[GH Actions] Add recommended configuration to harden the runner

DelazJ · Jan 31, 2025 · a9b0eff · a9b0eff
1 parent a861688
commit a9b0eff
Show file tree

Hide file tree

Showing 8 changed files with 58 additions and 9 deletions.
diff --git a/.github/workflows/auto-label.yml b/.github/workflows/auto-label.yml
@@ -19,7 +19,10 @@ jobs:
       - name: Harden Runner
         uses: step-security/harden-runner@0080882f6c36860b6ba35c610c98ce87d4e2f26f # v2.10.2
         with:
-          egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
+          disable-sudo: true
+          egress-policy: block
+          allowed-endpoints: >
+            api.github.com:443
 
       - id: find_version_label
         name: Find Target version

diff --git a/.github/workflows/backport.yml b/.github/workflows/backport.yml
@@ -20,7 +20,11 @@ jobs:
       - name: Harden Runner
         uses: step-security/harden-runner@0080882f6c36860b6ba35c610c98ce87d4e2f26f # v2.10.2
         with:
-          egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
+          disable-sudo: true
+          egress-policy: block
+          allowed-endpoints: >
+            api.github.com:443
+            github.com:443
 
       - name: Backport Bot
         id: backport

diff --git a/.github/workflows/builds.yml b/.github/workflows/builds.yml
@@ -28,7 +28,14 @@ jobs:
     - name: Harden Runner
       uses: step-security/harden-runner@0080882f6c36860b6ba35c610c98ce87d4e2f26f # v2.10.2
       with:
-        egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
+        disable-sudo: true
+        egress-policy: block
+        allowed-endpoints: >
+          files.pythonhosted.org:443
+          github.com:443
+          pypi.org:443
+          qgis.org:443
+          raw.githubusercontent.com:443
 
     - name: Check out repository
       uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

diff --git a/.github/workflows/doctest.yml b/.github/workflows/doctest.yml
@@ -29,8 +29,20 @@ jobs:
     - name: Harden Runner
       uses: step-security/harden-runner@0080882f6c36860b6ba35c610c98ce87d4e2f26f # v2.10.2
       with:
-        egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
-
+        disable-sudo: true
+        egress-policy: block
+        allowed-endpoints: >
+          archive.ubuntu.com:80
+          auth.docker.io:443
+          demo.mapserver.org:443
+          files.pythonhosted.org:443
+          github.com:443
+          production.cloudflare.docker.com:443
+          pypi.org:443
+          qgis.org:443
+          raw.githubusercontent.com:443
+          registry-1.docker.io:443
+  
     - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       with:
         fetch-depth: 1

diff --git a/.github/workflows/pofiles.yml b/.github/workflows/pofiles.yml
@@ -24,7 +24,13 @@ jobs:
     - name: Harden Runner
       uses: step-security/harden-runner@0080882f6c36860b6ba35c610c98ce87d4e2f26f # v2.10.2
       with:
-        egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
+        disable-sudo: true
+        egress-policy: block
+        allowed-endpoints: >
+          files.pythonhosted.org:443
+          github.com:443
+          pypi.org:443
+          qgis.org:443
 
     - name: checkout
       uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

diff --git a/.github/workflows/pull_minimized_translations.yml b/.github/workflows/pull_minimized_translations.yml
@@ -25,7 +25,14 @@ jobs:
     - name: Harden Runner
       uses: step-security/harden-runner@0080882f6c36860b6ba35c610c98ce87d4e2f26f # v2.10.2
       with:
-        egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
+        egress-policy: block
+        allowed-endpoints: >
+          api.ipify.org:443
+          github.com:443
+          objects.githubusercontent.com:443
+          raw.githubusercontent.com:443
+          rest.api.transifex.com:443
+          storage.svc.transifex.net:443
 
     - name: Check out repository
       uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

diff --git a/.github/workflows/stale.yml b/.github/workflows/stale.yml
@@ -17,7 +17,10 @@ jobs:
     - name: Harden Runner
       uses: step-security/harden-runner@0080882f6c36860b6ba35c610c98ce87d4e2f26f # v2.10.2
       with:
-        egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
+        disable-sudo: true
+        egress-policy: block
+        allowed-endpoints: >
+          api.github.com:443
 
     - uses: actions/stale@28ca1036281a5e5922ead5184a1bbf96e5fc984e # v9.0.0
       with:

diff --git a/.github/workflows/translation_statistics.yml b/.github/workflows/translation_statistics.yml
@@ -29,7 +29,14 @@ jobs:
     - name: Harden Runner
       uses: step-security/harden-runner@0080882f6c36860b6ba35c610c98ce87d4e2f26f # v2.10.2
       with:
-        egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
+        disable-sudo: true
+        egress-policy: block
+        allowed-endpoints: >
+          api.github.com:443
+          files.pythonhosted.org:443
+          github.com:443
+          pypi.org:443
+          rest.api.transifex.com:443
 
     - name: Check out repository
       uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2