From aa2789c6b4475fdf989e4312cd71c098234c38f9 Mon Sep 17 00:00:00 2001 From: Mohit Bansal Webflow Date: Thu, 3 Sep 2026 21:04:14 -0700 Subject: [PATCH] [discussion] Add harden-runner (audit mode) to release job Allowlist step-security/harden-runner and wire it into publish-source-release as an audit-only first step, ahead of the pending cosign/SBOM/notarization pipeline restoration that will bring real signing credentials into this job. Scoped to this one job only; see .github/action-allowlist.txt for the rationale. --- .github/action-allowlist.txt | 21 +++++++++++++++++++++ .github/workflows/release.yml | 9 +++++++++ 2 files changed, 30 insertions(+) diff --git a/.github/action-allowlist.txt b/.github/action-allowlist.txt index 23b5545..9bbdb41 100644 --- a/.github/action-allowlist.txt +++ b/.github/action-allowlist.txt @@ -53,3 +53,24 @@ ossf/scorecard-action # (build commits committed mid-build can't tamper). Collaborated on by # Google, Chainguard, and the Linux Foundation. slsa-framework/slsa-github-generator + +# --- StepSecurity --- +# Harden-Runner. Not a wrapper around a tool we'd otherwise invoke via +# `run:` — its whole function is hooking the runner's networking before +# anything else in the job executes, which a plain script can't do. +# Added as the first step of release.yml's publish-source-release job +# only, in `egress-policy: audit` (observe, never block). That job is +# the one place in this repo with a `contents: write` token behind an +# environment gate, and it's the job the not-yet-restored cosign/SBOM/ +# notarization pipeline (see release.yml history) will land in — this +# gets egress visibility wired in ahead of that, rather than as a +# follow-up once real signing/notarization credentials are present. +# Deliberately not added to lint/test/build/codeql/vuln-scan/scorecard: +# none of those jobs carry a token or secret worth watching, and +# per-job StepSecurity is a privileged eBPF-based agent, not a passive +# action — running it where there's nothing to protect is added attack +# surface and an added external-service dependency for zero benefit. +# Maintainer: StepSecurity (venture-backed security co., not a single +# maintainer); action is widely adopted (OpenSSF, many CNCF projects). +# Pinned SHA: e14015d583714f6e62063499dc959a02595150a1 # v2.21.1 +step-security/harden-runner diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 7c4238b..106e467 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -37,6 +37,15 @@ jobs: permissions: contents: write # create the GitHub Release steps: + # Audit-only egress visibility on the one job in this repo that + # holds a write-scoped token behind an environment gate. See + # .github/action-allowlist.txt for the scoping rationale. Never + # blocking — this is observation, not enforcement. + - name: Harden Runner + uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1 + with: + egress-policy: audit + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0