.Y.Zcomment) — no newuses:references addedstep-security/harden-runneris included as the first step in every job — unchanged; reusable workflow jobs retain it, andjobs.<id>.uses:caller jobs cannot define steps (documented inworkflow-hardening.md)permissionsare used instead of top-levelpermissionsProtocol / Compatibility Impact
If impacted, describe compatibility impact:
Backward compatible: both new inputs have defaults matching previous behavior (
audit, empty endpoints), so existing consumers are unaffected unless they opt in.Testing
Describe test evidence:
actionlintpasses on all workflow files, including validation of the smoke workflow'swith:keys against the local reusable workflow input definitions"audit","") asserted programmaticallybun run lint:md(0 issues, 18 files) andbun run format:check(38 files) passapi.scorecard.devis scorecard-action v2.5.0's publish base URL (action.yaml); dependency-review-action'sscorecard.tsqueriesapi.deps.dev+api.securityscorecards.dev; SARIF upload usesapi.github.com; harden-runner's own telemetry endpoints are automatically allowed per StepSecurity docspr-smokejob exercises the input plumbing end-to-end in block mode (workflow files cannot be executed locally)Documentation
docs/security/workflow-hardening.md— new "Harden Runner in Reusable Workflows" section, stale v2.21.1 example pins corrected to v2.22.2, reference links added)Rollout / Risk
egress-policy: auditin the affected caller workflow (single input flip, no reusable workflow change needed).Reviewer Checklist