Skip to content

fix(ci): harden-runner in block mode for the GitHub-API-only jobs (RE001) #946

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
hyperpolymath merged 3 commits into from
Oct 20, 2026
+40 −0
Merged

fix(ci): harden-runner in block mode for the GitHub-API-only jobs (RE001) #946

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
a2db4fd
fix(ci): harden-runner in block mode for the GitHub-API-only jobs (RE…
claude Oct 20, 2026
55d2c28
Merge branch 'claude/eager-wright-zwwbe2-re004' into claude/eager-wri…
hyperpolymath Oct 20, 2026
6ad3033
Merge branch 'claude/eager-wright-zwwbe2-re004' into claude/eager-wri…
hyperpolymath Oct 20, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 8 additions & 0 deletions .github/workflows/ci-health-sweep.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -45,6 +45,14 @@
runs-on: ubuntu-latest
timeout-minutes: 30
steps:
# Egress allowlist (RE001): this job talks only to the GitHub API.
- name: Harden runner
uses: step-security/harden-runner@v2.22.2
with:
egress-policy: block
allowed-endpoints: >
api.github.com:443
github.com:443
- uses: actions/checkout@v7.0.1
- name: Run CI-health sweep
env:
Expand Down
8 changes: 8 additions & 0 deletions .github/workflows/dependabot-automerge.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -62,6 +62,14 @@
pull-requests: write # needed to approve

steps:
# Egress allowlist (RE001): this job talks only to the GitHub API.
- name: Harden runner
uses: step-security/harden-runner@v2.22.2
with:
egress-policy: block
allowed-endpoints: >
api.github.com:443
github.com:443
- name: Fetch Dependabot metadata
id: meta
uses: dependabot/fetch-metadata@v3.1.0
Expand Down
8 changes: 8 additions & 0 deletions .github/workflows/label-triage.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -49,6 +49,14 @@
runs-on: ubuntu-latest
timeout-minutes: 5
steps:
# Egress allowlist (RE001): this job talks only to the GitHub API.
- name: Harden runner
uses: step-security/harden-runner@v2.22.2

@chatgpt-codex-connector chatgpt-codex-connector Bot Oct 20, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Regenerate the actions lockfile for harden-runner

At this commit, .github/workflows/actions.lock is byte-for-byte unchanged and contains no step-security/harden-runner@v2.22.2 dependency; consequently, all five onboarded workflow entries omit the newly added action and will be rejected at job setup instead of running. The official gh actions-lock documentation explicitly requires rerunning the command whenever an existing workflow adds a uses dependency, so regenerate and commit the lockfile alongside these workflow changes.

Useful? React with 👍 / 👎.

with:
egress-policy: block
allowed-endpoints: >
api.github.com:443
github.com:443
- name: Classify and label
env:
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
Expand Down
8 changes: 8 additions & 0 deletions .github/workflows/labels.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,6 +35,14 @@
runs-on: ubuntu-latest
timeout-minutes: 10
steps:
# Egress allowlist (RE001): this job talks only to the GitHub API.
- name: Harden runner
uses: step-security/harden-runner@v2.22.2
with:
egress-policy: block
allowed-endpoints: >
api.github.com:443
github.com:443
- name: Apply canonical labels
env:
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
Expand Down
8 changes: 8 additions & 0 deletions .github/workflows/roadmap-sync.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -46,6 +46,14 @@
EXCLUDE: 'idaptik burble rattlescript vcl-ut'
WINDOW_MIN: ${{ inputs.window_min || '45' }} # look-back window (> cron interval for overlap)
steps:
# Egress allowlist (RE001): this job talks only to the GitHub API.
- name: Harden runner
uses: step-security/harden-runner@v2.22.2
with:
egress-policy: block
allowed-endpoints: >
api.github.com:443
github.com:443
- name: Mint App installation token
id: app
uses: actions/create-github-app-token@v3.3.0
Expand Down
Loading