Repolode
Submit
step-security

step-security/harden-runner

A CI/CD security agent for GitHub Actions runners that monitors network egress, file writes and process activity to detect supply chain attacks.

View on GitHubWebsite
Stars
1,289
Forks
120
Open issues
54
Last commit
3 days ago

What is it?

Harden-Runner is a security agent that runs inside CI/CD jobs and behaves like an endpoint detection tool for GitHub Actions runners. It records outbound network connections, file writes and process executions, and ties each event to the specific step, job and workflow where it happened. This targets a gap where ephemeral build runners often handle secrets and produce production artifacts without the monitoring applied to other critical systems.

The agent can build a baseline of expected outbound connections for each job and flag any new destination. In the Community tier it can also restrict egress with a domain allowlist and enforce a global block list of domains and IPs tied to active supply chain attacks. Linux runners get full support, while Windows and macOS runners support audit mode only.

Self-hosted runners, private repositories, centralized policies, SIEM integration and alerts require the paid Enterprise tier. Community features are free for public repositories on GitHub-hosted runners.

Key features

  • 01Maps each outbound network connection, file write and process execution to its workflow step.
  • 02Builds a per-job baseline of outbound connections and flags new destinations.
  • 03Restricts egress traffic with a domain allowlist in block mode.
  • 04Applies a global block list of domains and IPs linked to active supply chain attacks.
  • 05Supports Linux, Windows and macOS GitHub-hosted runners, with block mode limited to Linux.
  • 06Offers self-hosted runner support, including ARC, under the Enterprise tier.

Use cases

  • Detecting compromised third-party GitHub Actions that exfiltrate secrets during builds.
  • Auditing which external hosts a CI pipeline contacts before tightening egress rules.
  • Monitoring build pipelines of open-source projects that publish artifacts to users.
  • Reducing GITHUB_TOKEN permissions to the minimum a workflow needs.

Quick start

  1. 1

    Add the Harden-Runner step as the first step in each job of your GitHub Actions workflow file

  2. 2

    Run your workflow, then open the link in the job log to view network and file events

Things to know

  • The free Community tier covers only public repositories on GitHub-hosted runners.
  • Private repositories and self-hosted runners require a paid Enterprise subscription.
  • It only works within GitHub Actions workflows, not other CI/CD systems.

In collections

Testing frameworks & test automation tools

Topics

#github-actions#ci-cd#supply-chain-security#runtime-security#egress-filtering#network-security#actions#hardening#runners#security-hardening

FAQ

What is harden-runner?
A CI/CD security agent for GitHub Actions runners that monitors network egress, file writes and process activity to detect supply chain attacks. Harden-Runner is a security agent that runs inside CI/CD jobs and behaves like an endpoint detection tool for GitHub Actions runners. It records outbound network connections, file writes and process executions, and ties each event to the specific step, job and workflow where it happened. This targets a gap where ephemeral build runners often handle secrets and produce production artifacts without the monitoring applied to other critical systems.
Is harden-runner free to use? What license does it have?
harden-runner is open source under the Apache-2.0 license. Check the license terms before using it in commercial products.
Is harden-runner still maintained?
Actively maintained. The last commit to harden-runner was on Oct 19, 2026.
What can I use harden-runner for?
Detecting compromised third-party GitHub Actions that exfiltrate secrets during builds. Auditing which external hosts a CI pipeline contacts before tightening egress rules. Monitoring build pipelines of open-source projects that publish artifacts to users. Reducing GITHUB_TOKEN permissions to the minimum a workflow needs.
How do I install harden-runner?
Add the Harden-Runner step as the first step in each job of your GitHub Actions workflow file Run your workflow, then open the link in the job log to view network and file events
Where can I get harden-runner?
The source code and installation instructions are on GitHub: https://github.com/step-security/harden-runner

Summary generated by AI from the project's README. GitHub stats refresh daily.

Related projects