Skip to content

Feat: Add build egress hatch and bump allow-list #37

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
tykeal merged 1 commit into from
Jul 29, 2026
Merged

Feat: Add build egress hatch and bump allow-list #37

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
112 changes: 45 additions & 67 deletions .github/workflows/build-test-multiarch.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -221,12 +221,22 @@ on:
required: false
type: string
default: 'block'
build_permit_egress_traffic:
description: >
Run harden-runner in audit mode for the build job only,
permitting unrestricted egress. Use when the build fetches
dependencies from CDNs that are impractical to enumerate in the
allow-list. Other jobs stay governed by harden_runner_egress;
left unset, the build job follows it too.
required: false
type: boolean
default: false
harden_runner_allowlist:
description: 'Out-of-band harden-runner allow-list configuration'
required: false
type: string
# yamllint disable-line rule:line-length
default: 'lfreleng-actions//.github/harden-runner/lfreleng-actions/allow_list.txt@18d9c4446bea555d0783e850f6d295f844fe8f67' # v0.1.1
default: 'lfreleng-actions//.github/harden-runner/lfreleng-actions/allow_list.txt@60d8d71016f31c26775e5ec9380eba4264aa6f9e' # v0.12.1

# --- Gerrit-aware checkout (empty unless dispatched via Gerrit) ---
gerrit_refspec:
Expand Down Expand Up @@ -372,26 +382,19 @@ jobs:
pull-requests: read # Gather repository/PR metadata
timeout-minutes: 5
steps:
- name: 'Load egress allow-list (block mode)'
if: inputs.harden_runner_egress != 'audit'
- name: 'Load egress allow-list'
# yamllint disable-line rule:line-length
uses: lfreleng-actions/harden-runner-block-action@6db537b3e6d060c3287c5a3ce2c28b55b0af330d # v0.2.1
with:
config: ${{ inputs.harden_runner_allowlist }}
- name: 'Harden runner (block)'
if: inputs.harden_runner_egress != 'audit'
- name: 'Harden runner'
# yamllint disable-line rule:line-length
uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
with:
egress-policy: 'block'
# yamllint disable-line rule:line-length
egress-policy: ${{ inputs.harden_runner_egress == 'audit' && 'audit' || 'block' }}
allowed-endpoints: >
${{ env.CONNECTION_ALLOW_LIST }}
- name: 'Harden runner (audit)'
if: inputs.harden_runner_egress == 'audit'
# yamllint disable-line rule:line-length
uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
with:
egress-policy: 'audit'

- name: 'Checkout Gerrit change'
if: inputs.gerrit_refspec != ''
Expand Down Expand Up @@ -436,26 +439,19 @@ jobs:
contents: read
timeout-minutes: 5
steps:
- name: 'Load egress allow-list (block mode)'
if: inputs.harden_runner_egress != 'audit'
- name: 'Load egress allow-list'
# yamllint disable-line rule:line-length
uses: lfreleng-actions/harden-runner-block-action@6db537b3e6d060c3287c5a3ce2c28b55b0af330d # v0.2.1
with:
config: ${{ inputs.harden_runner_allowlist }}
- name: 'Harden runner (block)'
if: inputs.harden_runner_egress != 'audit'
- name: 'Harden runner'
# yamllint disable-line rule:line-length
uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
with:
egress-policy: 'block'
# yamllint disable-line rule:line-length
egress-policy: ${{ inputs.harden_runner_egress == 'audit' && 'audit' || 'block' }}
allowed-endpoints: >
${{ env.CONNECTION_ALLOW_LIST }}
- name: 'Harden runner (audit)'
if: inputs.harden_runner_egress == 'audit'
# yamllint disable-line rule:line-length
uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
with:
egress-policy: 'audit'

- name: 'Checkout Gerrit change'
if: inputs.gerrit_refspec != ''
Expand Down Expand Up @@ -517,26 +513,29 @@ jobs:
contents: read
timeout-minutes: ${{ inputs.build_timeout_minutes }}
steps:
- name: 'Load egress allow-list (block mode)'
if: inputs.harden_runner_egress != 'audit'
# The build job can opt into audit egress independently of the
# other jobs via build_permit_egress_traffic, for dependency
# fetches from CDNs impractical to enumerate in the allow-list.
# Left unset it follows harden_runner_egress like every other job.
#
# One harden-runner step with the policy computed, rather than
# two selected by condition: harden-runner declares a 'pre'
# entry point and no 'pre-if', so its pre-phase runs whatever a
# step-level 'if:' says. Both would engage the agent, the first
# would win, and audit mode would be unreachable.
- name: 'Load egress allow-list'
# yamllint disable-line rule:line-length
uses: lfreleng-actions/harden-runner-block-action@6db537b3e6d060c3287c5a3ce2c28b55b0af330d # v0.2.1
with:
config: ${{ inputs.harden_runner_allowlist }}
- name: 'Harden runner (block)'
if: inputs.harden_runner_egress != 'audit'
- name: 'Harden runner'
# yamllint disable-line rule:line-length
uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
with:
egress-policy: 'block'
# yamllint disable-line rule:line-length
egress-policy: ${{ (inputs.build_permit_egress_traffic || inputs.harden_runner_egress == 'audit') && 'audit' || 'block' }}
allowed-endpoints: >
${{ env.CONNECTION_ALLOW_LIST }}
- name: 'Harden runner (audit)'
if: inputs.harden_runner_egress == 'audit'
# yamllint disable-line rule:line-length
uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
with:
egress-policy: 'audit'

- name: 'Checkout Gerrit change'
if: inputs.gerrit_refspec != ''
Expand Down Expand Up @@ -617,26 +616,19 @@ jobs:
contents: read
timeout-minutes: ${{ inputs.test_timeout_minutes }}
steps:
- name: 'Load egress allow-list (block mode)'
if: inputs.harden_runner_egress != 'audit'
- name: 'Load egress allow-list'
# yamllint disable-line rule:line-length
uses: lfreleng-actions/harden-runner-block-action@6db537b3e6d060c3287c5a3ce2c28b55b0af330d # v0.2.1
with:
config: ${{ inputs.harden_runner_allowlist }}
- name: 'Harden runner (block)'
if: inputs.harden_runner_egress != 'audit'
- name: 'Harden runner'
# yamllint disable-line rule:line-length
uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
with:
egress-policy: 'block'
# yamllint disable-line rule:line-length
egress-policy: ${{ inputs.harden_runner_egress == 'audit' && 'audit' || 'block' }}
allowed-endpoints: >
${{ env.CONNECTION_ALLOW_LIST }}
- name: 'Harden runner (audit)'
if: inputs.harden_runner_egress == 'audit'
# yamllint disable-line rule:line-length
uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
with:
egress-policy: 'audit'

- name: 'Checkout Gerrit change'
if: inputs.gerrit_refspec != ''
Expand Down Expand Up @@ -723,26 +715,19 @@ jobs:
contents: read
timeout-minutes: ${{ inputs.audit_timeout_minutes }}
steps:
- name: 'Load egress allow-list (block mode)'
if: inputs.harden_runner_egress != 'audit'
- name: 'Load egress allow-list'
# yamllint disable-line rule:line-length
uses: lfreleng-actions/harden-runner-block-action@6db537b3e6d060c3287c5a3ce2c28b55b0af330d # v0.2.1
with:
config: ${{ inputs.harden_runner_allowlist }}
- name: 'Harden runner (block)'
if: inputs.harden_runner_egress != 'audit'
- name: 'Harden runner'
# yamllint disable-line rule:line-length
uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
with:
egress-policy: 'block'
# yamllint disable-line rule:line-length
egress-policy: ${{ inputs.harden_runner_egress == 'audit' && 'audit' || 'block' }}
allowed-endpoints: >
${{ env.CONNECTION_ALLOW_LIST }}
- name: 'Harden runner (audit)'
if: inputs.harden_runner_egress == 'audit'
# yamllint disable-line rule:line-length
uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
with:
egress-policy: 'audit'

- name: 'Checkout Gerrit change'
if: inputs.gerrit_refspec != ''
Expand Down Expand Up @@ -816,26 +801,19 @@ jobs:
contents: read
timeout-minutes: ${{ inputs.audit_timeout_minutes }}
steps:
- name: 'Load egress allow-list (block mode)'
if: inputs.harden_runner_egress != 'audit'
- name: 'Load egress allow-list'
# yamllint disable-line rule:line-length
uses: lfreleng-actions/harden-runner-block-action@6db537b3e6d060c3287c5a3ce2c28b55b0af330d # v0.2.1
with:
config: ${{ inputs.harden_runner_allowlist }}
- name: 'Harden runner (block)'
if: inputs.harden_runner_egress != 'audit'
- name: 'Harden runner'
# yamllint disable-line rule:line-length
uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
with:
egress-policy: 'block'
# yamllint disable-line rule:line-length
egress-policy: ${{ inputs.harden_runner_egress == 'audit' && 'audit' || 'block' }}
allowed-endpoints: >
${{ env.CONNECTION_ALLOW_LIST }}
- name: 'Harden runner (audit)'
if: inputs.harden_runner_egress == 'audit'
# yamllint disable-line rule:line-length
uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
with:
egress-policy: 'audit'

- name: 'Checkout Gerrit change'
if: inputs.gerrit_refspec != ''
Expand Down
Loading
Loading