Adopt StepSecurity Harden Runner for GitHub Actions
Nobody has claimed this yet.
Assessment
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Newbie friendliness
- 25/100
Research direction
Review the GitHub Actions configurations and the referenced PRs for loopback/cicd and loopback/loopback.io, then compare the proposed adoption with StepSecurity Harden Runner's Ubuntu, sudo, and container-action limitations. Done means the applicable repositories use the action to audit the stated risks and the repository checklist reflects their status.
Written by the indexing model from the issue text.
Description
The StepSecurity Harden Runner GitHub Action contains a Go-based client which would audit and, if configured, restrict the following:
- Of Interest:
- Source code overwriting
- Network activity
- Others (not as relevant):
- GitHub Action workflow permission
- GitHub Action pinning
Limitations:
- Ubuntu OS only
- GitHub Actions only (No Travis CI or AppVeyor)
- Does not work with container-based actions (Requires
sudoprivileges)
Although StepSecurity's Online Tool is referenced by the OpenSSF Scorecard Guide, the "Harden Runner" GitHub Action is not actually referenced or recommended. However, "Harden Runner" is used within the OpenSSF Scorecard GitHub Repository itself.
StepSecurity Harden Runner GitHub Repository: https://github.com/step-security/harden-runner
Loosely-related to https://github.com/loopbackio/security/issues/25 (Part of OpenSSF Scorecard check).
GitHub repositories
- Dominant language
- TypeScript
- Stars
- 4
- Forks
- 1
- PR merge metrics
- No merged PRs in 30d
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from loopbackio/security
-
Difficulty 4/5 3-5 days Newbie friendliness 45/100
loopbackio/security#42 ·
-
Difficulty 5/5 Over a week Newbie friendliness 25/100
loopbackio/security#41 ·
-
Difficulty 5/5 Over a week Newbie friendliness 25/100
loopbackio/security#40 ·
-
openjsf
Difficulty 5/5 Over a week Newbie friendliness 25/100
loopbackio/security#39 ·
-
Difficulty 5/5 Over a week Newbie friendliness 25/100
loopbackio/security#38 ·
All issues in loopbackio/security
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 84/100
Eynzof/Hermes-CN-Desktop#610 ·
-
bug clawsweeper:linked-pr-open clawsweeper:needs-live-repro clawsweeper:no-new-fix-pr impact:message-loss issue-rating: 🐚 platinum hermit P2 regression
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
-
enhancement
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
-
calcite-components needs triage refactor
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
Esri/calcite-design-system#15203 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 90/100
danielmiessler/LifeOS#2218 ·