step-security/Harden-Runner
Harden-Runner provides runtime security for GitHub-hosted and self-hosted runners
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
Inputs
| name | description | required | default |
|---|---|---|---|
| allowed-endpoints | Only these endpoints will be allowed if egress-policy is set to block | no | "" |
| egress-policy | Policy for outbound traffic, can be either audit or block | no | block |
| token | Used to avoid github rate limiting | — | ${{ github.token }} |
| disable-telemetry | Disable sending telemetry to StepSecurity API, can be set to true or false. This can only be set to true when egress-policy is set to block | no | false |
| disable-sudo | Disable sudo access for the runner account. Note: This parameter will be deprecated in the future. Please use disable-sudo-and-containers instead. | no | false |
| disable-sudo-and-containers | Disable sudo and container access for the runner account | no | false |
| disable-file-monitoring | Disable file monitoring | no | false |
| policy | Policy name to be used from the policy store. Requires id-token: write permission. | no | "" |
| api-key | StepSecurity API key for authenticating with the policy store. Required when use-policy-store is set to true. | no | "" |
| use-policy-store | Set to true to fetch policy from the policy store using the API key. This is the preferred method over the policy input which requires id-token: write permission. Policies can be defined and attached at workflow, repo, org, or cluster (for ARC) level in the policy store. The most granular policy will apply. | no | false |
| deploy-on-self-hosted-vm | Set to true to deploy the Harden Runner agent directly on a self-hosted runner VM (Linux only). The recommended approach for self-hosted VMs is to bake the agent into the VM image; see docs.stepsecurity.io. Use this option only if baking is not possible, and only for ephemeral runners. | no | false |
Outputs
no outputs