search

step-security / secure-repo

Orchestrate GitHub Actions Security
https://app.stepsecurity.io
GNU Affero General Public License v3.0
257 stars 41 forks source link

Duplicate Harden Runner #2401

Open konstruktoid opened 11 months ago

konstruktoid commented 11 months ago

When adding a "Harden Runner" to an action, it doesn't check if there is already an runner present. It seems it only adds an duplicate runner when https://github.com/slsa-framework/slsa-github-generator is used.

https://github.com/konstruktoid/ansible-role-hardening/commit/9c2da3afd3ef6267dc7f11a00c24ddba524495b9#diff-277991c5b829f3784ce03bf0c5fb0f43ee3f3d5325dfd3ef136f3cf3d83dfb6f

https://github.com/konstruktoid/ansible-role-hardening/blob/9b38aa459f6b1333ffc9c66ae857c8e1d7cd45fa/.github/workflows/slsa.yml#L18-L27

https://github.com/konstruktoid/ansible-role-hardening/actions/runs/7287514260

https://github.com/konstruktoid/ansible-role-docker-rootless/pull/257/files#diff-277991c5b829f3784ce03bf0c5fb0f43ee3f3d5325dfd3ef136f3cf3d83dfb6f

varunsh-coder commented 11 months ago

Thanks @konstruktoid for creating the issue! I will investigate and get back

konstruktoid commented 5 months ago

https://github.com/konstruktoid/ansible-role-template/pull/189/files#diff-277991c5b829f3784ce03bf0c5fb0f43ee3f3d5325dfd3ef136f3cf3d83dfb6f