lfreleng-actions/🛡️ Harden Runner: Block-mode Allow-list Loader
Loads an allowed-endpoints egress allow-list from a local file or remote URL (with sensible defaults), sanitises it, and publishes it as an environment variable that a subsequent step-security/harden-runner step can consume in 'block' egress mode.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Activelast commit Jul 8, 2026
- License
- None
Pinned Snippet
uses: lfreleng-actions/harden-runner-block-action@6db537b3e6d060c3287c5a3ce2c28b55b0af330d # v0.2.1tags can be moved; commit SHAs can't. why a SHA?
Inputs
| name | description | required | default |
|---|---|---|---|
| allow_list_path | Local filesystem path to an allow-list file. When supplied, the action ignores the 'url' and 'org' inputs. The file must contain a list of host[:port] entries separated by whitespace (single or multi-line accepted; '#' introduces a comment, either as a full-line comment or trailing on a line). Must not contain newline characters in the path string itself. | no | "" |
| url | Remote URL from which to download the allow-list file. Ignored when 'allow_list_path' is supplied. When neither 'allow_list_path' nor 'url' is provided, the action constructs a default URL using the 'org' input. Must not contain newline characters. | no | "" |
| org | GitHub organisation/owner used to construct the default allow-list URL. When omitted, defaults at runtime to the current repository owner (github.repository_owner). Ignored when 'allow_list_path' is set or 'url' is supplied explicitly. | no | "" |
| env_var_name | Name of the environment variable to publish to subsequent steps. Must match ^[A-Z_][A-Z0-9_]*$ (uppercase letters, digits, underscores; cannot start with a digit). | no | CONNECTION_ALLOW_LIST |
| config | GitHub-Actions 'uses:'-style coordinate identifying a remote allow-list file, fetched with a shallow, ref-pinned git fetch (branch, tag or commit SHA). Mutually exclusive with the 'allow_list_path', 'url' and 'org' inputs; supplying any of them together with 'config' is an error. See the README for the full grammar. Examples: lfreleng-actions@main lfit@v1.1.0 lfit//custom_list.txt@v1.1.0 lfit//@<sha> | no | "" |
| token | Token used to authenticate the git fetch when 'config' targets a private host repository. Leave empty for public repositories. GITHUB_TOKEN only grants access to the current repository; reading a private config repo in another org needs a PAT or GitHub App token with contents:read on that repo. | no | "" |
| allow_list_summary | Whether to write the allow-list/config block to the job step summary. Set to 'false' to suppress it. Useful for matrix jobs, where the same block would otherwise repeat once per leg; emit it on a single matrix leg only (see the README for the strategy.job-index pattern). | no | true |
Outputs
| name | description |
|---|---|
| allowed_endpoints | The sanitised, space-separated allowed-endpoints allow-list string. |
| source | The source from which the action loaded the allow-list: 'path', 'url', 'default-url' or 'config'. |
| resolved_url | When the action fetched the allow-list from a URL, the URL that it used. Empty when the source was a local 'path' or 'config' (config mode reports the resolved_* outputs instead). |
| resolved_host_org | Host org the allow-list was fetched from (config mode). |
| resolved_repo | Repository the allow-list was fetched from (config mode). |
| resolved_ref | Git ref requested for the config fetch (config mode). |
| resolved_sha | Exact commit SHA the config ref resolved to (config mode). |
| resolved_path | In-repo path of the matched config file (config mode). |
| matched_candidate | Which search candidate matched: org-specific, family-default or explicit (config mode). |