1
1
---
2
2
author : Cybersecurity and Infrastructure Security Agency
3
+
3
4
branding :
4
5
color : blue
5
6
icon : shield
7
+
6
8
description : >-
7
9
Our standard permissions monitoring and runner hardening that is to
8
10
be applied at the beginning of each GitHub Actions job.
11
+
9
12
name : Job preamble
10
13
11
14
inputs :
@@ -16,34 +19,39 @@ inputs:
16
19
check GitHub status using the crazy-max/ghaction-github-status
17
20
GitHub action.
18
21
required : false
22
+
19
23
harden_runner :
20
24
default : " true"
21
25
description : >-
22
26
A Boolean ("true"/"false") value indicating whether or not to
23
27
harden the runner using the step-security/harden-runner GitHub
24
28
action.
25
29
required : false
30
+
26
31
harden_runner_egress_policy :
27
32
default : audit
28
33
description : >-
29
34
The egress policy to use for runner hardening. Valid values are
30
35
audit and block. See step-security/harden-runner for more
31
36
details.
32
37
required : false
38
+
33
39
monitor_permissions :
34
40
default : " true"
35
41
description : >-
36
42
A Boolean ("true"/"false") value indicating whether or not to
37
43
monitor GitHub permission requests using the
38
44
GitHubSecurityLab/actions-permission/monitor GitHub action.
39
45
required : false
46
+
40
47
output_workflow_context :
41
48
default : " false"
42
49
description : >-
43
50
A Boolean ("true"/"false") value indicating whether or not to
44
51
output the workflow context using the
45
52
crazy-max/ghaction-dump-context GitHub action.
46
53
required : false
54
+
47
55
permissions_monitoring_config :
48
56
default : " "
49
57
description : >-
@@ -74,16 +82,19 @@ runs:
74
82
uses : GitHubSecurityLab/actions-permissions/monitor@v1
75
83
with :
76
84
config : ${{ inputs.permissions_monitoring_config }}
85
+
77
86
- id : harden-runner
78
87
if : ${{ inputs.harden_runner == 'true' }}
79
88
name : Harden the runner
80
89
uses : step-security/harden-runner@v2
81
90
with :
82
91
egress-policy : ${{ inputs.harden_runner_egress_policy }}
92
+
83
93
- id : check-github-status
84
94
if : ${{ inputs.check_github_status == 'true' }}
85
95
name : Check GitHub status
86
96
uses : crazy-max/ghaction-github-status@v4
97
+
87
98
- id : output-workflow-context
88
99
if : ${{ inputs.output_workflow_context == 'true' }}
89
100
name : Output workflow context
0 commit comments