Releases: step-security/harden-runner
Releases · step-security/harden-runner
v2.4.1
What's Changed
Release v2.4.1 by @varunsh-coder and @Devils-Knight in #309
This release
- Shows a preview of the network events in the job summary markdown
- Uses a fallback DNS service from Cloudflare in addition to Google DNS to improve reliability
Full Changelog: v2...v2.4.1
v2.4.0
What's Changed
- Release v2.4.0 by @varunsh-coder and @h0x0er in #292
Adds support for wildcard domains inblock
mode. e.g. you can add*.data.mcr.microsoft.com:443
to the allowed list, and egress traffic will be allowed toeastus.data.mcr.microsoft.com:443
andwestus.data.mcr.microsoft.com:443
.
Link to documentation. - Bump actions/checkout from 3.5.0 to 3.5.2 by @dependabot in #277
- Bump github/codeql-action from 2.2.11 to 2.2.12 by @dependabot in #278
- Bump step-security/harden-runner from 2.3.0 to 2.3.1 by @dependabot in #282
- Added a workflow for reviewing code changes using stepsecurity code reviewer by @boahc077 in #290
Full Changelog: v2...v2.4.0
v2.3.1
What's Changed
- Release v2.3.1 by @arjundashrath and @varunsh-coder in #281
Fixes #279 and #275 - Update README.md by @varunsh-coder in #267
- Bump step-security/harden-runner from 2.2.1 to 2.3.0 by @dependabot in #268
- Bump codecov/codecov-action from 3.1.1 to 3.1.2 by @dependabot in #273
- Bump ossf/scorecard-action from 2.1.2 to 2.1.3 by @dependabot in #265
- Bump actions/checkout from 3.3.0 to 3.5.0 by @dependabot in #261
- Bump github/codeql-action from 2.2.6 to 2.2.11 by @dependabot in #270
Full Changelog: v2...v2.3.1
v2.3.0
What's Changed
- Enable setting policy via insights website (link to documentation) by @h0x0er and @varunsh-coder in #266
The Policy Store helps you manage Harden Runner policies without altering your workflow files. - Update README.md by @varunsh-coder in #255
- Bump github/codeql-action from 2.2.4 to 2.2.6 by @dependabot in #254
- Bump step-security/harden-runner from 2.2.0 to 2.2.1 by @dependabot in #256
Full Changelog: v2...v2.3.0
v2.2.1
What's Changed
- Fix issue to get cache endpoint by @h0x0er in #253
Harden runner has the ability to automatically detect the cache endpoint used by each job. When Harden runner is used in block mode, this endpoint is added to the list of allowed endpoints. A fix has been implemented to improve this feature by updating the logic used to fetch the cache endpoint. This update involves using code from the actions/cache library to ensure the endpoint is properly retrieved. - Update README.md by @varunsh-coder in #247
- Bump step-security/harden-runner from 2.1.0 to 2.2.0 by @dependabot in #248
- Bump github/codeql-action from 2.1.38 to 2.2.4 by @dependabot in #244
Full Changelog: v2...v2.2.1
v2.2.1
What's Changed
- Fix issue to get cache endpoint by @h0x0er in #253
Harden runner has the ability to automatically detect the cache endpoint used by each job. When Harden runner is used in block mode, this endpoint is added to the list of allowed endpoints. A fix has been implemented to improve this feature by updating the logic used to fetch the cache endpoint. This update involves using code from the actions/cache library to ensure the endpoint is properly retrieved. - Update README.md by @varunsh-coder in #247
- Bump step-security/harden-runner from 2.1.0 to 2.2.0 by @dependabot in #248
- Bump github/codeql-action from 2.1.38 to 2.2.4 by @dependabot in #244
Full Changelog: v2...v2.2.1
v2.2.0
What's Changed
- Release v2.2.0 by @varunsh-coder in #245
- Added functionality that allows for skipping Harden Runner installation if any errors arise during the installation process.
- Updated Harden-Runner GitHub Action to use the latest version of the Harden Runner agent, which resolves three issues:
- Addressed a bug that allowed calls to direct IP addresses not included in the allowed list when executing code in a docker image.
- Enhanced annotations to eliminate false positives, specifically not showing false positive calls to docker.io
- Upgraded
containerd
dependency to a non-vulnerable version.
- Bump codecov/codecov-action from 2.1.0 to 3.1.1 by @dependabot in #233
- Bump step-security/harden-runner from 2.0.0 to 2.1.0 by @dependabot in #232
- Bump github/codeql-action from 2.1.37 to 2.1.38 by @dependabot in #229
- Update README.md by @varunsh-coder in #231
Full Changelog: v2...v2.2.0
v2.1.0
What's Changed
- Add harden-runner insights URL in job summary by @h0x0er and @varunsh-coder in #227.
This makes it easier to locate and click on the insights link. One had to look for it in the build log earlier. - Update README.md by @varunsh-coder in #210
- Bump github/codeql-action from 2.1.29 to 2.1.31 by @dependabot in #206
- Bump step-security/harden-runner from 1.5.0 to 2.0.0 by @dependabot in #211
- Update README by @varunsh-coder in #216
- Bump ossf/scorecard-action from 2.0.6 to 2.1.0 by @dependabot in #221
- Bump github/codeql-action from 2.1.31 to 2.1.37 by @dependabot in #220
- Bump ossf/scorecard-action from 2.1.0 to 2.1.2 by @dependabot in #223
- Bump actions/upload-artifact from 3.1.1 to 3.1.2 by @dependabot in #225
- Bump actions/checkout from 3.1.0 to 3.3.0 by @dependabot in #224
Full Changelog: v2...v2.1.0
v2.0.0
Release v2.0.0
- Feature to disable sudo: Use
disable-sudo: true
to run job steps without sudo access on the GitHub-hosted runner.disable-sudo
isfalse
by default and needs to be opted-into. (documentation) - File monitoring improvements: All source code files are monitored now for overwrite, instead of a few extensions. Instead of getting annotations for overwrites, you can also opt-in to getting email or Slack notifications if source code is overwritten. (documentation)
- Support for private repositories: Starting with Harder Runner v2.0.0, use of harden runner for private repositories will require a Team/ Enterprise license. Harder Runner GitHub Action is free for all public repositories.
What's Changed
- Update README.md by @varunsh-coder in #187
- Bump step-security/harden-runner from 1.4.5 to 1.5.0 by @dependabot in #188
- Bump github/codeql-action from 2.1.22 to 2.1.26 by @dependabot in #189
- Add scorecard by @varunsh-coder in #192
- Bump actions/checkout from 3.0.0 to 3.1.0 by @dependabot in #198
- Bump github/codeql-action from 2.1.26 to 2.1.27 by @dependabot in #197
- Bump actions/upload-artifact from 3.0.0 to 3.1.0 by @dependabot in #194
- Bump ossf/scorecard-action from 2.0.4 to 2.0.6 by @dependabot in #202
- Bump github/codeql-action from 2.1.27 to 2.1.28 by @dependabot in #201
- Bump actions/upload-artifact from 3.1.0 to 3.1.1 by @dependabot in #203
- Bump github/codeql-action from 2.1.28 to 2.1.29 by @dependabot in #204
- Update README by @varunsh-coder in #208
Full Changelog: v1...v2.0.0
v1.5.0
What's Changed
- Add cache endpoint to allowed list automatically by @h0x0er and @varunsh-coder in #186
- Improve annotation messages
Full Changelog: v1...v1.5.0