ci: enable more harden-runner features #835
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Contributor
There was a problem hiding this comment.
Pull Request Overview
This PR hardens the GitHub Actions runners by enabling additional harden-runner flags across all CI workflows.
- Adds
disable-sudoordisable-sudo-and-containersflags to thestep-security/harden-runnerstep in each workflow - Introduces a
pushtrigger for the linting/formatting workflow to establish a baseline onmain
Reviewed Changes
Copilot reviewed 15 out of 15 changed files in this pull request and generated no comments.
Show a summary per file
| File | Description |
|---|---|
| .github/workflows/wc-integration-test.yml | Enable disable-sudo on the harden-runner step |
| .github/workflows/wc-build-push.yml | Enable disable-sudo on the harden-runner step |
| .github/workflows/wc-build-push-test.yml | Enable disable-sudo-and-containers on one job and disable-sudo on another |
| .github/workflows/wc-acceptance-test.yml | Enable disable-sudo-and-containers on the harden-runner step |
| .github/workflows/social-interaction.yml | Enable disable-sudo-and-containers on the harden-runner step |
| .github/workflows/release-published.yml | Enable disable-sudo-and-containers on the harden-runner step |
| .github/workflows/release-please.yml | Enable disable-sudo-and-containers on the harden-runner step |
| .github/workflows/release-build.yml | Enable disable-sudo-and-containers on both harden-runner jobs |
| .github/workflows/pr-report.yml | Enable disable-sudo-and-containers on the harden-runner step |
| .github/workflows/pr-image-cleanup.yml | Enable disable-sudo-and-containers on both harden-runner jobs |
| .github/workflows/pr-conventional-title.yml | Enable disable-sudo-and-containers on the harden-runner step |
| .github/workflows/ossf-scorecard.yml | Enable disable-sudo on the harden-runner step |
| .github/workflows/linting-formatting.yml | Enable disable-sudo on the harden-runner step and add push trigger for main |
| .github/workflows/issue-creation-tool-versions.yml | Enable disable-sudo-and-containers on the harden-runner step |
| .github/workflows/issue-cleanup.yml | Enable disable-sudo-and-containers on the harden-runner step |
Comments suppressed due to low confidence (4)
.github/workflows/wc-build-push-test.yml:40
- The
disable-sudo-and-containersinput requires harden-runner v2.12.1 or later. Consider updating the action reference here to 002fdce3c6a235733a90a27c80493a3241e56863 (v2.12.1) to ensure the flag is supported.
- uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0
.github/workflows/linting-formatting.yml:7
- [nitpick] This adds a
pushtrigger formainto establish a baseline, but there’s no filtering on paths. If unintended workflows run on every push tomain, consider specifying paths or clarifying in docs.
push:
.github/workflows/wc-integration-test.yml:29
- [nitpick] Across workflows you mix
disable-sudoanddisable-sudo-and-containers. Verify and standardize which flag is needed per job, and document the rationale to keep consistency.
disable-sudo: true
.github/workflows/wc-integration-test.yml:27
- The harden-runner configuration is duplicated in every workflow. Consider creating a reusable composite action or using YAML anchors to DRY this step and simplify future updates.
- uses: step-security/harden-runner@002fdce3c6a235733a90a27c80493a3241e56863 # v2.12.1
Contributor
🦙 MegaLinter status:
|
| Descriptor | Linter | Files | Fixed | Errors | Warnings | Elapsed time |
|---|---|---|---|---|---|---|
| ✅ ACTION | actionlint | 18 | 0 | 0 | 0.51s | |
| ✅ DOCKERFILE | hadolint | 2 | 0 | 0 | 0.81s | |
| ✅ GHERKIN | gherkin-lint | 2 | 0 | 0 | 1.18s | |
| ✅ JSON | npm-package-json-lint | yes | no | no | 0.52s | |
| ✅ JSON | prettier | 16 | 1 | 0 | 0 | 0.57s |
| ✅ JSON | v8r | 16 | 0 | 0 | 6.86s | |
| ✅ MARKDOWN | markdownlint | 9 | 0 | 0 | 0 | 0.89s |
| ✅ MARKDOWN | markdown-table-formatter | 9 | 0 | 0 | 0 | 0.3s |
| ✅ REPOSITORY | checkov | yes | no | no | 17.25s | |
| ✅ REPOSITORY | gitleaks | yes | no | no | 0.41s | |
| ✅ REPOSITORY | git_diff | yes | no | no | 0.01s | |
| grype | yes | no | 2 | 24.0s | ||
| ✅ REPOSITORY | secretlint | yes | no | no | 0.95s | |
| ✅ REPOSITORY | syft | yes | no | no | 1.9s | |
| ✅ REPOSITORY | trivy | yes | no | no | 6.91s | |
| ✅ REPOSITORY | trivy-sbom | yes | no | no | 0.23s | |
| ✅ REPOSITORY | trufflehog | yes | no | no | 3.39s | |
| ✅ SPELL | lychee | 63 | 0 | 0 | 1.77s | |
| ✅ YAML | prettier | 24 | 0 | 0 | 0 | 1.05s |
| ✅ YAML | v8r | 24 | 0 | 0 | 6.8s | |
| ✅ YAML | yamllint | 24 | 0 | 0 | 0.82s |
See detailed report in MegaLinter reports
Contributor
📦 Container Size AnalysisComparing 📈 Size Comparison Table
|
Contributor
📦 Container Size AnalysisComparing 📈 Size Comparison Table
|
Contributor
EkelmansPh
approved these changes
Jun 24, 2025
|
Contributor
Pull Request Report (#835)Static measures
Time related measures
Status check related measures
|
Contributor
|
🎉 Hooray! The changes in this pull request went live with the release of v6.2.0 🎉 |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
🚀 Hey, I have created a Pull Request
Description of changes
This PR enables
disable-sudoanddisable-sudo-and-containerswhere possible. And it enables theblockpolicy on jobs that have a stable baseline.Note
We are aware that step-security/harden-runner currently does not work on ARM runners and on job that themselves run in containers (via
container:). We have purposely not excluded the step from those jobs, as support might come in the future.✔️ Checklist