v2.1.0

What's Changed

• Add harden-runner insights URL in job summary by @h0x0er and @varunsh-coder in #227.
  This makes it easier to locate and click on the insights link. One had to look for it in the build log earlier.
• Update README.md by @varunsh-coder in #210
• Bump github/codeql-action from 2.1.29 to 2.1.31 by @dependabot in #206
• Bump step-security/harden-runner from 1.5.0 to 2.0.0 by @dependabot in #211
• Update README by @varunsh-coder in #216
• Bump ossf/scorecard-action from 2.0.6 to 2.1.0 by @dependabot in #221
• Bump github/codeql-action from 2.1.31 to 2.1.37 by @dependabot in #220
• Bump ossf/scorecard-action from 2.1.0 to 2.1.2 by @dependabot in #223
• Bump actions/upload-artifact from 3.1.1 to 3.1.2 by @dependabot in #225
• Bump actions/checkout from 3.1.0 to 3.3.0 by @dependabot in #224

Full Changelog: v2...v2.1.0

v2.0.0

Release v2.0.0

• Feature to disable sudo: Use disable-sudo: true to run job steps without sudo access on the GitHub-hosted runner. disable-sudo is false by default and needs to be opted-into. (documentation)
• File monitoring improvements: All source code files are monitored now for overwrite, instead of a few extensions. Instead of getting annotations for overwrites, you can also opt-in to getting email or Slack notifications if source code is overwritten. (documentation)
• Support for private repositories: Starting with Harder Runner v2.0.0, use of harden runner for private repositories will require a Team/ Enterprise license. Harder Runner GitHub Action is free for all public repositories.

What's Changed

• Update README.md by @varunsh-coder in #187
• Bump step-security/harden-runner from 1.4.5 to 1.5.0 by @dependabot in #188
• Bump github/codeql-action from 2.1.22 to 2.1.26 by @dependabot in #189
• Add scorecard by @varunsh-coder in #192
• Bump actions/checkout from 3.0.0 to 3.1.0 by @dependabot in #198
• Bump github/codeql-action from 2.1.26 to 2.1.27 by @dependabot in #197
• Bump actions/upload-artifact from 3.0.0 to 3.1.0 by @dependabot in #194
• Bump ossf/scorecard-action from 2.0.4 to 2.0.6 by @dependabot in #202
• Bump github/codeql-action from 2.1.27 to 2.1.28 by @dependabot in #201
• Bump actions/upload-artifact from 3.1.0 to 3.1.1 by @dependabot in #203
• Bump github/codeql-action from 2.1.28 to 2.1.29 by @dependabot in #204
• Update README by @varunsh-coder in #208

Full Changelog: v1...v2.0.0

v1.5.0

What's Changed

• Add cache endpoint to allowed list automatically by @h0x0er and @varunsh-coder in #186
• Improve annotation messages

Full Changelog: v1...v1.5.0

v1.4.5

What's Changed

• Fix bug (#152) that caused service containers to not work
• Release v1.4.5 by @varunsh-coder in #156

Full Changelog: v1...v1.4.5

v1.4.4

What's Changed

• Update agent to use reproducible build by @varunsh-coder in #149
• Add a project banner by @boahc077 in #146

New Contributors

• @boahc077 made their first contribution in #146

Full Changelog: v1...v1.4.4

v1.4.3

What's Changed

• Fix performance issues related to file monitoring
• Limit annotations for source code overwrites

Full Changelog: v1...v1.4.3

v1.4.2

• Do not fail workflow and show message if Harden Runner is running in a container
• Add "StepSecurity Harden Runner" as prefix to annotation message when source code change detected
• Update dependencies
• Add limitations section to ReadMe
• Update description in package.json and action.yml

v1.4.1

What's Changed

Updated agent to not block UDP traffic in audit mode in #112
Updated agent to not show annotation when calls to api.snapcraft.io are blocked in #113
Updated dependencies

Full Changelog: v1...v1.4.1

v1.4.0

What's Changed

• Verify checksum of agent by @h0x0er in #59
• Bumped node version to v16 by @arjundashrath in #72
• Create dependabot.yml by @jauderho in #81
• Avoid rate limiting by using GitHub token by @Devils-Knight in #86
• Improve Harden Runner screenshots by @arjundashrath in #90
• Add feature to disable-telemetry by @arjundashrath in #92

New Contributors

• @h0x0er made their first contribution in #59
• @arjundashrath made their first contribution in #72
• @jauderho made their first contribution in #80
• @Devils-Knight made their first contribution in #86

Full Changelog: v1...v1.4.0

v1.3.0

What's Changed

• Source change detection by @varunsh-coder in #51

Full Changelog: v1...v1.3.0