Harden Runner Adds Windows and macOS Monitoring for GitHub Actions
Summary
Step Security says Harden Runner now monitors network and process events on GitHub-hosted Windows and macOS runners in audit mode, with no workflow changes. Network monitoring is available in the Community tier; process-event monitoring is Enterprise-only.
Key points
- The release adds audit-mode network and process event monitoring for GitHub-hosted Windows and macOS runners.
- Existing workflows using the action on Windows or macOS begin monitoring without changes to workflow files.
- Network events are available in the Community tier; process events are available in the Enterprise tier.
- Block mode, file monitoring, self-hosted Windows and macOS runners, and custom VM image support are listed as coming soon.
- Step Security says Harden Runner detected real-world supply-chain attacks, including the tj-actions/changed-files compromise and Shai Hulud campaign.
Article Details
- Event Type
- Security product release
- Impact
- Step Security announced Windows and macOS support for Harden Runner on GitHub-hosted runners. In audit mode, the release monitors network and process events; network monitoring is available in the Community tier, while process-event monitoring is available in the Enterprise tier. Existing workflows can begin monitoring without changes. The article does not report a new breach or security incident.