Skip to content

Commit 01c2c29

Browse files
amankongamankong
authored
added harden runner to all the jobs (#7574)
1 parent 59fadd5 commit 01c2c29

33 files changed

+264
-0
lines changed

‎.github/workflows/_conformance_tests.yaml‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,10 @@ jobs:
1919
outputs:
2020
helm-kong: ${{ steps.set-versions.outputs.helm-kong }}
2121
steps:
22+
- name: Harden Runner
23+
uses: step-security/harden-runner@c6295a65d1254861815972266d5933fd6e532bdf # v2.11.1
24+
with:
25+
egress-policy: audit
2226
- name: checkout repository
2327
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
2428

@@ -43,6 +47,10 @@ jobs:
4347
- name: expressions-router
4448
router-flavor: expressions
4549
steps:
50+
- name: Harden Runner
51+
uses: step-security/harden-runner@c6295a65d1254861815972266d5933fd6e532bdf # v2.11.1
52+
with:
53+
egress-policy: audit
4654
- name: checkout repository
4755
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
4856

@@ -87,6 +95,10 @@ jobs:
8795
needs:
8896
- conformance-tests
8997
steps:
98+
- name: Harden Runner
99+
uses: step-security/harden-runner@c6295a65d1254861815972266d5933fd6e532bdf # v2.11.1
100+
with:
101+
egress-policy: audit
90102
- name: Merge Junit test reports
91103
uses: actions/upload-artifact/merge@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
92104
with:

‎.github/workflows/_docker_build.yaml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,10 @@ jobs:
3030
outputs:
3131
tags: ${{ steps.merge-tags.outputs.tags }}
3232
steps:
33+
- name: Harden Runner
34+
uses: step-security/harden-runner@c6295a65d1254861815972266d5933fd6e532bdf # v2.11.1
35+
with:
36+
egress-policy: audit
3337
- name: checkout repository
3438
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
3539

@@ -80,6 +84,10 @@ jobs:
8084
outputs:
8185
image: kong/kubernetes-ingress-controller:${{ steps.meta.outputs.version }}
8286
steps:
87+
- name: Harden Runner
88+
uses: step-security/harden-runner@c6295a65d1254861815972266d5933fd6e532bdf # v2.11.1
89+
with:
90+
egress-policy: audit
8391
- name: checkout repository
8492
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
8593

‎.github/workflows/_e2e_tests.yaml‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -42,6 +42,10 @@ jobs:
4242
outputs:
4343
test_names: ${{ steps.set_test_names.outputs.test_names }}
4444
steps:
45+
- name: Harden Runner
46+
uses: step-security/harden-runner@c6295a65d1254861815972266d5933fd6e532bdf # v2.11.1
47+
with:
48+
egress-policy: audit
4549
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
4650

4751
- id: setup_golang
@@ -80,6 +84,10 @@ jobs:
8084
gke: ${{ steps.set-versions.outputs.gke }}
8185
istio: ${{ steps.set-versions.outputs.istio }}
8286
steps:
87+
- name: Harden Runner
88+
uses: step-security/harden-runner@c6295a65d1254861815972266d5933fd6e532bdf # v2.11.1
89+
with:
90+
egress-policy: audit
8391
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
8492

8593
- id: set-versions
@@ -107,6 +115,10 @@ jobs:
107115
kubernetes-version: ${{ fromJSON(needs.dependencies-versions.outputs.kind) }}
108116
test: ${{ fromJSON(needs.setup-e2e-tests.outputs.test_names) }}
109117
steps:
118+
- name: Harden Runner
119+
uses: step-security/harden-runner@c6295a65d1254861815972266d5933fd6e532bdf # v2.11.1
120+
with:
121+
egress-policy: audit
110122
- name: Download built image artifact
111123
if: ${{ inputs.load-local-image }}
112124
uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
@@ -223,6 +235,10 @@ jobs:
223235
kubernetes-version: ${{ fromJSON(needs.dependencies-versions.outputs.gke) }}
224236
test: ${{ fromJSON(needs.setup-e2e-tests.outputs.test_names) }}
225237
steps:
238+
- name: Harden Runner
239+
uses: step-security/harden-runner@c6295a65d1254861815972266d5933fd6e532bdf # v2.11.1
240+
with:
241+
egress-policy: audit
226242
- name: checkout repository
227243
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
228244

@@ -339,6 +355,10 @@ jobs:
339355
matrix:
340356
include: ${{ fromJSON(needs.dependencies-versions.outputs.istio) }}
341357
steps:
358+
- name: Harden Runner
359+
uses: step-security/harden-runner@c6295a65d1254861815972266d5933fd6e532bdf # v2.11.1
360+
with:
361+
egress-policy: audit
342362
- name: Download built image artifact
343363
if: ${{ inputs.load-local-image }}
344364
uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0

‎.github/workflows/_envtest_tests.yaml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,10 @@ jobs:
1111
timeout-minutes: ${{ fromJSON(vars.GHA_DEFAULT_TIMEOUT || 10) }}
1212
runs-on: ubuntu-latest
1313
steps:
14+
- name: Harden Runner
15+
uses: step-security/harden-runner@c6295a65d1254861815972266d5933fd6e532bdf # v2.11.1
16+
with:
17+
egress-policy: audit
1418
- name: checkout repository
1519
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
1620

‎.github/workflows/_integration_tests.yaml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -52,6 +52,10 @@ jobs:
5252
kong-oss: ${{ steps.set-versions.outputs.kong-oss }}
5353
helm-kong: ${{ steps.set-versions.outputs.helm-kong }}
5454
steps:
55+
- name: Harden Runner
56+
uses: step-security/harden-runner@c6295a65d1254861815972266d5933fd6e532bdf # v2.11.1
57+
with:
58+
egress-policy: audit
5559
- name: checkout repository
5660
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
5761

@@ -148,6 +152,10 @@ jobs:
148152
enterprise: true
149153

150154
steps:
155+
- name: Harden Runner
156+
uses: step-security/harden-runner@c6295a65d1254861815972266d5933fd6e532bdf # v2.11.1
157+
with:
158+
egress-policy: audit
151159
- uses: Kong/kong-license@c4decf08584f84ff8fe8e7cd3c463e0192f6111b # master @ 20250107
152160
id: license
153161
with:

‎.github/workflows/_kongintegration_tests.yaml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,10 @@ jobs:
1919
- name: oss
2020
enterprise: false
2121
steps:
22+
- name: Harden Runner
23+
uses: step-security/harden-runner@c6295a65d1254861815972266d5933fd6e532bdf # v2.11.1
24+
with:
25+
egress-policy: audit
2226
- name: checkout repository
2327
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
2428

‎.github/workflows/_linters.yaml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,10 @@ jobs:
1111
timeout-minutes: ${{ fromJSON(vars.GHA_DEFAULT_TIMEOUT || 10) }}
1212
runs-on: ubuntu-latest
1313
steps:
14+
- name: Harden Runner
15+
uses: step-security/harden-runner@c6295a65d1254861815972266d5933fd6e532bdf # v2.11.1
16+
with:
17+
egress-policy: audit
1418
- name: Checkout repository
1519
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
1620

@@ -41,6 +45,10 @@ jobs:
4145
timeout-minutes: ${{ fromJSON(vars.GHA_DEFAULT_TIMEOUT || 10) }}
4246
runs-on: ubuntu-latest
4347
steps:
48+
- name: Harden Runner
49+
uses: step-security/harden-runner@c6295a65d1254861815972266d5933fd6e532bdf # v2.11.1
50+
with:
51+
egress-policy: audit
4452
- name: Checkout repository
4553
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
4654

‎.github/workflows/_performance_tests.yaml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -36,6 +36,10 @@ jobs:
3636
resource-number: [1000, 2500, 5000]
3737
fail-fast: false
3838
steps:
39+
- name: Harden Runner
40+
uses: step-security/harden-runner@c6295a65d1254861815972266d5933fd6e532bdf # v2.11.1
41+
with:
42+
egress-policy: audit
3943
- name: Download built image artifact
4044
if: ${{ inputs.load-local-image }}
4145
uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
@@ -129,6 +133,10 @@ jobs:
129133
strategy:
130134
fail-fast: false
131135
steps:
136+
- name: Harden Runner
137+
uses: step-security/harden-runner@c6295a65d1254861815972266d5933fd6e532bdf # v2.11.1
138+
with:
139+
egress-policy: audit
132140
- name: Download built image artifact
133141
if: ${{ inputs.load-local-image }}
134142
uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0

‎.github/workflows/_test_reports.yaml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,10 @@ jobs:
2525
runs-on: ubuntu-latest
2626
if: ${{ inputs.coverage && !cancelled() }}
2727
steps:
28+
- name: Harden Runner
29+
uses: step-security/harden-runner@c6295a65d1254861815972266d5933fd6e532bdf # v2.11.1
30+
with:
31+
egress-policy: audit
2832
- name: checkout repository
2933
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
3034

@@ -50,6 +54,10 @@ jobs:
5054
if: ${{ inputs.buildpulse && !cancelled() }}
5155
runs-on: ubuntu-latest
5256
steps:
57+
- name: Harden Runner
58+
uses: step-security/harden-runner@c6295a65d1254861815972266d5933fd6e532bdf # v2.11.1
59+
with:
60+
egress-policy: audit
5361
- name: checkout repository
5462
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
5563

‎.github/workflows/_unit_tests.yaml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,10 @@ jobs:
1111
timeout-minutes: ${{ fromJSON(vars.GHA_DEFAULT_TIMEOUT || 10) }}
1212
runs-on: ubuntu-latest
1313
steps:
14+
- name: Harden Runner
15+
uses: step-security/harden-runner@c6295a65d1254861815972266d5933fd6e532bdf # v2.11.1
16+
with:
17+
egress-policy: audit
1418
- name: checkout repository
1519
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
1620

0 commit comments

Comments
 (0)