StepSecurity Compares Harden-Runner With GitHub Actions’ Native Egress Firewall
Summary
StepSecurity compares GitHub’s preview egress firewall for hosted Linux Actions runners with Harden-Runner, highlighting cross-platform coverage, behavioral and file monitoring, threat-intelligence blocking, and centralized visibility, with supply-chain incident cases.
Key points
- GitHub’s firewall preview supports GitHub-hosted Linux runners; StepSecurity says Harden-Runner supports Linux, Windows, and macOS on hosted and self-hosted runners.
- StepSecurity says Harden-Runner builds network baselines, flags new destinations, and correlates network, process, and file events with workflow steps.
- The vendor says Harden-Runner flagged the tj-actions/changed-files compromise after the action contacted gist[.]githubusercontent[.]com to download a script that read runner memory for secrets and printed them in workflow logs.
- StepSecurity says its Global Block List can block identified malicious endpoints, and Lockdown Mode can terminate a process and stop a job when suspicious behavior is detected.
- Harden-Runner monitors file writes during builds to flag unexpected changes to checked-out source files, including modifications that may be restored before a build ends.
- The dashboard can identify jobs contacting public registries such as registry[.]npmjs[.]org and pypi[.]org; deny policies are available, while centralized registry configuration is described as upcoming.
Article Details
- Event Type
- GitHub is introducing a native egress firewall for GitHub-hosted Actions runners; StepSecurity compares its preview capabilities with Harden-Runner.
- Impact
- According to the article, the firewall preview supports GitHub-hosted Linux runners. Harden-Runner supports Linux, Windows, and macOS on hosted and self-hosted runners, and adds behavioral detection, process visibility, file-write monitoring, threat-intelligence-based blocking, and centralized investigation. StepSecurity says Harden-Runner detected the unexpected destination in the tj-actions/changed-files compromise and can help identify jobs affected by disclosed incidents. Registry visibility and deny policies are available; centralized registry configuration is described as upcoming.
Malware
Vendors
GitHubGitHub is introducing a native egress firewall for GitHub-hosted Actions runners. We welcome this feature. Bringing network controls to more runners is good for software supply chain security and reinforces the approachStepSecurityis good for software supply chain security and reinforces the approach we have been building at StepSecurity since 2022: runners need runtime visibility and network protection.
Products
Actions Runner Controllerand macOS across both GitHub-hosted and self-hosted runners, with deployment options including Actions Runner Controller on Kubernetes, virtual machines, and bare-metal servers.GitHub ActionsThat need extends beyond GitHub Actions. Whether your organization uses GitLab CI, Azure DevOps, Buildkite, or another platform, your runners execute third-party code, handle credentials, and produce software thatHarden-RunnerFor teams using GitHub Actions, the new firewall raises a practical question: how does it compare with Harden-Runner?JFrog Artifactoryare moving package downloads through approved registries such as StepSecurity Secure Registry or JFrog Artifactory. Discovering which jobs still contact public registries directly is a practical challenge.StepSecurity Secure RegistryMany organizations are moving package downloads through approved registries such as StepSecurity Secure Registry or JFrog Artifactory. Discovering which jobs still contact public registries directly is a practical