portswigger-tim/Safer Runner Action
Multi-layer security and reporting for GitHub Actions
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Maintainedlast commit Dec 19, 2025
- License
- MIT
Pinned Snippet
uses: portswigger-tim/safer-runner-action@b2208f653b6bf422e08501155f4df82bad008184 # v1.2.2tags can be moved; commit SHAs can't. why a SHA?
Inputs
| name | description | required | default |
|---|---|---|---|
| mode | Operation mode: "analyze" to log traffic without blocking, "enforce" to block unauthorized domains | no | analyze |
| allowed-domains | Space-separated list of additional domains to allow (beyond GitHub required domains) | no | "" |
| primary-dns-server | Primary DNS server for allowed domains (defaults to Quad9: 9.9.9.9) | no | 9.9.9.9 |
| secondary-dns-server | Secondary DNS server for redundancy (defaults to Quad9 secondary: 149.112.112.112) | no | 149.112.112.112 |
| fail-on-tampering | Whether to fail the workflow after job completion if security configuration tampering is detected | no | false |
| block-risky-github-subdomains | Whether to block risky GitHub subdomains (gist.github.com, gist.githubusercontent.com, raw.githubusercontent.com) in enforce mode. Set to "false" if you need these domains. | no | true |
| disable-sudo | Whether to disable sudo access for the runner user after setup is complete. This prevents malicious code from using sudo to bypass security controls. | no | false |
| sudo-config | Custom sudoers configuration for the runner user (only used when disable-sudo is false). Provide sudoers rules as a multi-line string. | no | "" |
| disable-docker | Whether to remove runner user from docker group. This prevents container usage, blocking container escape attacks and docker socket abuse. | no | false |
| stop-docker | Whether to completely stop and disable the Docker service. This provides stronger protection than disable-docker by preventing all Docker usage system-wide. | no | false |
Outputs
no outputs