Skip to content

Releases: step-security/harden-runner

v2.8.1

07 Jun 13:18
17d0e2b
Compare
Choose a tag to compare

What's Changed

  • Bug fix: Update isGitHubHosted implementation by @varunsh-coder in #425
    The previous implementation incorrectly identified large GitHub-hosted runners as self-hosted runners. As a result, harden-runner was not executing on these large GitHub-hosted runners.

Full Changelog: v2...v2.8.1

v2.8.0

22 May 00:48
f086349
Compare
Choose a tag to compare

What's Changed

Release v2.8.0 by @h0x0er and @varunsh-coder in #416
This release includes:

  • File Monitoring Enhancements: Adds the capability to view the name and path of every file written during the build process.
  • Process Tracking Enhancements: Adds the capability to view process names and arguments of processes run during the build process.

These enhancements are based on insights from the XZ Utils incident, aimed at improving observability and detections during the build process.

Full Changelog: v2...v2.8.0

v2.7.1

29 Apr 21:05
a4aa98b
Compare
Choose a tag to compare

What's Changed

Release v2.7.1 by @varunsh-coder, @h0x0er, @ashishkurmi in #397
This release:

  • Improves the capability to inspect outbound HTTPS traffic on GitHub-hosted and self-hosted VM runners
  • Updates README to add link to case study video on how Harden-Runner detected a supply chain attack on a Google open-source project
  • Addresses minor bugs

Full Changelog: v2.7.0...v2.7.1

v2.7.0

31 Jan 00:00
63c24ba
Compare
Choose a tag to compare

What's Changed

Release 2.7.0 by @varunsh-coder and @h0x0er in #376
This release:

  1. Updates the node runtime to node20
  2. Adds capability to inspect outbound HTTPS traffic on GitHub-hosted and self-hosted VM runners

Full Changelog: v2...v2.7.0

v2.6.1

16 Nov 20:50
eb238b5
Compare
Choose a tag to compare

What's Changed

Release v2.6.1 by @varunsh-coder and @h0x0er in #356
This release:

  1. Improves the job summary markdown written by the Harden-Runner Action
  2. Improves detection of cache endpoint used by the job
  3. Detects use of Kubernetes mode in Actions Runner Controller (ARC) based runners
  4. Updates dependencies

Full Changelog: v2...v2.6.1

v2.6.0

03 Oct 01:08
1b05615
Compare
Choose a tag to compare

What's Changed

Release v2.6.0 by @varunsh-coder in #346

This release adds support for self-hosted Virtual Machine runners (e.g. on EC2).

Full Changelog: v2...v2.6.0

v2.5.1

09 Aug 16:12
8ca2b8b
Compare
Choose a tag to compare

What's Changed

  • Updated default allowed endpoints to include *.actions.githubusercontent.com. GitHub Actions recently started making calls to additional sub-domains for this domain. Please update to this latest version of harden-runner to allow these new endpoints.
  • Update README.md by @varunsh-coder in #326
  • Bump step-security/harden-runner from 2.4.1 to 2.5.0 by @dependabot in #327

Full Changelog: v2...v2.5.1

v2.5.0

24 Jul 18:36
cba0d00
Compare
Choose a tag to compare

What's Changed

Release v2.5.0 by @h0x0er and @varunsh-coder in #325

This release:

  1. Adds support for Actions Runner Controller (ARC) environment
  2. Improves the job summary markdown

Full Changelog: v2...v2.5.0

v2.4.1

20 Jun 00:36
55d479f
Compare
Choose a tag to compare

What's Changed

Release v2.4.1 by @varunsh-coder and @Devils-Knight in #309

This release

  1. Shows a preview of the network events in the job summary markdown
  2. Uses a fallback DNS service from Cloudflare in addition to Google DNS to improve reliability

Full Changelog: v2...v2.4.1

v2.4.0

04 May 20:44
128a634
Compare
Choose a tag to compare

What's Changed

  • Release v2.4.0 by @varunsh-coder and @h0x0er in #292
    Adds support for wildcard domains in block mode. e.g. you can add *.data.mcr.microsoft.com:443 to the allowed list, and egress traffic will be allowed to eastus.data.mcr.microsoft.com:443 and westus.data.mcr.microsoft.com:443.
    Link to documentation.
  • Bump actions/checkout from 3.5.0 to 3.5.2 by @dependabot in #277
  • Bump github/codeql-action from 2.2.11 to 2.2.12 by @dependabot in #278
  • Bump step-security/harden-runner from 2.3.0 to 2.3.1 by @dependabot in #282
  • Added a workflow for reviewing code changes using stepsecurity code reviewer by @boahc077 in #290

Full Changelog: v2...v2.4.0