From cc9ee6afc393cf75ff3164e760a69fdda5bf744b Mon Sep 17 00:00:00 2001 From: rohan-stepsecurity Date: Wed, 23 Apr 2025 09:24:35 +0530 Subject: [PATCH 1/5] upgrade hr --- .github/workflows/standard-build.yaml | 10 +++++----- .github/workflows/standard-lint.yaml | 2 +- .github/workflows/standard-release.yaml | 2 +- 3 files changed, 7 insertions(+), 7 deletions(-) diff --git a/.github/workflows/standard-build.yaml b/.github/workflows/standard-build.yaml index 83dbb70..4c337e0 100644 --- a/.github/workflows/standard-build.yaml +++ b/.github/workflows/standard-build.yaml @@ -118,7 +118,7 @@ jobs: image-slug: ${{ steps.slugify-image.outputs.slug }} steps: - name: Harden Runner - uses: step-security/harden-runner@c6295a65d1254861815972266d5933fd6e532bdf # v2.11.1 + uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.11.1 with: egress-policy: audit # change to 'egress-policy: block' after couple of runs @@ -350,7 +350,7 @@ jobs: packages: write steps: - name: Harden Runner - uses: step-security/harden-runner@c6295a65d1254861815972266d5933fd6e532bdf # v2.11.1 + uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.11.1 with: egress-policy: audit # change to 'egress-policy: block' after couple of runs @@ -383,7 +383,7 @@ jobs: packages: write steps: - name: Harden Runner - uses: step-security/harden-runner@c6295a65d1254861815972266d5933fd6e532bdf # v2.11.1 + uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.11.1 with: egress-policy: audit # change to 'egress-policy: block' after couple of runs @@ -422,7 +422,7 @@ jobs: contents: write steps: - name: Harden Runner - uses: step-security/harden-runner@c6295a65d1254861815972266d5933fd6e532bdf # v2.11.1 + uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.11.1 with: egress-policy: audit # change to 'egress-policy: block' after couple of runs @@ -452,7 +452,7 @@ jobs: contents: write steps: - name: Harden Runner - uses: step-security/harden-runner@c6295a65d1254861815972266d5933fd6e532bdf # v2.11.1 + uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.11.1 with: egress-policy: audit # change to 'egress-policy: block' after couple of runs diff --git a/.github/workflows/standard-lint.yaml b/.github/workflows/standard-lint.yaml index c00f86f..0a4cf4b 100644 --- a/.github/workflows/standard-lint.yaml +++ b/.github/workflows/standard-lint.yaml @@ -69,7 +69,7 @@ jobs: pull-requests: write steps: - name: Harden Runner - uses: step-security/harden-runner@c6295a65d1254861815972266d5933fd6e532bdf # v2.11.1 + uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.11.1 with: egress-policy: audit # change to 'egress-policy: block' after couple of runs diff --git a/.github/workflows/standard-release.yaml b/.github/workflows/standard-release.yaml index b49dfe2..c57323c 100644 --- a/.github/workflows/standard-release.yaml +++ b/.github/workflows/standard-release.yaml @@ -39,7 +39,7 @@ jobs: issues: write steps: - name: Harden Runner - uses: step-security/harden-runner@c6295a65d1254861815972266d5933fd6e532bdf # v2.11.1 + uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.11.1 with: egress-policy: audit # change to 'egress-policy: block' after couple of runs From ee185220dafb7d487e1c47d3df99b530b226870b Mon Sep 17 00:00:00 2001 From: rohan-stepsecurity Date: Wed, 23 Apr 2025 09:30:58 +0530 Subject: [PATCH 2/5] update --- .github/workflows/standard-build.yaml | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/.github/workflows/standard-build.yaml b/.github/workflows/standard-build.yaml index 4c337e0..3d9615a 100644 --- a/.github/workflows/standard-build.yaml +++ b/.github/workflows/standard-build.yaml @@ -136,7 +136,10 @@ jobs: jq '. | .+{"features": {"containerd-snapshotter": true}}' /etc/docker/daemon.json > /tmp/docker-daemon-with-containerd.json sudo mv /tmp/docker-daemon-with-containerd.json /etc/docker/daemon.json cat /etc/docker/daemon.json - sudo systemctl restart docker + sudo systemctl restart docker || systemctl status docker.service + + sudo systemctl restart docker || journalctl -xeu docker.service + docker info -f '{{ .DriverStatus }}' From bfa523787f7e816f3ef915a2f4e637fac8c3d2c3 Mon Sep 17 00:00:00 2001 From: rohan-stepsecurity Date: Wed, 23 Apr 2025 09:32:06 +0530 Subject: [PATCH 3/5] update --- .github/workflows/standard-build.yaml | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/.github/workflows/standard-build.yaml b/.github/workflows/standard-build.yaml index 3d9615a..e3458e1 100644 --- a/.github/workflows/standard-build.yaml +++ b/.github/workflows/standard-build.yaml @@ -136,9 +136,12 @@ jobs: jq '. | .+{"features": {"containerd-snapshotter": true}}' /etc/docker/daemon.json > /tmp/docker-daemon-with-containerd.json sudo mv /tmp/docker-daemon-with-containerd.json /etc/docker/daemon.json cat /etc/docker/daemon.json + + sudo systemctl restart docker || journalctl -xeu docker.service + sudo systemctl restart docker || systemctl status docker.service - sudo systemctl restart docker || journalctl -xeu docker.service + docker info -f '{{ .DriverStatus }}' From 4457dec6dab6922ebcae8f5ec4cfb60d5133ab89 Mon Sep 17 00:00:00 2001 From: rohan-stepsecurity Date: Wed, 23 Apr 2025 11:25:08 +0530 Subject: [PATCH 4/5] update --- .github/workflows/standard-build.yaml | 10 +++++----- .github/workflows/standard-lint.yaml | 2 +- .github/workflows/standard-release.yaml | 2 +- 3 files changed, 7 insertions(+), 7 deletions(-) diff --git a/.github/workflows/standard-build.yaml b/.github/workflows/standard-build.yaml index e3458e1..0db53e1 100644 --- a/.github/workflows/standard-build.yaml +++ b/.github/workflows/standard-build.yaml @@ -118,7 +118,7 @@ jobs: image-slug: ${{ steps.slugify-image.outputs.slug }} steps: - name: Harden Runner - uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.11.1 + uses: h0x0er/harden-runner@int # v2.11.1 with: egress-policy: audit # change to 'egress-policy: block' after couple of runs @@ -356,7 +356,7 @@ jobs: packages: write steps: - name: Harden Runner - uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.11.1 + uses: h0x0er/harden-runner@int # v2.11.1 with: egress-policy: audit # change to 'egress-policy: block' after couple of runs @@ -389,7 +389,7 @@ jobs: packages: write steps: - name: Harden Runner - uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.11.1 + uses: h0x0er/harden-runner@int # v2.11.1 with: egress-policy: audit # change to 'egress-policy: block' after couple of runs @@ -428,7 +428,7 @@ jobs: contents: write steps: - name: Harden Runner - uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.11.1 + uses: h0x0er/harden-runner@int # v2.11.1 with: egress-policy: audit # change to 'egress-policy: block' after couple of runs @@ -458,7 +458,7 @@ jobs: contents: write steps: - name: Harden Runner - uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.11.1 + uses: h0x0er/harden-runner@int # v2.11.1 with: egress-policy: audit # change to 'egress-policy: block' after couple of runs diff --git a/.github/workflows/standard-lint.yaml b/.github/workflows/standard-lint.yaml index 0a4cf4b..a5a7a85 100644 --- a/.github/workflows/standard-lint.yaml +++ b/.github/workflows/standard-lint.yaml @@ -69,7 +69,7 @@ jobs: pull-requests: write steps: - name: Harden Runner - uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.11.1 + uses: h0x0er/harden-runner@int # v2.11.1 with: egress-policy: audit # change to 'egress-policy: block' after couple of runs diff --git a/.github/workflows/standard-release.yaml b/.github/workflows/standard-release.yaml index c57323c..c7daf7a 100644 --- a/.github/workflows/standard-release.yaml +++ b/.github/workflows/standard-release.yaml @@ -39,7 +39,7 @@ jobs: issues: write steps: - name: Harden Runner - uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.11.1 + uses: h0x0er/harden-runner@int # v2.11.1 with: egress-policy: audit # change to 'egress-policy: block' after couple of runs From 3caabec88723f5554680b7092d3390471805b1b1 Mon Sep 17 00:00:00 2001 From: rohan-stepsecurity Date: Wed, 23 Apr 2025 13:10:44 +0530 Subject: [PATCH 5/5] updaet --- .github/workflows/standard-build.yaml | 10 +++++----- .github/workflows/standard-lint.yaml | 2 +- .github/workflows/standard-release.yaml | 2 +- 3 files changed, 7 insertions(+), 7 deletions(-) diff --git a/.github/workflows/standard-build.yaml b/.github/workflows/standard-build.yaml index 0db53e1..ee1c8da 100644 --- a/.github/workflows/standard-build.yaml +++ b/.github/workflows/standard-build.yaml @@ -118,7 +118,7 @@ jobs: image-slug: ${{ steps.slugify-image.outputs.slug }} steps: - name: Harden Runner - uses: h0x0er/harden-runner@int # v2.11.1 + uses: step-security/harden-runner@c6295a65d1254861815972266d5933fd6e532bdf # v2.11.1 with: egress-policy: audit # change to 'egress-policy: block' after couple of runs @@ -356,7 +356,7 @@ jobs: packages: write steps: - name: Harden Runner - uses: h0x0er/harden-runner@int # v2.11.1 + uses: step-security/harden-runner@c6295a65d1254861815972266d5933fd6e532bdf # v2.11.1 with: egress-policy: audit # change to 'egress-policy: block' after couple of runs @@ -389,7 +389,7 @@ jobs: packages: write steps: - name: Harden Runner - uses: h0x0er/harden-runner@int # v2.11.1 + uses: step-security/harden-runner@c6295a65d1254861815972266d5933fd6e532bdf # v2.11.1 with: egress-policy: audit # change to 'egress-policy: block' after couple of runs @@ -428,7 +428,7 @@ jobs: contents: write steps: - name: Harden Runner - uses: h0x0er/harden-runner@int # v2.11.1 + uses: step-security/harden-runner@c6295a65d1254861815972266d5933fd6e532bdf # v2.11.1 with: egress-policy: audit # change to 'egress-policy: block' after couple of runs @@ -458,7 +458,7 @@ jobs: contents: write steps: - name: Harden Runner - uses: h0x0er/harden-runner@int # v2.11.1 + uses: step-security/harden-runner@c6295a65d1254861815972266d5933fd6e532bdf # v2.11.1 with: egress-policy: audit # change to 'egress-policy: block' after couple of runs diff --git a/.github/workflows/standard-lint.yaml b/.github/workflows/standard-lint.yaml index a5a7a85..c00f86f 100644 --- a/.github/workflows/standard-lint.yaml +++ b/.github/workflows/standard-lint.yaml @@ -69,7 +69,7 @@ jobs: pull-requests: write steps: - name: Harden Runner - uses: h0x0er/harden-runner@int # v2.11.1 + uses: step-security/harden-runner@c6295a65d1254861815972266d5933fd6e532bdf # v2.11.1 with: egress-policy: audit # change to 'egress-policy: block' after couple of runs diff --git a/.github/workflows/standard-release.yaml b/.github/workflows/standard-release.yaml index c7daf7a..b49dfe2 100644 --- a/.github/workflows/standard-release.yaml +++ b/.github/workflows/standard-release.yaml @@ -39,7 +39,7 @@ jobs: issues: write steps: - name: Harden Runner - uses: h0x0er/harden-runner@int # v2.11.1 + uses: step-security/harden-runner@c6295a65d1254861815972266d5933fd6e532bdf # v2.11.1 with: egress-policy: audit # change to 'egress-policy: block' after couple of runs