From 2edf8b6175a87bd3e375afa9bca5cf4f0afb1a8e Mon Sep 17 00:00:00 2001 From: "Dylan M. Taylor" Date: Tue, 10 Nov 2026 07:54:57 -0500 Subject: [PATCH] ci: address review findings for Harden-Runner egress policy - Add allowed-endpoints to ast-grep.yml matching test-ast-grep.yml - Add pypi.org and files.pythonhosted.org to sonarcloud.yml for Python coverage - Add packages.microsoft.com:443 and https mirrors to apt allowed-endpoints - Set unvalidated reusable workflows (release, docker-build, gate, etc.) to audit mode --- .github/workflows/ast-grep.yml | 5 ++++ .github/workflows/changed-paths.yml | 2 +- .github/workflows/docker-build.yml | 4 ++-- .github/workflows/flatpak-oci.yml | 2 +- .github/workflows/freebsd.yml | 2 +- .github/workflows/gate.yml | 2 +- .github/workflows/git-sources.yml | 2 +- .github/workflows/nix.yml | 2 +- .github/workflows/packaging-lint.yml | 3 +++ .github/workflows/refresh-contributors.yml | 2 +- .github/workflows/release.yml | 24 +++++++++---------- .github/workflows/sonarcloud.yml | 20 ++++++++++++++++ .github/workflows/supply-chain.yml | 2 +- .github/workflows/test-freebsd.yml | 2 ++ .github/workflows/test-house-rules.yml | 3 +++ .../workflows/test-install-apt-packages.yml | 2 ++ .github/workflows/windows-arm64.yml | 4 ++-- 17 files changed, 59 insertions(+), 24 deletions(-) diff --git a/.github/workflows/ast-grep.yml b/.github/workflows/ast-grep.yml index 80fbe8c..cc8c605 100644 --- a/.github/workflows/ast-grep.yml +++ b/.github/workflows/ast-grep.yml @@ -39,6 +39,11 @@ jobs: uses: step-security/harden-runner@1d88384fd173af6ecb012dfd0264a306b711241a # v2.22.4 with: egress-policy: block + allowed-endpoints: > + api.github.com:443 + github.com:443 + objects.githubusercontent.com:443 + release-assets.githubusercontent.com:443 - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false diff --git a/.github/workflows/changed-paths.yml b/.github/workflows/changed-paths.yml index 1f96ba8..777e636 100644 --- a/.github/workflows/changed-paths.yml +++ b/.github/workflows/changed-paths.yml @@ -48,7 +48,7 @@ jobs: - name: Harden runner uses: step-security/harden-runner@1d88384fd173af6ecb012dfd0264a306b711241a # v2.22.4 with: - egress-policy: block + egress-policy: audit # Two commits deep for the merge commit's first parent; trees only, no file contents. - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: diff --git a/.github/workflows/docker-build.yml b/.github/workflows/docker-build.yml index 1a73d63..77ad337 100644 --- a/.github/workflows/docker-build.yml +++ b/.github/workflows/docker-build.yml @@ -110,7 +110,7 @@ jobs: - name: Harden runner uses: step-security/harden-runner@1d88384fd173af6ecb012dfd0264a306b711241a # v2.22.4 with: - egress-policy: block + egress-policy: audit - name: Check out uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: @@ -253,7 +253,7 @@ jobs: - name: Harden runner uses: step-security/harden-runner@1d88384fd173af6ecb012dfd0264a306b711241a # v2.22.4 with: - egress-policy: block + egress-policy: audit - name: Download digests uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: diff --git a/.github/workflows/flatpak-oci.yml b/.github/workflows/flatpak-oci.yml index ccd8f01..1bd8a16 100644 --- a/.github/workflows/flatpak-oci.yml +++ b/.github/workflows/flatpak-oci.yml @@ -37,7 +37,7 @@ jobs: - name: Harden runner uses: step-security/harden-runner@1d88384fd173af6ecb012dfd0264a306b711241a # v2.22.4 with: - egress-policy: block + egress-policy: audit - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 diff --git a/.github/workflows/freebsd.yml b/.github/workflows/freebsd.yml index db9dc36..9840cbb 100644 --- a/.github/workflows/freebsd.yml +++ b/.github/workflows/freebsd.yml @@ -74,7 +74,7 @@ jobs: - name: Harden runner uses: step-security/harden-runner@1d88384fd173af6ecb012dfd0264a306b711241a # v2.22.4 with: - egress-policy: block + egress-policy: audit - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Check out craft-fonts if: inputs.craft-fonts-ref != '' diff --git a/.github/workflows/gate.yml b/.github/workflows/gate.yml index e95e159..eded0bd 100644 --- a/.github/workflows/gate.yml +++ b/.github/workflows/gate.yml @@ -121,7 +121,7 @@ jobs: - name: Harden runner uses: step-security/harden-runner@1d88384fd173af6ecb012dfd0264a306b711241a # v2.22.4 with: - egress-policy: block + egress-policy: audit - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false diff --git a/.github/workflows/git-sources.yml b/.github/workflows/git-sources.yml index e4b6e02..1a51ee8 100644 --- a/.github/workflows/git-sources.yml +++ b/.github/workflows/git-sources.yml @@ -30,7 +30,7 @@ jobs: - name: Harden runner uses: step-security/harden-runner@1d88384fd173af6ecb012dfd0264a306b711241a # v2.22.4 with: - egress-policy: block + egress-policy: audit - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false diff --git a/.github/workflows/nix.yml b/.github/workflows/nix.yml index 233137a..92d219a 100644 --- a/.github/workflows/nix.yml +++ b/.github/workflows/nix.yml @@ -21,7 +21,7 @@ jobs: - name: Harden runner uses: step-security/harden-runner@1d88384fd173af6ecb012dfd0264a306b711241a # v2.22.4 with: - egress-policy: block + egress-policy: audit - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - uses: DeterminateSystems/nix-installer-action@3138316df39ed29be04236d7ffc686fa525866aa # v23 - name: Check flake evaluation diff --git a/.github/workflows/packaging-lint.yml b/.github/workflows/packaging-lint.yml index 80bb8fe..52c4204 100644 --- a/.github/workflows/packaging-lint.yml +++ b/.github/workflows/packaging-lint.yml @@ -27,10 +27,13 @@ jobs: api.github.com:443 archive.ubuntu.com:80 azure.archive.ubuntu.com:80 + azure.archive.ubuntu.com:443 + packages.microsoft.com:443 github.com:443 objects.githubusercontent.com:443 release-assets.githubusercontent.com:443 security.ubuntu.com:80 + security.ubuntu.com:443 - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Run packaging lint uses: storytold/craft-common-actions/actions/packaging-lint@main diff --git a/.github/workflows/refresh-contributors.yml b/.github/workflows/refresh-contributors.yml index ab1b434..8a92483 100644 --- a/.github/workflows/refresh-contributors.yml +++ b/.github/workflows/refresh-contributors.yml @@ -21,7 +21,7 @@ jobs: - name: Harden runner uses: step-security/harden-runner@1d88384fd173af6ecb012dfd0264a306b711241a # v2.22.4 with: - egress-policy: block + egress-policy: audit - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index d49f599..fcaf633 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -151,7 +151,7 @@ jobs: - name: Harden runner uses: step-security/harden-runner@1d88384fd173af6ecb012dfd0264a306b711241a # v2.22.4 with: - egress-policy: block + egress-policy: audit - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Git dependencies come from storytold run: | @@ -198,7 +198,7 @@ jobs: - name: Harden runner uses: step-security/harden-runner@1d88384fd173af6ecb012dfd0264a306b711241a # v2.22.4 with: - egress-policy: block + egress-policy: audit - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - id: v name: Resolve version @@ -225,7 +225,7 @@ jobs: - name: Harden runner uses: step-security/harden-runner@1d88384fd173af6ecb012dfd0264a306b711241a # v2.22.4 with: - egress-policy: block + egress-policy: audit # A signed job reads only the secrets the caller lists in its `secrets:` block; values come # from the repo's `release` environment. An unlisted name is empty, and the app's packaging # would then warn and ship unsigned, so on the release branch fail here instead. @@ -349,7 +349,7 @@ jobs: - name: Harden runner uses: step-security/harden-runner@1d88384fd173af6ecb012dfd0264a306b711241a # v2.22.4 with: - egress-policy: block + egress-policy: audit # See the macOS job: unlisted secrets are empty, and the build would ship unsigned. # Signing needs either the PFX pair or all six Azure Trusted Signing values. - name: Require signing secrets on the release branch @@ -458,7 +458,7 @@ jobs: - name: Harden runner uses: step-security/harden-runner@1d88384fd173af6ecb012dfd0264a306b711241a # v2.22.4 with: - egress-policy: block + egress-policy: audit - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Load refreshed contributor credits if: inputs.contributors-artifact != '' @@ -555,7 +555,7 @@ jobs: - name: Harden runner uses: step-security/harden-runner@1d88384fd173af6ecb012dfd0264a306b711241a # v2.22.4 with: - egress-policy: block + egress-policy: audit - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Export the app's build variables id: app-env @@ -676,7 +676,7 @@ jobs: - name: Harden runner uses: step-security/harden-runner@1d88384fd173af6ecb012dfd0264a306b711241a # v2.22.4 with: - egress-policy: block + egress-policy: audit - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: @@ -739,7 +739,7 @@ jobs: - name: Harden runner uses: step-security/harden-runner@1d88384fd173af6ecb012dfd0264a306b711241a # v2.22.4 with: - egress-policy: block + egress-policy: audit - name: Check the FreeBSD architecture env: ARCH: ${{ matrix.arch }} @@ -972,7 +972,7 @@ jobs: - name: Harden runner uses: step-security/harden-runner@1d88384fd173af6ecb012dfd0264a306b711241a # v2.22.4 with: - egress-policy: block + egress-policy: audit - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Load refreshed contributor credits if: inputs.contributors-artifact != '' @@ -1048,7 +1048,7 @@ jobs: - name: Harden runner uses: step-security/harden-runner@1d88384fd173af6ecb012dfd0264a306b711241a # v2.22.4 with: - egress-policy: block + egress-policy: audit - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Load refreshed contributor credits if: inputs.contributors-artifact != '' @@ -1146,7 +1146,7 @@ jobs: - name: Harden runner uses: step-security/harden-runner@1d88384fd173af6ecb012dfd0264a306b711241a # v2.22.4 with: - egress-policy: block + egress-policy: audit - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Load refreshed contributor credits if: inputs.contributors-artifact != '' @@ -1201,7 +1201,7 @@ jobs: - name: Harden runner uses: step-security/harden-runner@1d88384fd173af6ecb012dfd0264a306b711241a # v2.22.4 with: - egress-policy: block + egress-policy: audit - uses: storytold/craft-common-actions/actions/draft-release@main with: version: ${{ needs.version.outputs.version }} diff --git a/.github/workflows/sonarcloud.yml b/.github/workflows/sonarcloud.yml index f0d9945..bd46cc6 100644 --- a/.github/workflows/sonarcloud.yml +++ b/.github/workflows/sonarcloud.yml @@ -74,14 +74,19 @@ jobs: api.github.com:443 archive.ubuntu.com:80 azure.archive.ubuntu.com:80 + azure.archive.ubuntu.com:443 + packages.microsoft.com:443 binaries.sonarsource.com:443 crates.io:443 + files.pythonhosted.org:443 github.com:443 index.crates.io:443 objects.githubusercontent.com:443 + pypi.org:443 release-assets.githubusercontent.com:443 scanner.sonarcloud.io:443 security.ubuntu.com:80 + security.ubuntu.com:443 sonarcloud.io:443 static.crates.io:443 static.rust-lang.org:443 @@ -124,14 +129,19 @@ jobs: api.github.com:443 archive.ubuntu.com:80 azure.archive.ubuntu.com:80 + azure.archive.ubuntu.com:443 + packages.microsoft.com:443 binaries.sonarsource.com:443 crates.io:443 + files.pythonhosted.org:443 github.com:443 index.crates.io:443 objects.githubusercontent.com:443 + pypi.org:443 release-assets.githubusercontent.com:443 scanner.sonarcloud.io:443 security.ubuntu.com:80 + security.ubuntu.com:443 sonarcloud.io:443 static.crates.io:443 static.rust-lang.org:443 @@ -214,14 +224,19 @@ jobs: api.github.com:443 archive.ubuntu.com:80 azure.archive.ubuntu.com:80 + azure.archive.ubuntu.com:443 + packages.microsoft.com:443 binaries.sonarsource.com:443 crates.io:443 + files.pythonhosted.org:443 github.com:443 index.crates.io:443 objects.githubusercontent.com:443 + pypi.org:443 release-assets.githubusercontent.com:443 scanner.sonarcloud.io:443 security.ubuntu.com:80 + security.ubuntu.com:443 sonarcloud.io:443 static.crates.io:443 static.rust-lang.org:443 @@ -304,14 +319,19 @@ jobs: api.github.com:443 archive.ubuntu.com:80 azure.archive.ubuntu.com:80 + azure.archive.ubuntu.com:443 + packages.microsoft.com:443 binaries.sonarsource.com:443 crates.io:443 + files.pythonhosted.org:443 github.com:443 index.crates.io:443 objects.githubusercontent.com:443 + pypi.org:443 release-assets.githubusercontent.com:443 scanner.sonarcloud.io:443 security.ubuntu.com:80 + security.ubuntu.com:443 sonarcloud.io:443 static.crates.io:443 static.rust-lang.org:443 diff --git a/.github/workflows/supply-chain.yml b/.github/workflows/supply-chain.yml index 4fa5f79..64efa45 100644 --- a/.github/workflows/supply-chain.yml +++ b/.github/workflows/supply-chain.yml @@ -25,7 +25,7 @@ jobs: - name: Harden runner uses: step-security/harden-runner@1d88384fd173af6ecb012dfd0264a306b711241a # v2.22.4 with: - egress-policy: block + egress-policy: audit - name: Download release artifacts uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: diff --git a/.github/workflows/test-freebsd.yml b/.github/workflows/test-freebsd.yml index 5e9f276..fef7d55 100644 --- a/.github/workflows/test-freebsd.yml +++ b/.github/workflows/test-freebsd.yml @@ -32,6 +32,8 @@ jobs: github.com:443 archive.ubuntu.com:80 azure.archive.ubuntu.com:80 + azure.archive.ubuntu.com:443 + packages.microsoft.com:443 security.ubuntu.com:80 archive.ubuntu.com:443 azure.archive.ubuntu.com:443 diff --git a/.github/workflows/test-house-rules.yml b/.github/workflows/test-house-rules.yml index ca67cf2..1d3848b 100644 --- a/.github/workflows/test-house-rules.yml +++ b/.github/workflows/test-house-rules.yml @@ -28,6 +28,9 @@ jobs: uses: step-security/harden-runner@1d88384fd173af6ecb012dfd0264a306b711241a # v2.22.4 with: egress-policy: block + allowed-endpoints: > + api.github.com:443 + github.com:443 - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false diff --git a/.github/workflows/test-install-apt-packages.yml b/.github/workflows/test-install-apt-packages.yml index 2b7de84..9eb289d 100644 --- a/.github/workflows/test-install-apt-packages.yml +++ b/.github/workflows/test-install-apt-packages.yml @@ -29,6 +29,8 @@ jobs: github.com:443 archive.ubuntu.com:80 azure.archive.ubuntu.com:80 + azure.archive.ubuntu.com:443 + packages.microsoft.com:443 security.ubuntu.com:80 archive.ubuntu.com:443 azure.archive.ubuntu.com:443 diff --git a/.github/workflows/windows-arm64.yml b/.github/workflows/windows-arm64.yml index 4c9c543..bc64022 100644 --- a/.github/workflows/windows-arm64.yml +++ b/.github/workflows/windows-arm64.yml @@ -58,7 +58,7 @@ jobs: - name: Harden runner uses: step-security/harden-runner@1d88384fd173af6ecb012dfd0264a306b711241a # v2.22.4 with: - egress-policy: block + egress-policy: audit - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Check out craft-i18n uses: storytold/craft-common-actions/actions/checkout-craft-i18n@main @@ -98,7 +98,7 @@ jobs: - name: Harden runner uses: step-security/harden-runner@1d88384fd173af6ecb012dfd0264a306b711241a # v2.22.4 with: - egress-policy: block + egress-policy: audit - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: name: ${{ inputs.app-name }}-windows-arm64