v2.2.1

What's Changed

• Fix issue to get cache endpoint by @h0x0er in #253
  Harden runner has the ability to automatically detect the cache endpoint used by each job. When Harden runner is used in block mode, this endpoint is added to the list of allowed endpoints. A fix has been implemented to improve this feature by updating the logic used to fetch the cache endpoint. This update involves using code from the actions/cache library to ensure the endpoint is properly retrieved.
• Update README.md by @varunsh-coder in #247
• Bump step-security/harden-runner from 2.1.0 to 2.2.0 by @dependabot in #248
• Bump github/codeql-action from 2.1.38 to 2.2.4 by @dependabot in #244

Full Changelog: v2...v2.2.1

v2.2.0

What's Changed

• Release v2.2.0 by @varunsh-coder in #245
  1. Added functionality that allows for skipping Harden Runner installation if any errors arise during the installation process.
  2. Updated Harden-Runner GitHub Action to use the latest version of the Harden Runner agent, which resolves three issues:
     • Addressed a bug that allowed calls to direct IP addresses not included in the allowed list when executing code in a docker image.
     • Enhanced annotations to eliminate false positives, specifically not showing false positive calls to docker.io
     • Upgraded containerd dependency to a non-vulnerable version.
• Bump codecov/codecov-action from 2.1.0 to 3.1.1 by @dependabot in #233
• Bump step-security/harden-runner from 2.0.0 to 2.1.0 by @dependabot in #232
• Bump github/codeql-action from 2.1.37 to 2.1.38 by @dependabot in #229
• Update README.md by @varunsh-coder in #231

Full Changelog: v2...v2.2.0

v2.1.0

What's Changed

• Add harden-runner insights URL in job summary by @h0x0er and @varunsh-coder in #227.
  This makes it easier to locate and click on the insights link. One had to look for it in the build log earlier.
• Update README.md by @varunsh-coder in #210
• Bump github/codeql-action from 2.1.29 to 2.1.31 by @dependabot in #206
• Bump step-security/harden-runner from 1.5.0 to 2.0.0 by @dependabot in #211
• Update README by @varunsh-coder in #216
• Bump ossf/scorecard-action from 2.0.6 to 2.1.0 by @dependabot in #221
• Bump github/codeql-action from 2.1.31 to 2.1.37 by @dependabot in #220
• Bump ossf/scorecard-action from 2.1.0 to 2.1.2 by @dependabot in #223
• Bump actions/upload-artifact from 3.1.1 to 3.1.2 by @dependabot in #225
• Bump actions/checkout from 3.1.0 to 3.3.0 by @dependabot in #224

Full Changelog: v2...v2.1.0

v2.0.0

Release v2.0.0

• Feature to disable sudo: Use disable-sudo: true to run job steps without sudo access on the GitHub-hosted runner. disable-sudo is false by default and needs to be opted-into. (documentation)
• File monitoring improvements: All source code files are monitored now for overwrite, instead of a few extensions. Instead of getting annotations for overwrites, you can also opt-in to getting email or Slack notifications if source code is overwritten. (documentation)
• Support for private repositories: Starting with Harder Runner v2.0.0, use of harden runner for private repositories will require a Team/ Enterprise license. Harder Runner GitHub Action is free for all public repositories.

What's Changed

• Update README.md by @varunsh-coder in #187
• Bump step-security/harden-runner from 1.4.5 to 1.5.0 by @dependabot in #188
• Bump github/codeql-action from 2.1.22 to 2.1.26 by @dependabot in #189
• Add scorecard by @varunsh-coder in #192
• Bump actions/checkout from 3.0.0 to 3.1.0 by @dependabot in #198
• Bump github/codeql-action from 2.1.26 to 2.1.27 by @dependabot in #197
• Bump actions/upload-artifact from 3.0.0 to 3.1.0 by @dependabot in #194
• Bump ossf/scorecard-action from 2.0.4 to 2.0.6 by @dependabot in #202
• Bump github/codeql-action from 2.1.27 to 2.1.28 by @dependabot in #201
• Bump actions/upload-artifact from 3.1.0 to 3.1.1 by @dependabot in #203
• Bump github/codeql-action from 2.1.28 to 2.1.29 by @dependabot in #204
• Update README by @varunsh-coder in #208

Full Changelog: v1...v2.0.0

v1.5.0

What's Changed

• Add cache endpoint to allowed list automatically by @h0x0er and @varunsh-coder in #186
• Improve annotation messages

Full Changelog: v1...v1.5.0

v1.4.5

What's Changed

• Fix bug (#152) that caused service containers to not work
• Release v1.4.5 by @varunsh-coder in #156

Full Changelog: v1...v1.4.5

v1.4.4

What's Changed

• Update agent to use reproducible build by @varunsh-coder in #149
• Add a project banner by @boahc077 in #146

New Contributors

• @boahc077 made their first contribution in #146

Full Changelog: v1...v1.4.4

v1.4.3

What's Changed

• Fix performance issues related to file monitoring
• Limit annotations for source code overwrites

Full Changelog: v1...v1.4.3

v1.4.2

• Do not fail workflow and show message if Harden Runner is running in a container
• Add "StepSecurity Harden Runner" as prefix to annotation message when source code change detected
• Update dependencies
• Add limitations section to ReadMe
• Update description in package.json and action.yml

v1.4.1

What's Changed

Updated agent to not block UDP traffic in audit mode in #112
Updated agent to not show annotation when calls to api.snapcraft.io are blocked in #113
Updated dependencies

Full Changelog: v1...v1.4.1