Skip to content

Commit 95d9a5d

Browse files
varunsh-codervarunsh-coder
authored
Merge pull request #606 from step-security/rc-28
Release v2.13.2
2 parents 92c522a + 87e429d commit 95d9a5d

12 files changed

Lines changed: 46 additions & 14 deletions

File tree

‎dist/index.js‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -27698,7 +27698,7 @@ function addSummary() {
2769827698
});
2769927699
}
2770027700
const STATUS_HARDEN_RUNNER_UNAVAILABLE = "409";
27701-
const CONTAINER_MESSAGE = "This job is running in a container. Harden Runner does not run in a container as it needs sudo access to run. This job will not be monitored.";
27701+
const CONTAINER_MESSAGE = "This job is running in a container. Such jobs can be monitored by installing Harden Runner in a custom VM image for GitHub-hosted runners.";
2770227702
const UBUNTU_MESSAGE = "This job is not running in a GitHub Actions Hosted Runner Ubuntu VM. Harden Runner is only supported on Ubuntu VM. This job will not be monitored.";
2770327703
const SELF_HOSTED_RUNNER_MESSAGE = "This job is running on a self-hosted runner.";
2770427704
const HARDEN_RUNNER_UNAVAILABLE_MESSAGE = "Sorry, we are currently experiencing issues with the Harden Runner installation process. It is currently unavailable.";

‎dist/index.js.map‎

Lines changed: 1 addition & 1 deletion
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎dist/post/index.js‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -27705,7 +27705,7 @@ function addSummary() {
2770527705
});
2770627706
}
2770727707
const STATUS_HARDEN_RUNNER_UNAVAILABLE = "409";
27708-
const CONTAINER_MESSAGE = "This job is running in a container. Harden Runner does not run in a container as it needs sudo access to run. This job will not be monitored.";
27708+
const CONTAINER_MESSAGE = "This job is running in a container. Such jobs can be monitored by installing Harden Runner in a custom VM image for GitHub-hosted runners.";
2770927709
const UBUNTU_MESSAGE = "This job is not running in a GitHub Actions Hosted Runner Ubuntu VM. Harden Runner is only supported on Ubuntu VM. This job will not be monitored.";
2771027710
const SELF_HOSTED_RUNNER_MESSAGE = "This job is running on a self-hosted runner.";
2771127711
const HARDEN_RUNNER_UNAVAILABLE_MESSAGE = "Sorry, we are currently experiencing issues with the Harden Runner installation process. It is currently unavailable.";
@@ -27867,6 +27867,9 @@ var cleanup_awaiter = (undefined && undefined.__awaiter) || function (thisArg, _
2786727867
if (process.env.STATE_selfHosted === "true") {
2786827868
return;
2786927869
}
27870+
if (process.env.STATE_customVMImage === "true") {
27871+
return;
27872+
}
2787027873
if (process.env.STATE_isTLS === "false" && process.arch === "arm64") {
2787127874
return;
2787227875
}

‎dist/post/index.js.map‎

Lines changed: 1 addition & 1 deletion
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎dist/pre/index.js‎

Lines changed: 15 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -85248,7 +85248,7 @@ function addSummary() {
8524885248
});
8524985249
}
8525085250
const STATUS_HARDEN_RUNNER_UNAVAILABLE = "409";
85251-
const CONTAINER_MESSAGE = "This job is running in a container. Harden Runner does not run in a container as it needs sudo access to run. This job will not be monitored.";
85251+
const CONTAINER_MESSAGE = "This job is running in a container. Such jobs can be monitored by installing Harden Runner in a custom VM image for GitHub-hosted runners.";
8525285252
const UBUNTU_MESSAGE = "This job is not running in a GitHub Actions Hosted Runner Ubuntu VM. Harden Runner is only supported on Ubuntu VM. This job will not be monitored.";
8525385253
const SELF_HOSTED_RUNNER_MESSAGE = "This job is running on a self-hosted runner.";
8525485254
const HARDEN_RUNNER_UNAVAILABLE_MESSAGE = "Sorry, we are currently experiencing issues with the Harden Runner installation process. It is currently unavailable.";
@@ -85495,8 +85495,8 @@ var external_crypto_ = __nccwpck_require__(6982);
8549585495

8549685496
const CHECKSUMS = {
8549785497
tls: {
85498-
amd64: "2430b850e0e4d67a2f3b626f02d2827226ee16406da6af0c47ae7b18e18bd2b8",
85499-
arm64: "a3c89271e697ab39557ba8011cac7a2df690b5d27b4584d5d5abdf8845a6ce6c",
85498+
amd64: "603d6a0dabb60a7c8f651d7f5b53258fa64162424a77da9884d9032b3e71d6b1",
85499+
arm64: "fdc7504a3210dc67fc8393969b0f3c98df593c7884c83ed6d1c0ec84070801aa",
8550085500
},
8550185501
non_tls: {
8550285502
amd64: "336093af8ebe969567b66fd035af3bd4f7e1c723ce680d6b4b5b2a1f79bc329e", // v0.14.2
@@ -85549,7 +85549,7 @@ function installAgent(isTLS, configStr) {
8554985549
encoding: "utf8",
8555085550
});
8555185551
if (isTLS) {
85552-
downloadPath = yield tool_cache.downloadTool(`https://github.com/step-security/agent-ebpf/releases/download/v1.6.23/harden-runner_1.6.23_linux_${variant}.tar.gz`, undefined, auth);
85552+
downloadPath = yield tool_cache.downloadTool(`https://github.com/step-security/agent-ebpf/releases/download/v1.7.6/harden-runner_1.7.6_linux_${variant}.tar.gz`, undefined, auth);
8555385553
}
8555485554
else {
8555585555
if (variant === "arm64") {
@@ -85764,6 +85764,17 @@ var setup_awaiter = (undefined && undefined.__awaiter) || function (thisArg, _ar
8576485764
}
8576585765
return;
8576685766
}
85767+
if (isGithubHosted() && process.env.STEP_SECURITY_HARDEN_RUNNER === "true") {
85768+
external_fs_.appendFileSync(process.env.GITHUB_STATE, `customVMImage=true${external_os_.EOL}`, {
85769+
encoding: "utf8",
85770+
});
85771+
lib_core.info("This job is running on a custom VM image with Harden Runner installed.");
85772+
if (confg.egress_policy === "block") {
85773+
sendAllowedEndpoints(confg.allowed_endpoints);
85774+
yield setup_sleep(5000);
85775+
}
85776+
return;
85777+
}
8576785778
let _http = new lib.HttpClient();
8576885779
let statusCode;
8576985780
_http.requestOptions = { socketTimeout: 3 * 1000 };

‎dist/pre/index.js.map‎

Lines changed: 1 addition & 1 deletion
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎docs/limitations.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
### GitHub-Hosted Runners
44

55
* Only Ubuntu VM is supported. Windows and MacOS GitHub-hosted runners are not supported. There is a discussion about that [here](https://github.com/step-security/harden-runner/discussions/121).
6-
* Harden-Runner is not supported when [job is run in a container](https://docs.github.com/en/actions/using-jobs/running-jobs-in-a-container) as it needs sudo access on the Ubuntu VM to run. It can be used to monitor jobs that use containers to run steps. The limitation is if the entire job is run in a container. That is not common for GitHub Actions workflows, as most of them run directly on `ubuntu-latest`. Note: This is not a limitation for Self-Hosted runners.
6+
* Harden-Runner is not supported when [job is run in a container](https://docs.github.com/en/actions/using-jobs/running-jobs-in-a-container) with built-in labels such as `ubuntu-latest`, as it needs sudo access on the Ubuntu VM to run. The limitation is if the entire job is run in a container. However, such jobs can be monitored when using custom VM images with GitHub-hosted runners. This is also not a limitation for Self-Hosted runners.
77

88
### Self-Hosted Actions Runner Controller (ARC) Runners
99

‎src/checksum.ts‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -4,8 +4,8 @@ import * as fs from "fs";
44

55
const CHECKSUMS = {
66
tls: {
7-
amd64: "2430b850e0e4d67a2f3b626f02d2827226ee16406da6af0c47ae7b18e18bd2b8", // v1.6.23
8-
arm64: "a3c89271e697ab39557ba8011cac7a2df690b5d27b4584d5d5abdf8845a6ce6c",
7+
amd64: "603d6a0dabb60a7c8f651d7f5b53258fa64162424a77da9884d9032b3e71d6b1", // v1.7.6
8+
arm64: "fdc7504a3210dc67fc8393969b0f3c98df593c7884c83ed6d1c0ec84070801aa",
99
},
1010
non_tls: {
1111
amd64: "336093af8ebe969567b66fd035af3bd4f7e1c723ce680d6b4b5b2a1f79bc329e", // v0.14.2

‎src/cleanup.ts‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,10 @@ import { isGithubHosted } from "./tls-inspect";
2525
return;
2626
}
2727

28+
if (process.env.STATE_customVMImage === "true") {
29+
return;
30+
}
31+
2832
if (process.env.STATE_isTLS === "false" && process.arch === "arm64") {
2933
return;
3034
}

‎src/common.ts‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -126,7 +126,7 @@ export async function addSummary() {
126126
export const STATUS_HARDEN_RUNNER_UNAVAILABLE = "409";
127127

128128
export const CONTAINER_MESSAGE =
129-
"This job is running in a container. Harden Runner does not run in a container as it needs sudo access to run. This job will not be monitored.";
129+
"This job is running in a container. Such jobs can be monitored by installing Harden Runner in a custom VM image for GitHub-hosted runners.";
130130

131131
export const UBUNTU_MESSAGE =
132132
"This job is not running in a GitHub Actions Hosted Runner Ubuntu VM. Harden Runner is only supported on Ubuntu VM. This job will not be monitored.";

0 commit comments

Comments
 (0)