ci: add Harden-Runner audit step to all existing workflows - #326
Merged
Conversation
|
Warning Rate limit exceeded
To keep reviews running without waiting, you can enable usage-based add-on for your organization. This allows additional reviews beyond the hourly cap. Account admins can enable it under billing. ⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (7)
📝 WalkthroughWalkthroughAdds Changes
Estimated code review effort🎯 2 (Simple) | ⏱️ ~8 minutes Possibly related PRs
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Review rate limit: 0/1 reviews remaining, refill in 57 minutes and 18 seconds.Comment |
Reviewer's GuideAdds the step-security/harden-runner@v2 action in audit mode as the first step of every job across all existing GitHub Actions workflows to capture egress baselines without changing current behavior. Sequence diagram for GitHub Actions job execution with HardenRunner audit stepsequenceDiagram
actor Developer
participant GitHubActions
participant JobRunner
participant HardenRunner as HardenRunner_step_security_harden_runner_v2
participant Checkout as Action_actions_checkout
participant OtherAction as Other_job_steps
participant StepSecurityService
participant ExternalService
Developer->>GitHubActions: Push commit or open pull_request
GitHubActions->>GitHubActions: Select workflow and job
GitHubActions->>JobRunner: Start job on ubuntu_latest
JobRunner->>HardenRunner: Execute with egress_policy_audit
HardenRunner->>JobRunner: Configure egress monitoring
HardenRunner->>StepSecurityService: Send initial job metadata
JobRunner->>Checkout: Run checkout action
Checkout->>ExternalService: Fetch repository contents
ExternalService-->>Checkout: Repository data
JobRunner->>OtherAction: Run subsequent job steps
OtherAction->>ExternalService: Make outbound network calls
ExternalService-->>OtherAction: Responses
HardenRunner->>StepSecurityService: Report observed egress traffic
JobRunner->>GitHubActions: Complete job without blocking egress
File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
There was a problem hiding this comment.
Hey - I've found 1 issue
Prompt for AI Agents
Please address the comments from this code review:
## Individual Comments
### Comment 1
<location path=".github/workflows/staging-gate.yml" line_range="20-22" />
<code_context>
rebase:
runs-on: ubuntu-latest
steps:
+ - uses: step-security/harden-runner@v2
+ with:
+ egress-policy: audit
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
with:
</code_context>
<issue_to_address>
**🚨 issue (security):** Consider pinning step-security/harden-runner to a specific commit SHA instead of the v2 tag.
A floating tag like `@v2` can change without any updates here, undermining the supply-chain hardening you’re adding. Please pin `step-security/harden-runner` to a specific commit SHA for deterministic behavior and apply that consistently in all workflows touched by this PR.
</issue_to_address>Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.
github-actions
Bot
force-pushed
the
ci/harden-runner-expansion
branch
from
April 30, 2026 21:52
8aa5c98 to
b05acbe
Compare
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 7
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In @.github/workflows/auto-rebase-open-prs.yml:
- Around line 29-31: Replace the loose version tag for the GitHub Action
"step-security/harden-runner@v2" with a pinned commit SHA while preserving the
version tag as a trailing comment; specifically, update the action reference in
the workflow to use "step-security/harden-runner@<COMMIT_SHA>" and add a comment
like "# v2" after the line, keeping the existing "with: egress-policy: audit"
block unchanged so the action is pinned but human-readable.
In @.github/workflows/ci.yml:
- Around line 21-23: Replace the mutable action reference "uses:
step-security/harden-runner@v2" with a SHA-pinned reference to the specific
commit (e.g., "uses: step-security/harden-runner@<COMMIT_SHA>") and append the
human-readable tag as a trailing comment for traceability (e.g., "# v2"). Update
the workflow entry where "step-security/harden-runner@v2" appears so CI uses the
full commit SHA instead of the mutable tag.
In @.github/workflows/post-release-docs-issue.yml:
- Around line 15-17: The GitHub Actions usage of step-security/harden-runner is
tag-pinned ("step-security/harden-runner@v2"); update that reference to the full
commit SHA (e.g., "step-security/harden-runner@<COMMIT_SHA>") and keep the
version tag as a trailing comment (e.g., "# v2.x.y") so the workflow uses a
fixed commit while still documenting the intended version; modify the uses line
where "step-security/harden-runner@v2" appears in the workflow file accordingly.
In @.github/workflows/publish.yml:
- Around line 18-20: Replace the mutable action reference
"step-security/harden-runner@v2" with a specific commit SHA (e.g.
"step-security/harden-runner@<COMMIT_SHA>") and append a trailing comment
containing the original version tag (e.g. "# v2.x.y"); update the uses entry in
the workflow where "step-security/harden-runner@v2" appears and keep the
existing inputs like "egress-policy: audit" unchanged.
In @.github/workflows/release-drafter.yml:
- Around line 18-20: Replace the floating tag "step-security/harden-runner@v2"
with an immutable commit pin (the repo@<commit-sha>) and retain the
human-readable version as a trailing comment (e.g. " # v2.x.y") so the workflow
step uses the exact commit while still documenting the version; update the
action reference in the workflow step where "step-security/harden-runner@v2"
appears and add the corresponding commit SHA and version comment.
In @.github/workflows/staging-gate.yml:
- Around line 20-22: The workflow uses mutable action refs—replace all six
occurrences of step-security/harden-runner@v2 with pinned commit SHAs in the
format step-security/harden-runner@<commit-sha> # v2.x.y (e.g.,
a235c7d7def8a53dbc7bed9e20bf6a94b87d2e8d) so each harden-runner usage is
immutable; while editing, also pin other third-party actions such as
actions/checkout@v4 and gitleaks/gitleaks-action@v2 to their specific commit
SHAs and add a trailing comment with the corresponding semantic version for
clarity.
In @.github/workflows/stale.yml:
- Around line 16-18: Replace the floating tag in the uses entry for
step-security/harden-runner (the line containing "uses:
step-security/harden-runner@v2") with a specific commit SHA and append the
original version tag as a trailing comment (e.g., "uses:
step-security/harden-runner@<commit-sha> # v2") so the action is pinned to an
exact revision while preserving the human-readable version in a comment; keep
the existing "with: egress-policy: audit" block unchanged.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: aba4bc50-3d03-412e-897b-52c1a021b775
📒 Files selected for processing (7)
.github/workflows/auto-rebase-open-prs.yml.github/workflows/ci.yml.github/workflows/post-release-docs-issue.yml.github/workflows/publish.yml.github/workflows/release-drafter.yml.github/workflows/staging-gate.yml.github/workflows/stale.yml
Pre-step on every job emits an egress baseline to StepSecurity for review before promoting to block mode. No behavior change at audit level. ci.yml: pytest job. staging-gate.yml: secrets-scan, pattern-scan, history-scan, release-docs-check, commit-msg-prefix, pr-body-issue-link.
Highest-value placement: publish runs with id-token: write and contacts the PyPI Trusted Publishing OIDC endpoint. Audit-mode egress baseline captures the legitimate publish path so a future block-mode promotion can reject any unexpected outbound traffic from a compromised action.
post-release-docs-issue.yml, release-drafter.yml, stale.yml each get the audit-mode egress baseline. Completes Harden-Runner coverage across the .github/workflows/ tree.
Closes Harden-Runner coverage. This workflow runs with contents: write and force-pushes to open PR branches, so an egress baseline here is load-bearing for future block-mode promotion.
Four atomic commits adding step-security/harden-runner@v2 (audit mode) as the first step of every job in every existing workflow. Pairs with the new workflows on ci/devtools-bundle which already include it. Verification: - coverage: 7/7 workflows (1 ci, 6 staging-gate jobs, 1 publish, 1 post-release-docs-issue, 1 release-drafter, 1 stale, 1 auto-rebase) - mode: audit only — no egress blocking, baseline collection only - behavior change: none until promoted to block mode Blockers (require user decision before merge): - [user] confirm app.stepsecurity.io account exists or accept that baselines are visible only in workflow-run logs until then Open questions: - Promotion to block mode is a follow-up after baselines stabilize (~2 weeks of normal traffic) Rollback: - git revert 21b6500..HEAD (or delete branch before merge)
robotrocketscience
force-pushed
the
ci/harden-runner-expansion
branch
from
April 30, 2026 21:56
b05acbe to
9650bd6
Compare
Replaces tag-pin with commit SHA per repo convention (other third-party actions in these files are SHA-pinned). Resolves sourcery + coderabbit findings on PR #326.
This was referenced May 1, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds
step-security/harden-runner@v2(audit mode) as the first step of every job in every existing workflow. Pairs with #325 which ships the same step in newly-added workflows.ci.ymlstaging-gate.ymlpublish.ymlid-token: write+ PyPI OIDC)post-release-docs-issue.ymlrelease-drafter.ymlstale.ymlauto-rebase-open-prs.ymlcontents: write, force-pushes to PRs)Audit mode only — no behavior change. Captures the egress baseline so a future block-mode promotion can reject unexpected outbound traffic from a compromised action.
Test plan
harden-runnerstep at the top of each jobFollow-up
Promotion to block mode is deliberately deferred. Audit-only first.
Summary by Sourcery
CI:
Summary by CodeRabbit