Skip to content

Commit 58077d3

Browse files
varunsh-codervarunsh-coder
authored
Release v2.15.1 (#641)
1 parent a90bcbc commit 58077d3

12 files changed

Lines changed: 274 additions & 355 deletions

File tree

‎README.md‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,7 @@ Corporate laptops and production servers typically have robust security monitori
1919

2020
Traditional security monitoring and EDR solutions are ineffective for CI/CD runners due to their ephemeral nature. These tools also lack the necessary context to correlate events with specific workflow runs in a CI/CD environment.
2121

22-
StepSecurity Harden-Runner addresses this gap by providing security monitoring tailored for CI/CD runners. This approach brings CI/CD runners under the same level of security scrutiny as other critical systems, addressing a significant gap in the software supply chain.
22+
StepSecurity Harden-Runner addresses this gap by providing security monitoring tailored for CI/CD runners, with support for Linux, Windows, and macOS runners. This approach brings CI/CD runners under the same level of security scrutiny as other critical systems, addressing a significant gap in the software supply chain.
2323
### Harden-Runner: Security Incidents Detected
2424

2525
- [Harden-Runner Detected the tj-actions/changed-files compromise](https://www.stepsecurity.io/blog/harden-runner-detection-tj-actions-changed-files-action-is-compromised) ([CVE-2025-30066](https://github.com/advisories/GHSA-mrrh-fwg8-r2c3))
@@ -138,7 +138,7 @@ Explore the full feature set in the [Features Documentation](https://docs.stepse
138138

139139
## Trusted By and Case Studies
140140

141-
Harden-Runner is trusted by over 8000 leading open-source projects and enterprises, including Microsoft, Google, Kubernetes, and more.
141+
Harden-Runner is trusted by over 11,000 leading open-source projects and enterprises, including Microsoft, Google, Kubernetes, and more.
142142

143143
### Trusted by
144144

@@ -163,7 +163,8 @@ Harden-Runner is designed to work seamlessly across a variety of runner environm
163163

164164
| Environment Type | Compatibility | Audit Mode Deployment | Workflow Changes for Audit Mode |
165165
|------------------|---------------|--------------------------|-------------------|
166-
| GitHub-hosted runners | ✅ Full support | Add Harden-Runner Action to workflow | Yes |
166+
| GitHub-hosted runners (Linux) | ✅ Full support | Add Harden-Runner Action to workflow | Yes |
167+
| GitHub-hosted runners (Windows, macOS) | ✅ Audit mode only | Add Harden-Runner Action to workflow | Yes |
167168
| Self-hosted VM runners | ✅ Full support | Include agent in runner image | No |
168169
| Self-hosted bare-metal runners | ✅ Full support | Install agent as a service | No |
169170
| Actions Runner Controller (ARC) | ✅ Full support | Deploy as DaemonSet | No |

‎dist/index.js‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -32029,6 +32029,7 @@ const SELF_HOSTED_RUNNER_MESSAGE = "This job is running on a self-hosted runner.
3202932029
const HARDEN_RUNNER_UNAVAILABLE_MESSAGE = "Sorry, we are currently experiencing issues with the Harden Runner installation process. It is currently unavailable.";
3203032030
const ARC_RUNNER_MESSAGE = "Workflow is currently being executed in ARC based runner.";
3203132031
const ARM64_RUNNER_MESSAGE = "ARM runners are not supported in the Harden-Runner community tier.";
32032+
const ARM64_WINDOWS_RUNNER_MESSAGE = "Windows ARM runners are not yet supported by Harden-Runner.";
3203232033

3203332034
;// CONCATENATED MODULE: external "node:fs"
3203432035
const external_node_fs_namespaceObject = require("node:fs");

‎dist/index.js.map‎

Lines changed: 1 addition & 1 deletion
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎dist/post/index.js‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -32034,6 +32034,7 @@ const SELF_HOSTED_RUNNER_MESSAGE = "This job is running on a self-hosted runner.
3203432034
const HARDEN_RUNNER_UNAVAILABLE_MESSAGE = "Sorry, we are currently experiencing issues with the Harden Runner installation process. It is currently unavailable.";
3203532035
const ARC_RUNNER_MESSAGE = "Workflow is currently being executed in ARC based runner.";
3203632036
const ARM64_RUNNER_MESSAGE = "ARM runners are not supported in the Harden-Runner community tier.";
32037+
const ARM64_WINDOWS_RUNNER_MESSAGE = "Windows ARM runners are not yet supported by Harden-Runner.";
3203732038

3203832039
// EXTERNAL MODULE: external "path"
3203932040
var external_path_ = __nccwpck_require__(6928);
@@ -32350,6 +32351,10 @@ function handleWindowsCleanup() {
3235032351
console.log("Windows post step already executed, skipping");
3235132352
return;
3235232353
}
32354+
if (process.arch === "arm64") {
32355+
console.log(ARM64_WINDOWS_RUNNER_MESSAGE);
32356+
return;
32357+
}
3235332358
const p = external_child_process_.spawn("powershell.exe", [
3235432359
"-NoProfile",
3235532360
"-NonInteractive",

‎dist/post/index.js.map‎

Lines changed: 1 addition & 1 deletion
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎dist/pre/index.js‎

Lines changed: 160 additions & 307 deletions
Large diffs are not rendered by default.

‎dist/pre/index.js.map‎

Lines changed: 1 addition & 1 deletion
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎osv-scanner.toml‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,4 +8,8 @@ reason = "Untrusted headers are not processed"
88

99
[[IgnoredVulns]]
1010
id = "GHSA-xx4v-prfh-6cgc"
11-
reason = "Untrusted headers are not processed"
11+
reason = "Untrusted headers are not processed"
12+
13+
[[IgnoredVulns]]
14+
id = "GHSA-g9mf-h72j-4rw9"
15+
reason = "undici fetch() is only used to call GitHub API; exploitation requires a malicious server"

‎package-lock.json‎

Lines changed: 86 additions & 39 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎src/cleanup.ts‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -204,6 +204,11 @@ async function handleWindowsCleanup() {
204204
return;
205205
}
206206

207+
if (process.arch === "arm64") {
208+
console.log(common.ARM64_WINDOWS_RUNNER_MESSAGE);
209+
return;
210+
}
211+
207212
const p = cp.spawn(
208213
"powershell.exe",
209214
[

0 commit comments

Comments
 (0)