wraith-security/Legion Runner

Stop CI supply chain attacks at the network layer. Legion records and blocks every outbound connection from a GitHub Actions job and names the process behind it. Open source, self contained, no account, no data leaves the runner.

Trust Signals

Scorecard Score: not yet scored
Maintenance Recency: Stale
License: None

Inputs

name	description	required	default
egress-policy	"audit" (monitor only, never breaks builds) or "block" (default-deny egress allowlist).	no	audit
allowed-endpoints	Endpoints to permit in block mode, one per line or space/comma separated, as "host" or "host:port" ( "api.nuget.org:443"). GitHub/Actions endpoints are always allowed when allow-github is true.	no	""
allowed-presets	Comma/space-separated curated ecosystem allowlists to permit in block mode, so common toolchains "just work" without listing endpoints. Known presets: npm, yarn, pnpm, pip, pypi, cargo, rust, go, maven, gradle, nuget, apt, debian, docker. Example: "cargo, apt".	no	""
allow-github	Always allow GitHub + Actions endpoints (so the job can still talk to GitHub).	no	true
policy-file	Path (in the repo) to the learned egress allowlist. In audit mode the observed destinations are surfaced as a baseline; in block mode this file's hosts are part of the allowlist. Commit it to enforce a reviewable policy.	no	.legion/egress-allowed.txt
learn	In audit mode, write/update the policy-file with the destinations observed this run (otherwise the baseline is only printed to the job summary).	no	false
learned-baseline	In block mode, also allow destinations previously learned into the Actions cache (the zero-config learn→enforce baseline). Set to "false" to enforce ONLY the explicit allowlist (inline endpoints + policy-file + GitHub), with no cache read or write.	no	true
disable-sudo	Revoke the runner user's sudo after setup, to stop later privilege use.	no	false
disable-telemetry	Do not emit any lifecycle events (Legion link / step summary stays local).	no	false
legion-link	Optional Legion desktop endpoint (e.g. http://host:3000) to stream job egress events to.	no	""
dns-capture	Route the resolver through a local logging forwarder to map connections to the exact domains the job resolved (more accurate than reverse DNS). Requires sudo; falls back to reverse DNS if unavailable.	no	true
ebpf	Use the Rust/aya eBPF agent (legionr-bpf) for socket-layer connection capture with process attribution when present. "auto" (use if available) or "off". Falls back to the ss//proc sampler otherwise.	no	auto
sample-interval	Seconds between egress samples for the monitor.	no	3
file-integrity	Detect file tampering during the job. The Rust legionr-fim agent snapshots high-value targets at job start (credential/config files, the repo's .git config + hooks, and any already-checked-out source) and reports anything overwritten, deleted, or chmod'd at job end. "auto" (use if available) or "off". Skips silently if the agent binary can't be obtained.	no	auto
fim-extra-paths	Additional files to watch for tampering, one per line or space/comma separated. Useful for project-specific secrets or scripts.	no	""
job-summary	Write the outbound-connections table to the GitHub job summary. Set to "false" to keep monitoring/enforcement fully active but suppress the table (useful when many jobs in one workflow each harden and you only want the summary once).	no	true

Outputs

no outputs