[pull] main from step-security:main

README.md

@@ -40,7 +40,8 @@ Harden-Runner secures over **25 million CI/CD workflow runs every week**, protec
 ## Quick Links
 - [Getting Started Guide](#getting-started)
 - [Why Choose Harden-Runner](#why-choose-harden-runner)
-- [Features and Capabilities](#features)
+- [Features and Pricing Tiers](#features-and-pricing-tiers)
+- [StepSecurity Maintained Actions (Free for Public Repos)](#stepsecurity-maintained-actions)
 - [Case Studies and Trusted Projects](#trusted-by-and-case-studies)
 - [Environment Compatibility Matrix](#environment-compatibility-matrix)
 - [How It Works](docs/how-it-works.md)
@@ -63,6 +64,9 @@ Learn how Harden-Runner works through the video below, which shows how it detect
 
 This guide walks you through the steps to set up and use Harden-Runner in your CI/CD workflows. For more details, refer to the [official documentation](https://docs.stepsecurity.io/harden-runner).
 
+> [!NOTE]
+> The Community tier is free for **public repositories on GitHub-hosted runners** and includes the core feature set. Advanced features, private repositories, and self-hosted runners (including ARC) require the Enterprise tier. See [Features and Pricing Tiers](#features-and-pricing-tiers) for what is in each tier.
+
 ### **Step 1: Add Harden-Runner to Your Workflow**
 
 To integrate Harden-Runner, follow these steps:
@@ -72,7 +76,7 @@ To integrate Harden-Runner, follow these steps:
    ```yaml
    steps:
      - name: Harden Runner
-       uses: step-security/harden-runner@f808768d1510423e83855289c910610ca9b43176 # v2.17.0
+       uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
        with:
          egress-policy: audit
 
@@ -108,12 +112,23 @@ Run your workflow. Once completed:
 
 ---
 
-## Features
+## Features and Pricing Tiers
+
+Harden-Runner offers a comprehensive suite of features to enhance the security of your CI/CD workflows, available in two tiers: **Community** (free) and **Enterprise** (paid). Two things determine what you get: **where your workflows run** decides whether the free tier is available at all, and **your tier** decides which features you get. The feature lists below show what is in each tier.
+
+| Where your workflows run | What's available |
+|--------------------------|------------------|
+| Public repositories on GitHub-hosted runners | **Community** features free; **Enterprise** features require a paid plan |
+| Private repositories (any runner type) | **Enterprise** (paid) only |
+| Self-hosted runners, including ARC and bare metal (public or private repositories) | **Enterprise** (paid) only |
 
-Harden-Runner offers a comprehensive suite of features to enhance the security of your CI/CD workflows, available in two tiers: **Community** (Free) and **Enterprise** (Paid).
+> [!IMPORTANT]
+> **Self-hosted runners require an Enterprise subscription, even for public repositories.** Without a subscription, the Harden-Runner action is a no-op on self-hosted runners: the step succeeds and your workflow passes, but nothing is monitored and no insights are generated. To enable Harden-Runner on your self-hosted runners, [start a free trial](https://www.stepsecurity.io/start-free).
 
 ### Community (Free)
 
+Available for public repositories running on GitHub-hosted runners:
+
 - **CI/CD-Aware Event Correlation:** Each outbound network connection, file operation, and process execution is mapped to the exact step, job, and workflow where it occurs.
 - **Automated Baseline Creation:** Harden-Runner builds a baseline for each job based on past outbound network connections.
 - **Anomaly Detection:** Once the baseline is created, any future outbound calls not in the baseline trigger a detection.
@@ -126,19 +141,34 @@ Harden-Runner offers a comprehensive suite of features to enhance the security o
 Includes all features in the **Community** tier, plus:
 
 - **Support for Private Repositories:** Extend Harden-Runner's security capabilities to your private GitHub repositories.
-- **Support for Self-Hosted Runners:** Apply security controls and monitoring to self-hosted GitHub Actions runners.
-- **GitHub Checks Integration:** Enable GitHub Checks for Harden-Runner—if the baseline remains unchanged, the check passes; if it changes, the check fails, showing new outbound connections.
+- **Support for Self-Hosted Runners:** Apply security controls and monitoring to self-hosted GitHub Actions runners (VM, bare metal, and ARC), for both public and private repositories.
+- **GitHub Checks Integration:** Enable GitHub Checks for Harden-Runner. If the baseline remains unchanged, the check passes; if it changes, the check fails, showing new outbound connections.
 - **View Outbound GitHub API calls at the Job Level:** Monitor HTTPS requests to GitHub APIs
 - **Determine Minimum GITHUB_TOKEN Permissions:** Monitor outbound HTTPS requests to GitHub APIs to recommend the least-privilege permissions needed for your workflows, enhancing security by reducing unnecessary access.
 - **View the Name and Path of Every File Written During the Build Process:** Gain visibility into every file written to the build environment, including the ability to correlate file writes with processes, ensuring complete transparency.
 - **View Process Names and Arguments:** Monitor every process executed during the build process, along with its arguments, and navigate the process tree to detect suspicious activities.
+- **Centralized Policy Store:** Manage egress policies centrally from the StepSecurity dashboard instead of editing each workflow file. Learn more in the [Policy Store documentation](https://docs.stepsecurity.io/github-actions/harden-runner/policy-store).
+- **Baselines at Repository, Organization, and Cluster Level:** Create and manage baselines beyond the per-job level. Learn more in the [Baseline documentation](https://docs.stepsecurity.io/github-actions/harden-runner/baseline).
+- **Suppression Rules:** Suppress expected detections to reduce alert noise. Learn more in the [Suppression Rules documentation](https://docs.stepsecurity.io/github-actions/harden-runner/suppression-rules).
+- **Alert Notifications and SIEM Integration:** Receive alerts via email, Slack, and Microsoft Teams, and integrate detections with your SIEM solution.
 
 For a detailed comparison and more information, please visit our [Pricing Page](https://www.stepsecurity.io/pricing).
 
 Explore the full feature set in the [Features Documentation](https://docs.stepsecurity.io/harden-runner).
 
 ---
 
+## StepSecurity Maintained Actions
+
+Many popular third-party GitHub Actions are abandoned or stuck on outdated runtimes. StepSecurity publishes [Maintained Actions](https://docs.stepsecurity.io/github-actions/actions/stepsecurity-maintained-actions): drop-in replacements that are actively maintained, security-reviewed, and kept current, including updates to the Node 24 runtime.
+
+- **Free for public repositories**, no subscription required. Read the [announcement](https://www.stepsecurity.io/blog/stepsecurity-maintained-actions-are-now-free-for-public-repos).
+- **~500 actions and growing.** [Browse the full catalog](https://app.stepsecurity.io/action-advisor?tab=maintained).
+- **Actively maintained:** dependency updates, runtime upgrades (such as Node 24), and defined SLAs for patching vulnerabilities.
+- **Hardened release process:** manual secure code review before onboarding, signed commits, mandatory peer review, and tag protection.
+
+---
+
 ## Trusted By and Case Studies
 
 Harden-Runner is trusted by over 11,000 leading open-source projects and enterprises, including Microsoft, Google, Kubernetes, and more.
@@ -164,14 +194,14 @@ Harden-Runner is trusted by over 11,000 leading open-source projects and enterpr
 
 Harden-Runner is designed to work seamlessly across a variety of runner environments, providing consistent security insights and protections regardless of where your workflows execute. For self-hosted runners, audit mode is deployed directly to the runner infrastructure without requiring any changes to your existing workflows. For more details, refer to the [official documentation](https://docs.stepsecurity.io/harden-runner).
 
-| Environment Type | Compatibility | Audit Mode Deployment | Workflow Changes for Audit/Block Mode |
-|------------------|---------------|--------------------------|-------------------|
-| GitHub-hosted runners (Linux) | ✅ Full support | Add Harden-Runner Action to workflow | Yes |
-| GitHub-hosted runners (Windows, macOS) | ✅ Audit mode only | Add Harden-Runner Action to workflow | Yes |
-| Self-hosted VM runners | ✅ Full support | Include agent in runner image | No |
-| Self-hosted bare-metal runners | ✅ Full support | Install agent as a service | No |
-| Actions Runner Controller (ARC) | ✅ Full support | Deploy as DaemonSet | No |
-| RunsOn Runners | ✅ Full support | Pre-integrated | No |
+| Environment Type | Compatibility | Audit Mode Deployment | Workflow Changes for Audit/Block Mode | Free Community Tier |
+|------------------|---------------|--------------------------|-------------------|---------------------|
+| GitHub-hosted runners (Linux) | ✅ Full support | Add Harden-Runner Action to workflow | Yes | ✅ Public repos ([Community features](#community-free) only) |
+| GitHub-hosted runners (Windows, macOS) | ✅ Audit mode only | Add Harden-Runner Action to workflow | Yes | ✅ Public repos ([Community features](#community-free) only) |
+| Self-hosted VM runners | ✅ Full support | Include agent in runner image | No | ❌ Enterprise subscription required |
+| Self-hosted bare-metal runners | ✅ Full support | Install agent as a service | No | ❌ Enterprise subscription required |
+| Actions Runner Controller (ARC) | ✅ Full support | Deploy as DaemonSet | No | ❌ Enterprise subscription required |
+| RunsOn Runners | ✅ Full support | Pre-integrated | No | ❌ Enterprise subscription required |
 
 ## How It Works
 

dist/post/index.js

@@ -32303,7 +32303,9 @@ process.on("unhandledRejection", (reason) => {
 }))();
 function handleAgentBravoCleanup() {
     return cleanup_awaiter(this, void 0, void 0, function* () {
-        external_child_process_.execFileSync("/usr/bin/echo", ["step_policy_jobend"]);
+        // Non-usr-merged distros (e.g. Debian bullseye) only have /bin/echo.
+        const echoBin = external_fs_.existsSync("/usr/bin/echo") ? "/usr/bin/echo" : "/bin/echo";
+        external_child_process_.execFileSync(echoBin, ["step_policy_jobend"]);
         const doneFile = "/home/agent/done.json";
         let counter = 0;
         while (true) {

dist/pre/index.js

@@ -85582,15 +85582,15 @@ var external_crypto_ = __nccwpck_require__(6982);
 
 const CHECKSUMS = {
     tls: {
-        amd64: "07703be7dedacfa234e7962289e952d3731d9c5677054ce4f6e4c9dbf79b77ed", // v1.9.0
-        arm64: "6b3c8927928ccc0a9df3097eabd95ec3c00f98b3b25bb6eb6b5e99020584a53c", // v1.9.0
+        amd64: "b4efa8356de128c3daba6a7e334779877faafb08b49f9a4ef4152826c66ff4c2", // v1.9.1
+        arm64: "0e93ad693d562448fd62e322c8e165caba3de123c9cd631e2bdc2d4dbb4e091a", // v1.9.1
     },
     non_tls: {
-        amd64: "4b14d8a3a5fbcef95af55e0c54d3bee6f44da802878c10289a4ca0b79b6d0237", // v0.16.2
+        amd64: "4fca42590557ad92e50bd99cf81eba527d0699ac05dd11dfb0c795f48ae63e26", // v0.16.3
     },
     bravo: {
-        amd64: "3733cdd704e8f6455f036ff3534d53f965a0e6028a39c654ae4f1679e6b4c45b", // v1.9.0
-        arm64: "ecf8a50679cac9402795f7434f2edb470bd83fe47512bbc3f52bf9b956c1b62c", // v1.9.0
+        amd64: "59ea6f0a488514b2d3feaf5b98fb445af9d2875f32acf5878d84c72e835a3425", // v1.9.1
+        arm64: "0b1544370b89adee80f71cc0e9bed6dcc46fe3aa410338f9a305b892a194ebb8", // v1.9.1
     },
     darwin: "2990f0390d2760fa6262a3830060b6db1233f16a1410ffe1ed2bf13dfda80c38", // v0.0.6
     windows: {
@@ -85663,14 +85663,14 @@ function installAgent(isTLS, configStr) {
             encoding: "utf8",
         });
         if (isTLS) {
-            downloadPath = yield tool_cache.downloadTool(`https://github.com/step-security/agent-ebpf/releases/download/v1.9.0/harden-runner_1.9.0_linux_${variant}.tar.gz`, undefined, auth);
+            downloadPath = yield tool_cache.downloadTool(`https://github.com/step-security/agent-ebpf/releases/download/v1.9.1/harden-runner_1.9.1_linux_${variant}.tar.gz`, undefined, auth);
         }
         else {
             if (variant === "arm64") {
                 console.log(ARM64_RUNNER_MESSAGE);
                 return false;
             }
-            downloadPath = yield tool_cache.downloadTool("https://github.com/step-security/agent/releases/download/v0.16.2/agent_0.16.2_linux_amd64.tar.gz", undefined, auth);
+            downloadPath = yield tool_cache.downloadTool("https://github.com/step-security/agent/releases/download/v0.16.3/agent_0.16.3_linux_amd64.tar.gz", undefined, auth);
         }
         if (!verifyChecksum(downloadPath, isTLS, variant, "linux")) {
             return false;
@@ -85698,7 +85698,7 @@ function installAgentBravo(configStr_1) {
         const token = lib_core.getInput("token", { required: true });
         const auth = `token ${token}`;
         const variant = process.arch === "x64" ? "amd64" : "arm64";
-        const downloadPath = yield tool_cache.downloadTool(`https://github.com/step-security/agent-ebpf/releases/download/v1.9.0/harden-runner-bravo_1.9.0_linux_${variant}.tar.gz`, undefined, auth);
+        const downloadPath = yield tool_cache.downloadTool(`https://github.com/step-security/agent-ebpf/releases/download/v1.9.1/harden-runner-bravo_1.9.1_linux_${variant}.tar.gz`, undefined, auth);
         if (!verifyChecksum(downloadPath, true, variant, "linux", "bravo")) {
             return false;
         }

docs/limitations.md

@@ -1,7 +1,8 @@
 ## Limitations
 
 ### GitHub-Hosted Runners
-* Harden-Runner is not supported when [job is run in a container](https://docs.github.com/en/actions/using-jobs/running-jobs-in-a-container) with built-in labels such as `ubuntu-latest`, as it needs sudo access on the Ubuntu VM to run. The limitation is if the entire job is run in a container. However, such jobs can be monitored when using custom VM images with GitHub-hosted runners. This is also not a limitation for Self-Hosted runners.
+* Harden-Runner is not supported when [job is run in a container](https://docs.github.com/en/actions/using-jobs/running-jobs-in-a-container) with built-in labels such as `ubuntu-latest`, as it needs sudo access on the Ubuntu VM to run. The limitation is if the entire job is run in a container. However, such jobs can be monitored when using [custom VM images with GitHub-hosted runners](https://docs.stepsecurity.io/github-actions/harden-runner#github-hosted-custom-vm), which requires the Enterprise tier. This is also not a limitation for Self-Hosted runners.
+* Harden-Runner is not supported on `ubuntu-slim` runners. The agent relies on kernel-level features that require elevated capabilities, which are not available on `ubuntu-slim`. The action detects `ubuntu-slim` and exits cleanly with an informational log message, without monitoring the job. See [issue #627](https://github.com/step-security/harden-runner/issues/627) for details.
 
 ### Self-Hosted Actions Runner Controller (ARC) Runners
 

src/checksum.ts

@@ -4,15 +4,15 @@ import * as fs from "fs";
 
 export const CHECKSUMS = {
   tls: {
-    amd64: "07703be7dedacfa234e7962289e952d3731d9c5677054ce4f6e4c9dbf79b77ed", // v1.9.0
-    arm64: "6b3c8927928ccc0a9df3097eabd95ec3c00f98b3b25bb6eb6b5e99020584a53c", // v1.9.0
+    amd64: "b4efa8356de128c3daba6a7e334779877faafb08b49f9a4ef4152826c66ff4c2", // v1.9.1
+    arm64: "0e93ad693d562448fd62e322c8e165caba3de123c9cd631e2bdc2d4dbb4e091a", // v1.9.1
   },
   non_tls: {
-    amd64: "4b14d8a3a5fbcef95af55e0c54d3bee6f44da802878c10289a4ca0b79b6d0237", // v0.16.2
+    amd64: "4fca42590557ad92e50bd99cf81eba527d0699ac05dd11dfb0c795f48ae63e26", // v0.16.3
   },
   bravo: {
-    amd64: "3733cdd704e8f6455f036ff3534d53f965a0e6028a39c654ae4f1679e6b4c45b", // v1.9.0
-    arm64: "ecf8a50679cac9402795f7434f2edb470bd83fe47512bbc3f52bf9b956c1b62c", // v1.9.0
+    amd64: "59ea6f0a488514b2d3feaf5b98fb445af9d2875f32acf5878d84c72e835a3425", // v1.9.1
+    arm64: "0b1544370b89adee80f71cc0e9bed6dcc46fe3aa410338f9a305b892a194ebb8", // v1.9.1
   },
   darwin: "2990f0390d2760fa6262a3830060b6db1233f16a1410ffe1ed2bf13dfda80c38", // v0.0.6
   windows: {

src/cleanup.ts

@@ -86,7 +86,9 @@ process.on("unhandledRejection", (reason) => {
 })();
 
 async function handleAgentBravoCleanup() {
-  cp.execFileSync("/usr/bin/echo", ["step_policy_jobend"]);
+  // Non-usr-merged distros (e.g. Debian bullseye) only have /bin/echo.
+  const echoBin = fs.existsSync("/usr/bin/echo") ? "/usr/bin/echo" : "/bin/echo";
+  cp.execFileSync(echoBin, ["step_policy_jobend"]);
 
   const doneFile = "/home/agent/done.json";
   let counter = 0;

src/install-agent.ts

@@ -26,7 +26,7 @@ export async function installAgent(
 
   if (isTLS) {
     downloadPath = await tc.downloadTool(
-      `https://github.com/step-security/agent-ebpf/releases/download/v1.9.0/harden-runner_1.9.0_linux_${variant}.tar.gz`,
+      `https://github.com/step-security/agent-ebpf/releases/download/v1.9.1/harden-runner_1.9.1_linux_${variant}.tar.gz`,
       undefined,
       auth
     );
@@ -36,7 +36,7 @@ export async function installAgent(
       return false;
     }
     downloadPath = await tc.downloadTool(
-      "https://github.com/step-security/agent/releases/download/v0.16.2/agent_0.16.2_linux_amd64.tar.gz",
+      "https://github.com/step-security/agent/releases/download/v0.16.3/agent_0.16.3_linux_amd64.tar.gz",
       undefined,
       auth
     );
@@ -79,7 +79,7 @@ export async function installAgentBravo(
 
   const variant = process.arch === "x64" ? "amd64" : "arm64";
   const downloadPath = await tc.downloadTool(
-    `https://github.com/step-security/agent-ebpf/releases/download/v1.9.0/harden-runner-bravo_1.9.0_linux_${variant}.tar.gz`,
+    `https://github.com/step-security/agent-ebpf/releases/download/v1.9.1/harden-runner-bravo_1.9.1_linux_${variant}.tar.gz`,
     undefined,
     auth
   );