[StepSecurity] Apply security best practices - #22
Conversation
Signed-off-by: StepSecurity Bot <bot@stepsecurity.io>
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
There was a problem hiding this comment.
Sorry @stepsecurity-app[bot], you have reached your weekly rate limit of 500000 diff characters.
Please try again later or upgrade to continue using Sourcery
|
Skipping PR review because a bot author is detected. If you want to trigger CodeAnt AI, comment |
|
Bito Automatic Review Skipped - Files Excluded |
✅ Snyk checks have passed. No issues have been found so far.
💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse. |
|
Bito Automatic Review Skipped - Files Excluded |
Up to standards ✅🟢 Issues
|
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
![llamapreview[bot]](https://avatars.githubusercontent.com/in/1023541?s=60&v=4){kind=small}
There was a problem hiding this comment.
AI Code Review by LlamaPReview
🎯 TL;DR & Recommendation
Recommendation: Approve with suggestions
This PR adds step-security/harden-runner to the secret scanning workflow, implementing a security best practice. However, the egress-policy is set to audit, which limits its effectiveness to observability only. Moving to block mode with an allowed-endpoints list would provide stronger protection.
🌟 Strengths
- Adds security hardening to the CI pipeline following OpenSSF recommendations.
💡 Suggestions (P2)
- .github/workflows/secret_scan.yml: The
egress-policy: auditlogs outbound calls but does not block malicious traffic; consider moving toblockmode with an allowed-endpoints list after validation to fully prevent credential exfiltration.
💡 Have feedback? We'd love to hear it in our GitHub Discussions.
✨ This review was generated by LlamaPReview Advanced, which is free for all open-source projects. Learn more.
| - name: Harden the runner (Audit all outbound calls) | ||
| uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1 | ||
| with: | ||
| egress-policy: audit |
There was a problem hiding this comment.
P2 | Confidence: Medium
The egress-policy is set to audit, which logs outbound calls but does not block any network traffic. For a security-focused workflow, auditing alone may provide limited protection against credential exfiltration or supply-chain attacks. The documentation for harden-runner recommends moving to block mode (with an allowed endpoint list) after verifying the workflow’s network requirements. Setting egress-policy: audit is a safe initial step, but the PR should include a comment or follow-up task to transition to block once the allowed endpoints are validated. Without this, the security benefit of the runner hardening is reduced to observability only, leaving the CI pipeline still susceptible to malicious outbound calls.
Code Suggestion:
- name: Harden the runner (Audit all outbound calls)
uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1
with:
egress-policy: block # Future: change to 'audit' when testing new endpoints
allowed-endpoints: > #
api.github.com:443
github.com:443
objects.githubusercontent.com:443
|
1 participant
Summary
This pull request has been generated by StepSecurity as part of your enterprise subscription to ensure compliance with recommended security best practices. Please review and merge the pull request to apply these security enhancements.
Security Fixes
Harden Runner
Harden-Runner is an open-source security agent for the GitHub-hosted runner to prevent software supply chain attacks. It prevents exfiltration of credentials, detects tampering of source code during build, and enables running jobs without sudo access.
Feedback
For bug reports, feature requests, and general feedback; please create an issue in step-security/secure-repo or contact us via our website.
Summary by cubic
Add
step-security/harden-runner(pinned to v2.19.1) to the secret scanning workflow withegress-policy: auditto log all outbound calls and harden the GitHub runner. This reduces exfiltration and tampering risk during CI without changing job behavior.Written for commit 7473b73. Summary will update on new commits.