cisagov/Job preamble

Our standard permissions monitoring and runner hardening that is to be applied at the beginning of each GitHub Actions job.

Trust Signals

name	description	required	default
check_github_status	A Boolean ("true"/"false") value indicating whether or not to check GitHub status using the crazy-max/ghaction-github-status GitHub action.	no	false
harden_runner	A Boolean ("true"/"false") value indicating whether or not to harden the runner using the step-security/harden-runner GitHub action.	no	true
harden_runner_egress_policy	The egress policy to use for runner hardening. Valid values are audit and block. See step-security/harden-runner for more details.	no	audit
monitor_permissions	A Boolean ("true"/"false") value indicating whether or not to monitor GitHub permission requests using the GitHubSecurityLab/actions-permission/monitor GitHub action.	no	true
output_workflow_context	A Boolean ("true"/"false") value indicating whether or not to output the workflow context using the crazy-max/ghaction-dump-context GitHub action.	no	false
permissions_monitoring_config	A JSON string containing the configuration to use for permissions monitoring. In the case of cisagov you will almost usually to set this to `\$\{\{ vars.ACTIONS_PERMISSIONS_CONFIG \}\}` so it agrees with our organization-wide GitHub Actions permissions monitoring configuration. See the documentation for the GitHubSecurityLab/actions-permission/monitor action for more details: https://github.com/GitHubSecurityLab/actions-permissions/tree/main/monitor#configuration	no	""

no outputs