Merge pull request #97 from bjhargrave/step-security-block

ci: Limit egress to defined endpoints
bjhargrave · Apr 25, 2024 · 2c18045 · 2c18045
2 parents 3b73612 + 8d2ab41
commit 2c18045
Show file tree

Hide file tree

Showing 4 changed files with 33 additions and 8 deletions.
diff --git a/.github/workflows/cibuild.yml b/.github/workflows/cibuild.yml
@@ -44,9 +44,19 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
     - name: Harden Runner
-      uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142
+      uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0
       with:
-        egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
+        disable-sudo: true
+        egress-policy: block
+        allowed-endpoints: >
+          downloads.gradle.org:443
+          github.com:443
+          jcenter.bintray.com:443
+          objects.githubusercontent.com:443
+          plugins-artifacts.gradle.org:443
+          plugins.gradle.org:443
+          repo.maven.apache.org:443
+          services.gradle.org:443
 
     - name: Git Checkout
       uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b

diff --git a/.github/workflows/dependency-submission.yml b/.github/workflows/dependency-submission.yml
@@ -27,9 +27,16 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
     - name: Harden Runner
-      uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142
+      uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0
       with:
-        egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
+        disable-sudo: true
+        egress-policy: block
+        allowed-endpoints: >
+          api.github.com:443
+          github.com:443
+          plugins-artifacts.gradle.org:443
+          plugins.gradle.org:443
+          repo.maven.apache.org:443
 
     - name: Git Checkout
       uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b

diff --git a/.github/workflows/stale.yml b/.github/workflows/stale.yml
@@ -21,9 +21,12 @@ jobs:
     runs-on: 'ubuntu-latest'
     steps:
     - name: Harden Runner
-      uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142
+      uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0
       with:
-        egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
+        disable-sudo: true
+        egress-policy: block
+        allowed-endpoints: >
+          api.github.com:443
 
     - name: Stale Action
       uses: actions/stale@28ca1036281a5e5922ead5184a1bbf96e5fc984e

diff --git a/.github/workflows/wrapper.yml b/.github/workflows/wrapper.yml
@@ -30,9 +30,14 @@ jobs:
     runs-on: 'ubuntu-latest'
     steps:
     - name: Harden Runner
-      uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142
+      uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0
       with:
-        egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
+        disable-sudo: true
+        egress-policy: block
+        allowed-endpoints: >
+          downloads.gradle.org:443
+          github.com:443
+          services.gradle.org:443
 
     - name: Git Checkout
       uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b