Harden-Runner secures CI/CD workflows by controlling network access and monitoring activities on GitHub-hosted and self-hosted runners. It blocks unauthorized network traffic and detects unusual activity to protect against potential threats. The name "Harden-Runner" comes from its purpose: strengthening the security of the runners used in GitHub Actions workflows.
- Getting Started Guide
- Why Choose Harden-Runner
- Features and Capabilities
- Case Studies and Trusted Projects
- How It Works
- Known Limitations
- Join the Discussions
Learn how Harden-Runner works through the video below, which shows how it detected a supply chain attack on a Google open-source project.
This guide walks you through the steps to set up and use Harden-Runner in your CI/CD workflows.
To integrate Harden-Runner, follow these steps:
- Open your GitHub Actions workflow file (e.g.,
.github/workflows/<workflow-name>.yml
). - Add the following code as the first step in each job:
steps: - uses: step-security/harden-runner@446798f8213ac2e75931c1b0769676d927801858 # v2.10.3 with: egress-policy: audit
Tip: Automate this step by pasting your workflow into the StepSecurity online tool
Click to view the full Getting Started Guide
Run your workflow. Once completed:
- Review the workflow logs and the job markdown summary.
- Look for a link to security insights and recommendations.
- Click on the provided link (e.g., example link) to access the Process Monitor View, which displays:
- Prevent Exfiltration: Prevent the exfiltration of CI/CD secrets and source code.
- Detect Tampering: Identify source code modifications during builds.
- Anomaly Detection: Spot unusual dependencies and workflow behaviors.
- Simplify Permissions: Determine the minimum required
GITHUB_TOKEN
permissions.
Harden-Runner offers a comprehensive suite of features to enhance the security of your CI/CD workflows, available in two tiers: Community (Free) and Enterprise (Paid).
- Block Network Egress Traffic with Domain Allowlist: Control outbound network traffic by specifying allowed domains, preventing unauthorized data exfiltration.
- Detect Compromised Packages, Dependencies & Build Tools: Identify and mitigate risks from malicious or vulnerable components in your build process.
- Detect Modification of Source Code: Monitor and alert on unauthorized changes to your source code during the CI/CD pipeline.
- Disable Sudo Access: Restrict the use of superuser privileges in your workflows to minimize security risks.
- Insights Page for CI/CD Runs: Access detailed reports and analytics for each CI/CD run to monitor security events and compliance.
Includes all features in the Community tier, plus:
- Support for Private Repositories: Extend Harden-Runner's security capabilities to your private GitHub repositories.
- Support for Self-Hosted Runners: Apply security controls and monitoring to self-hosted GitHub Actions runners.
- View Outbound GitHub API calls at the Job Level: Monitor HTTPS requests to GitHub APIs
- Determine Minimum GITHUB_TOKEN Permissions: Monitor outbound HTTPS requests to GitHub APIs to recommend the least-privilege permissions needed for your workflows, enhancing security by reducing unnecessary access.
- View the Name and Path of Every File Written During the Build Process: Gain visibility into every file written to the build environment, including the ability to correlate file writes with processes, ensuring complete transparency.
- View Process Names and Arguments: Monitor every process executed during the build process, along with its arguments, and navigate the process tree to detect suspicious activities.
- Github Checks: Display Harden Runner insights in the GitHub Checks UI, giving quick feedback on unusual network activity in pull requests.
For a detailed comparison and more information, please visit our Pricing Page.
Explore the full feature set in the Features Documentation.
Harden-Runner is trusted by over 5000 leading open-source projects and enterprises, including Microsoft, Google, Kubernetes, and more.
CISA Explore |
Microsoft Explore |
Google Explore |
DataDog Explore |
Intel Explore |
Kubernetes Explore |
Node.js Explore |
AWS Explore |
- Harden-Runner Detects CI/CD Supply Chain Attack in Google’s Open-Source Project Flank
- StepSecurity Detects CI/CD Supply Chain Attack in Microsoft’s Open-Source Project Azure Karpenter Provider in Real-Time
- How Coveo Strengthened GitHub Actions Security with StepSecurity
- Hashgraph Achieves Comprehensive CI/CD Security Without Compromising Development Speed
- Kapiche secures their GitHub Actions software supply chain with Harden-Runner
- Arcjet Enhances CI/CD Security with Harden-Runner
Want to know the technical details? Dive into the architecture of Harden-Runner and its integrations for GitHub-hosted and self-hosted runners in our How Harden-Runner Works Documentation.
While Harden-Runner offers powerful features, there are certain limitations based on the environment, such as OS support. See the complete list in Known Limitations.
Join the conversation! For questions, ideas, or feedback, visit our Discussions Page.
For enterprise support, email [email protected]. Interested in using Harden-Runner in other CI/CD platforms? Reach out to [email protected].
Harden-Runner is open source. See the LICENSE file for details.