v2.5.1

What's Changed

• Updated default allowed endpoints to include *.actions.githubusercontent.com. GitHub Actions recently started making calls to additional sub-domains for this domain. Please update to this latest version of harden-runner to allow these new endpoints.
• Update README.md by @varunsh-coder in #326
• Bump step-security/harden-runner from 2.4.1 to 2.5.0 by @dependabot in #327

Full Changelog: v2...v2.5.1

v2.5.0

What's Changed

Release v2.5.0 by @h0x0er and @varunsh-coder in #325

This release:

1. Adds support for Actions Runner Controller (ARC) environment
2. Improves the job summary markdown

Full Changelog: v2...v2.5.0

v2.4.1

What's Changed

Release v2.4.1 by @varunsh-coder and @Devils-Knight in #309

This release

1. Shows a preview of the network events in the job summary markdown
2. Uses a fallback DNS service from Cloudflare in addition to Google DNS to improve reliability

Full Changelog: v2...v2.4.1

v2.4.0

What's Changed

• Release v2.4.0 by @varunsh-coder and @h0x0er in #292
  Adds support for wildcard domains in block mode. e.g. you can add *.data.mcr.microsoft.com:443 to the allowed list, and egress traffic will be allowed to eastus.data.mcr.microsoft.com:443 and westus.data.mcr.microsoft.com:443.
  Link to documentation.
• Bump actions/checkout from 3.5.0 to 3.5.2 by @dependabot in #277
• Bump github/codeql-action from 2.2.11 to 2.2.12 by @dependabot in #278
• Bump step-security/harden-runner from 2.3.0 to 2.3.1 by @dependabot in #282
• Added a workflow for reviewing code changes using stepsecurity code reviewer by @boahc077 in #290

Full Changelog: v2...v2.4.0

v2.3.1

What's Changed

• Release v2.3.1 by @arjundashrath and @varunsh-coder in #281
  Fixes #279 and #275
• Update README.md by @varunsh-coder in #267
• Bump step-security/harden-runner from 2.2.1 to 2.3.0 by @dependabot in #268
• Bump codecov/codecov-action from 3.1.1 to 3.1.2 by @dependabot in #273
• Bump ossf/scorecard-action from 2.1.2 to 2.1.3 by @dependabot in #265
• Bump actions/checkout from 3.3.0 to 3.5.0 by @dependabot in #261
• Bump github/codeql-action from 2.2.6 to 2.2.11 by @dependabot in #270

Full Changelog: v2...v2.3.1

v2.3.0

What's Changed

• Enable setting policy via insights website (link to documentation) by @h0x0er and @varunsh-coder in #266
  The Policy Store helps you manage Harden Runner policies without altering your workflow files.
• Update README.md by @varunsh-coder in #255
• Bump github/codeql-action from 2.2.4 to 2.2.6 by @dependabot in #254
• Bump step-security/harden-runner from 2.2.0 to 2.2.1 by @dependabot in #256

Full Changelog: v2...v2.3.0

v2.2.1

What's Changed

• Fix issue to get cache endpoint by @h0x0er in #253
  Harden runner has the ability to automatically detect the cache endpoint used by each job. When Harden runner is used in block mode, this endpoint is added to the list of allowed endpoints. A fix has been implemented to improve this feature by updating the logic used to fetch the cache endpoint. This update involves using code from the actions/cache library to ensure the endpoint is properly retrieved.
• Update README.md by @varunsh-coder in #247
• Bump step-security/harden-runner from 2.1.0 to 2.2.0 by @dependabot in #248
• Bump github/codeql-action from 2.1.38 to 2.2.4 by @dependabot in #244

Full Changelog: v2...v2.2.1

v2.2.1

What's Changed

• Fix issue to get cache endpoint by @h0x0er in #253
  Harden runner has the ability to automatically detect the cache endpoint used by each job. When Harden runner is used in block mode, this endpoint is added to the list of allowed endpoints. A fix has been implemented to improve this feature by updating the logic used to fetch the cache endpoint. This update involves using code from the actions/cache library to ensure the endpoint is properly retrieved.
• Update README.md by @varunsh-coder in #247
• Bump step-security/harden-runner from 2.1.0 to 2.2.0 by @dependabot in #248
• Bump github/codeql-action from 2.1.38 to 2.2.4 by @dependabot in #244

Full Changelog: v2...v2.2.1

v2.2.0

What's Changed

• Release v2.2.0 by @varunsh-coder in #245
  1. Added functionality that allows for skipping Harden Runner installation if any errors arise during the installation process.
  2. Updated Harden-Runner GitHub Action to use the latest version of the Harden Runner agent, which resolves three issues:
     • Addressed a bug that allowed calls to direct IP addresses not included in the allowed list when executing code in a docker image.
     • Enhanced annotations to eliminate false positives, specifically not showing false positive calls to docker.io
     • Upgraded containerd dependency to a non-vulnerable version.
• Bump codecov/codecov-action from 2.1.0 to 3.1.1 by @dependabot in #233
• Bump step-security/harden-runner from 2.0.0 to 2.1.0 by @dependabot in #232
• Bump github/codeql-action from 2.1.37 to 2.1.38 by @dependabot in #229
• Update README.md by @varunsh-coder in #231

Full Changelog: v2...v2.2.0

v2.1.0

What's Changed

• Add harden-runner insights URL in job summary by @h0x0er and @varunsh-coder in #227.
  This makes it easier to locate and click on the insights link. One had to look for it in the build log earlier.
• Update README.md by @varunsh-coder in #210
• Bump github/codeql-action from 2.1.29 to 2.1.31 by @dependabot in #206
• Bump step-security/harden-runner from 1.5.0 to 2.0.0 by @dependabot in #211
• Update README by @varunsh-coder in #216
• Bump ossf/scorecard-action from 2.0.6 to 2.1.0 by @dependabot in #221
• Bump github/codeql-action from 2.1.31 to 2.1.37 by @dependabot in #220
• Bump ossf/scorecard-action from 2.1.0 to 2.1.2 by @dependabot in #223
• Bump actions/upload-artifact from 3.1.1 to 3.1.2 by @dependabot in #225
• Bump actions/checkout from 3.1.0 to 3.3.0 by @dependabot in #224

Full Changelog: v2...v2.1.0