From a2db4fd65ea97429e35209acc93f7a593f9a5841 Mon Sep 17 00:00:00 2001 From: Claude Date: Tue, 20 Oct 2026 12:45:57 +0000 Subject: [PATCH] fix(ci): harden-runner in block mode for the GitHub-API-only jobs (RE001) Five jobs hold a token but talk only to the GitHub API: - labels.yml sync - label-triage.yml triage - dependabot-automerge.yml automerge - roadmap-sync.yml sync (app token) - ci-health-sweep.yml sweep (HYPATIA_DISPATCH_PAT) Each now starts with step-security/harden-runner@v2.22.2, `egress-policy: block`, and the allowlist api.github.com:443 and github.com:443. The endpoints were derived from the steps: gh CLI, dependabot/fetch-metadata, actions/create-github-app-token and actions/checkout. A job that needs another endpoint now fails loudly instead of reaching it. RE001 on this tree: 18 -> 13. actions.lock is tool-owned and not edited here. It needs a `gh actions-lock` run on this branch before these workflows can start. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01CYR5bf5FBLS7cXQK72aVNM --- .github/workflows/ci-health-sweep.yml | 8 ++++++++ .github/workflows/dependabot-automerge.yml | 8 ++++++++ .github/workflows/label-triage.yml | 8 ++++++++ .github/workflows/labels.yml | 8 ++++++++ .github/workflows/roadmap-sync.yml | 8 ++++++++ 5 files changed, 40 insertions(+) diff --git a/.github/workflows/ci-health-sweep.yml b/.github/workflows/ci-health-sweep.yml index c26d8ecc..3d705b66 100644 --- a/.github/workflows/ci-health-sweep.yml +++ b/.github/workflows/ci-health-sweep.yml @@ -45,6 +45,14 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 30 steps: + # Egress allowlist (RE001): this job talks only to the GitHub API. + - name: Harden runner + uses: step-security/harden-runner@v2.22.2 + with: + egress-policy: block + allowed-endpoints: > + api.github.com:443 + github.com:443 - uses: actions/checkout@v7.0.1 - name: Run CI-health sweep env: diff --git a/.github/workflows/dependabot-automerge.yml b/.github/workflows/dependabot-automerge.yml index 86842d10..d1875204 100644 --- a/.github/workflows/dependabot-automerge.yml +++ b/.github/workflows/dependabot-automerge.yml @@ -62,6 +62,14 @@ jobs: pull-requests: write # needed to approve steps: + # Egress allowlist (RE001): this job talks only to the GitHub API. + - name: Harden runner + uses: step-security/harden-runner@v2.22.2 + with: + egress-policy: block + allowed-endpoints: > + api.github.com:443 + github.com:443 - name: Fetch Dependabot metadata id: meta uses: dependabot/fetch-metadata@v3.1.0 diff --git a/.github/workflows/label-triage.yml b/.github/workflows/label-triage.yml index 3e747485..027b3871 100644 --- a/.github/workflows/label-triage.yml +++ b/.github/workflows/label-triage.yml @@ -49,6 +49,14 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 5 steps: + # Egress allowlist (RE001): this job talks only to the GitHub API. + - name: Harden runner + uses: step-security/harden-runner@v2.22.2 + with: + egress-policy: block + allowed-endpoints: > + api.github.com:443 + github.com:443 - name: Classify and label env: GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} diff --git a/.github/workflows/labels.yml b/.github/workflows/labels.yml index a4208d7f..e751fdec 100644 --- a/.github/workflows/labels.yml +++ b/.github/workflows/labels.yml @@ -35,6 +35,14 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 10 steps: + # Egress allowlist (RE001): this job talks only to the GitHub API. + - name: Harden runner + uses: step-security/harden-runner@v2.22.2 + with: + egress-policy: block + allowed-endpoints: > + api.github.com:443 + github.com:443 - name: Apply canonical labels env: GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} diff --git a/.github/workflows/roadmap-sync.yml b/.github/workflows/roadmap-sync.yml index eae7a233..ea784ee8 100644 --- a/.github/workflows/roadmap-sync.yml +++ b/.github/workflows/roadmap-sync.yml @@ -46,6 +46,14 @@ jobs: EXCLUDE: 'idaptik burble rattlescript vcl-ut' WINDOW_MIN: ${{ inputs.window_min || '45' }} # look-back window (> cron interval for overlap) steps: + # Egress allowlist (RE001): this job talks only to the GitHub API. + - name: Harden runner + uses: step-security/harden-runner@v2.22.2 + with: + egress-policy: block + allowed-endpoints: > + api.github.com:443 + github.com:443 - name: Mint App installation token id: app uses: actions/create-github-app-token@v3.3.0