portswigger-tim/Safer Runner Action

Multi-layer security and reporting for GitHub Actions

View on GitHub

Trust Signals

Scorecard Score
not yet scored
Maintenance Recency
Maintainedlast commit Dec 19, 2025
License
MIT

Pinned Snippet

workflow.ymlSHA-pinned
uses: portswigger-tim/safer-runner-action@b2208f653b6bf422e08501155f4df82bad008184 # v1.2.2

tags can be moved; commit SHAs can't. why a SHA?

namedescriptionrequireddefault
modeOperation mode: "analyze" to log traffic without blocking, "enforce" to block unauthorized domainsnoanalyze
allowed-domainsSpace-separated list of additional domains to allow (beyond GitHub required domains)no""
primary-dns-serverPrimary DNS server for allowed domains (defaults to Quad9: 9.9.9.9)no9.9.9.9
secondary-dns-serverSecondary DNS server for redundancy (defaults to Quad9 secondary: 149.112.112.112)no149.112.112.112
fail-on-tamperingWhether to fail the workflow after job completion if security configuration tampering is detectednofalse
block-risky-github-subdomainsWhether to block risky GitHub subdomains (gist.github.com, gist.githubusercontent.com, raw.githubusercontent.com) in enforce mode. Set to "false" if you need these domains.notrue
disable-sudoWhether to disable sudo access for the runner user after setup is complete. This prevents malicious code from using sudo to bypass security controls.nofalse
sudo-configCustom sudoers configuration for the runner user (only used when disable-sudo is false). Provide sudoers rules as a multi-line string.no""
disable-dockerWhether to remove runner user from docker group. This prevents container usage, blocking container escape attacks and docker socket abuse.nofalse
stop-dockerWhether to completely stop and disable the Docker service. This provides stronger protection than disable-docker by preventing all Docker usage system-wide.nofalse

no outputs