Please whitelist *.actions.githubusercontent.com about harden-runner HOT 8 CLOSED

Thanks for reporting @jauderho. It will be done as part of the next release.

from harden-runner.

New version has been released to address this issue. You do not need to explicitly add *.actions.githubusercontent.com to the allowed list. It has been added to the default allowed list. Just upgrade to v2.5.1.

https://github.com/step-security/harden-runner/releases/tag/v2.5.1

from harden-runner.

Yes, that was prior to upgrading. I was under the impression that I had to manually add *.actions.githubusercontent.com, but I may have been mistaken. All good if you're aware!

from harden-runner.

Hey @varunsh-coder, is actions.githubusercontent.com (no sub-subdomain *.actions) in the default allowed list?
It's failing a workflow due to this. See https://app.stepsecurity.io/github/kommitters/editorjs-toggle-block/actions/runs/6005650946.

Hi @miguelnietoa it is failing because of objects.githubusercontent.com which is a different sub domain.

from harden-runner.

Oops! 😅 Thank you @varunsh-coder

from harden-runner.

For the record, this issue broke a number of GitHub Actions that just became completely unresponsive e.g. https://github.com/DataDog/stratus-red-team/actions/runs/5974891989 and failed after 30+ minutes

Upgrading to v2.5.1 was not enough, it seems that I had to explicitly allow the new endpoint in my configuration:

    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09
        with:
          egress-policy: block
          allowed-endpoints: >
            ...
            *.actions.githubusercontent.com:443

from harden-runner.

Hi @christophetd, apologies for the inconvenience.

Upgrading to v2.5.1 should fix it, since it adds the same *.actions.githubusercontent.com in the default allowed list. Can you please share a workflow run with v2.5.1 where it did not work?

As an example, in the link you shared, I see that an older version is in use: https://github.com/DataDog/stratus-red-team/actions/runs/5974891989/job/16209832133#step:1:24

from harden-runner.

Hey @varunsh-coder, is actions.githubusercontent.com (no sub-subdomain *.actions) in the default allowed list?
It's failing a workflow due to this. See https://app.stepsecurity.io/github/kommitters/editorjs-toggle-block/actions/runs/6005650946.

from harden-runner.