Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commita9da90b

Browse files
Merge pull request#553 from h0x0er/feat/container-workflows
self-hosted: refactored block-policy apply logic
2 parentsfa70c45 +a60ef21 commita9da90b

File tree

12 files changed

+79
-72
lines changed

12 files changed

+79
-72
lines changed

‎.github/workflows/test.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -39,7 +39,7 @@ jobs:
3939
run:npm test -- --coverage
4040
-uses:codecov/codecov-action@eaaf4bedf32dbdc6b720b63067d99c4d77d6047d# v3.1.4
4141
-name:Publish Test Results
42-
uses:step-security/publish-unit-test-result-action@cc82caac074385ae176d39d2d143ad05e1130b2d# v2.18.0
42+
uses:step-security/publish-unit-test-result-action@b495e9a82021fc8f34737416de688298581b847d# v2.19.0
4343
if:always()
4444
with:
4545
files:|

‎dist/index.js

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -27752,7 +27752,7 @@ function addSummary() {
2775227752
const STATUS_HARDEN_RUNNER_UNAVAILABLE = "409";
2775327753
const CONTAINER_MESSAGE = "This job is running in a container. Harden Runner does not run in a container as it needs sudo access to run. This job will not be monitored.";
2775427754
const UBUNTU_MESSAGE = "This job is not running in a GitHub Actions Hosted Runner Ubuntu VM. Harden Runner is only supported on Ubuntu VM. This job will not be monitored.";
27755-
constSELF_HOSTED_NO_AGENT_MESSAGE = "This job is running on a self-hosted runner, but the runner does not have Harden-Runner installed. This job will not be monitored.";
27755+
constSELF_HOSTED_RUNNER_MESSAGE = "This job is running on a self-hosted runner.";
2775627756
const HARDEN_RUNNER_UNAVAILABLE_MESSAGE = "Sorry, we are currently experiencing issues with the Harden Runner installation process. It is currently unavailable.";
2775727757
const ARC_RUNNER_MESSAGE = "Workflow is currently being executed in ARC based runner.";
2775827758
const ARM64_RUNNER_MESSAGE = "ARM runners are not supported in the Harden-Runner community tier.";

‎dist/index.js.map

Lines changed: 1 addition & 1 deletion
Some generated files are not rendered by default. Learn more aboutcustomizing how changed files appear on GitHub.

‎dist/post/index.js

Lines changed: 16 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -27751,7 +27751,7 @@ function addSummary() {
2775127751
const STATUS_HARDEN_RUNNER_UNAVAILABLE = "409";
2775227752
const CONTAINER_MESSAGE = "This job is running in a container. Harden Runner does not run in a container as it needs sudo access to run. This job will not be monitored.";
2775327753
const UBUNTU_MESSAGE = "This job is not running in a GitHub Actions Hosted Runner Ubuntu VM. Harden Runner is only supported on Ubuntu VM. This job will not be monitored.";
27754-
constSELF_HOSTED_NO_AGENT_MESSAGE = "This job is running on a self-hosted runner, but the runner does not have Harden-Runner installed. This job will not be monitored.";
27754+
constSELF_HOSTED_RUNNER_MESSAGE = "This job is running on a self-hosted runner.";
2775527755
const HARDEN_RUNNER_UNAVAILABLE_MESSAGE = "Sorry, we are currently experiencing issues with the Harden Runner installation process. It is currently unavailable.";
2775627756
const ARC_RUNNER_MESSAGE = "Workflow is currently being executed in ARC based runner.";
2775727757
const ARM64_RUNNER_MESSAGE = "ARM runners are not supported in the Harden-Runner community tier.";
@@ -27792,7 +27792,7 @@ function isDocker() {
2779227792
;// CONCATENATED MODULE: ./src/arc-runner.ts
2779327793

2779427794

27795-
functionisArcRunner() {
27795+
functionisARCRunner() {
2779627796
const runnerUserAgent = process.env["GITHUB_ACTIONS_RUNNER_EXTRA_USER_AGENT"];
2779727797
let isARC = false;
2779827798
if (!runnerUserAgent) {
@@ -27805,20 +27805,27 @@ function isArcRunner() {
2780527805
}
2780627806
function isSecondaryPod() {
2780727807
const workDir = "/__w";
27808-
return external_fs_.existsSync(workDir);
27808+
let hasKubeEnv = process.env["KUBERNETES_PORT"] !== undefined;
27809+
return external_fs_.existsSync(workDir) && hasKubeEnv;
2780927810
}
2781027811
function sendAllowedEndpoints(endpoints) {
27812+
const startTime = Date.now();
2781127813
const allowedEndpoints = endpoints.split(" "); // endpoints are space separated
27812-
for (const endpoint of allowedEndpoints) {
27813-
if (endpoint) {
27814+
let sent = 0;
27815+
for (let endpoint of allowedEndpoints) {
27816+
endpoint = endpoint.trim();
27817+
if (endpoint.length > 0) {
2781427818
let encodedEndpoint = Buffer.from(endpoint).toString("base64");
2781527819
let endpointPolicyStr = `step_policy_endpoint_${encodedEndpoint}`;
2781627820
echo(endpointPolicyStr);
27821+
sent++;
2781727822
}
2781827823
}
27819-
if (allowedEndpoints.length > 0) {
27820-
applyPolicy(allowedEndpoints.length);
27824+
if (sent > 0) {
27825+
applyPolicy(sent);
2782127826
}
27827+
const duration = Date.now() - startTime;
27828+
console.log(`[harden-runner] sendAllowedEndpoints completed in ${duration}ms (sent ${sent} endpoints)`);
2782227829
}
2782327830
function applyPolicy(count) {
2782427831
let applyPolicyStr = `step_policy_apply_${count}`;
@@ -27897,7 +27904,7 @@ var cleanup_awaiter = (undefined && undefined.__awaiter) || function (thisArg, _
2789727904
console.log(CONTAINER_MESSAGE);
2789827905
return;
2789927906
}
27900-
if (isArcRunner()) {
27907+
if (isARCRunner()) {
2790127908
console.log(`[!] ${ARC_RUNNER_MESSAGE}`);
2790227909
return;
2790327910
}
@@ -27952,7 +27959,7 @@ var cleanup_awaiter = (undefined && undefined.__awaiter) || function (thisArg, _
2795227959
try {
2795327960
var journalLog = external_child_process_.execSync("sudo journalctl -u agent.service --lines=1000", {
2795427961
encoding: "utf8",
27955-
maxBuffer: 1024 * 1024 * 10 // 10MB buffer
27962+
maxBuffer: 1024 * 1024 * 10, // 10MB buffer
2795627963
});
2795727964
console.log("agent.service log:");
2795827965
console.log(journalLog);

‎dist/post/index.js.map

Lines changed: 1 addition & 1 deletion
Some generated files are not rendered by default. Learn more aboutcustomizing how changed files appear on GitHub.

‎dist/pre/index.js

Lines changed: 18 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -87779,7 +87779,7 @@ function addSummary() {
8777987779
const STATUS_HARDEN_RUNNER_UNAVAILABLE = "409";
8778087780
const CONTAINER_MESSAGE = "This job is running in a container. Harden Runner does not run in a container as it needs sudo access to run. This job will not be monitored.";
8778187781
const UBUNTU_MESSAGE = "This job is not running in a GitHub Actions Hosted Runner Ubuntu VM. Harden Runner is only supported on Ubuntu VM. This job will not be monitored.";
87782-
constSELF_HOSTED_NO_AGENT_MESSAGE = "This job is running on a self-hosted runner, but the runner does not have Harden-Runner installed. This job will not be monitored.";
87782+
constSELF_HOSTED_RUNNER_MESSAGE = "This job is running on a self-hosted runner.";
8778387783
const HARDEN_RUNNER_UNAVAILABLE_MESSAGE = "Sorry, we are currently experiencing issues with the Harden Runner installation process. It is currently unavailable.";
8778487784
const ARC_RUNNER_MESSAGE = "Workflow is currently being executed in ARC based runner.";
8778587785
const ARM64_RUNNER_MESSAGE = "ARM runners are not supported in the Harden-Runner community tier.";
@@ -87920,7 +87920,7 @@ var cacheUtils = __nccwpck_require__(1518);
8792087920
;// CONCATENATED MODULE: ./src/arc-runner.ts
8792187921

8792287922

87923-
functionisArcRunner() {
87923+
functionisARCRunner() {
8792487924
const runnerUserAgent = process.env["GITHUB_ACTIONS_RUNNER_EXTRA_USER_AGENT"];
8792587925
let isARC = false;
8792687926
if (!runnerUserAgent) {
@@ -87933,20 +87933,27 @@ function isArcRunner() {
8793387933
}
8793487934
function isSecondaryPod() {
8793587935
const workDir = "/__w";
87936-
return external_fs_.existsSync(workDir);
87936+
let hasKubeEnv = process.env["KUBERNETES_PORT"] !== undefined;
87937+
return external_fs_.existsSync(workDir) && hasKubeEnv;
8793787938
}
8793887939
function sendAllowedEndpoints(endpoints) {
87940+
const startTime = Date.now();
8793987941
const allowedEndpoints = endpoints.split(" "); // endpoints are space separated
87940-
for (const endpoint of allowedEndpoints) {
87941-
if (endpoint) {
87942+
let sent = 0;
87943+
for (let endpoint of allowedEndpoints) {
87944+
endpoint = endpoint.trim();
87945+
if (endpoint.length > 0) {
8794287946
let encodedEndpoint = Buffer.from(endpoint).toString("base64");
8794387947
let endpointPolicyStr = `step_policy_endpoint_${encodedEndpoint}`;
8794487948
echo(endpointPolicyStr);
87949+
sent++;
8794587950
}
8794687951
}
87947-
if (allowedEndpoints.length > 0) {
87948-
applyPolicy(allowedEndpoints.length);
87952+
if (sent > 0) {
87953+
applyPolicy(sent);
8794987954
}
87955+
const duration = Date.now() - startTime;
87956+
console.log(`[harden-runner] sendAllowedEndpoints completed in ${duration}ms (sent ${sent} endpoints)`);
8795087957
}
8795187958
function applyPolicy(count) {
8795287959
let applyPolicyStr = `step_policy_apply_${count}`;
@@ -88242,7 +88249,7 @@ var setup_awaiter = (undefined && undefined.__awaiter) || function (thisArg, _ar
8824288249
if (!confg.disable_telemetry || confg.egress_policy === "audit") {
8824388250
printInfo(web_url);
8824488251
}
88245-
if (isArcRunner()) {
88252+
if (isARCRunner()) {
8824688253
console.log(`[!] ${ARC_RUNNER_MESSAGE}`);
8824788254
if (confg.egress_policy === "block") {
8824888255
sendAllowedEndpoints(confg.allowed_endpoints);
@@ -88256,22 +88263,10 @@ var setup_awaiter = (undefined && undefined.__awaiter) || function (thisArg, _ar
8825688263
external_fs_.appendFileSync(process.env.GITHUB_STATE, `selfHosted=true${external_os_.EOL}`, {
8825788264
encoding: "utf8",
8825888265
});
88259-
if (!external_fs_.existsSync("/home/agent/agent")) {
88260-
lib_core.info(SELF_HOSTED_NO_AGENT_MESSAGE);
88261-
return;
88262-
}
88266+
lib_core.info(SELF_HOSTED_RUNNER_MESSAGE);
8826388267
if (confg.egress_policy === "block") {
88264-
try {
88265-
if (process.env.USER) {
88266-
chownForFolder(process.env.USER, "/home/agent");
88267-
}
88268-
const confgStr = JSON.stringify(confg);
88269-
external_fs_.writeFileSync("/home/agent/block_event.json", confgStr);
88270-
yield setup_sleep(5000);
88271-
}
88272-
catch (error) {
88273-
lib_core.info(`[!] Unable to write block_event.json: ${error}`);
88274-
}
88268+
sendAllowedEndpoints(confg.allowed_endpoints);
88269+
yield setup_sleep(5000);
8827588270
}
8827688271
return;
8827788272
}

‎dist/pre/index.js.map

Lines changed: 1 addition & 1 deletion
Some generated files are not rendered by default. Learn more aboutcustomizing how changed files appear on GitHub.

‎src/arc-runner.test.ts

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,9 @@
1-
import{isArcRunner,sendAllowedEndpoints}from"./arc-runner";
1+
import{isARCRunner}from"./arc-runner";
22

33
it("should correctly recognize arc based runner",async()=>{
44
process.env["GITHUB_ACTIONS_RUNNER_EXTRA_USER_AGENT"]=
55
"actions-runner-controller/2.0.1";
66

7-
letisArc:boolean=awaitisArcRunner();
7+
letisArc:boolean=awaitisARCRunner();
88
expect(isArc).toBe(true);
99
});

‎src/arc-runner.ts

Lines changed: 16 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@ import * as cp from "child_process";
22
import*asfsfrom"fs";
33
importpathfrom"path";
44

5-
exportfunctionisArcRunner():boolean{
5+
exportfunctionisARCRunner():boolean{
66
construnnerUserAgent=process.env["GITHUB_ACTIONS_RUNNER_EXTRA_USER_AGENT"];
77

88
letisARC=false;
@@ -18,23 +18,33 @@ export function isArcRunner(): boolean {
1818

1919
functionisSecondaryPod():boolean{
2020
constworkDir="/__w";
21-
returnfs.existsSync(workDir);
21+
lethasKubeEnv=process.env["KUBERNETES_PORT"]!==undefined;
22+
returnfs.existsSync(workDir)&&hasKubeEnv;
2223
}
2324

2425
exportfunctionsendAllowedEndpoints(endpoints:string):void{
26+
conststartTime=Date.now();
2527
constallowedEndpoints=endpoints.split(" ");// endpoints are space separated
2628

27-
for(constendpointofallowedEndpoints){
28-
if(endpoint){
29+
letsent=0;
30+
for(letendpointofallowedEndpoints){
31+
endpoint=endpoint.trim();
32+
if(endpoint.length>0){
2933
letencodedEndpoint=Buffer.from(endpoint).toString("base64");
3034
letendpointPolicyStr=`step_policy_endpoint_${encodedEndpoint}`;
3135
echo(endpointPolicyStr);
36+
sent++;
3237
}
3338
}
3439

35-
if(allowedEndpoints.length>0){
36-
applyPolicy(allowedEndpoints.length);
40+
if(sent>0){
41+
applyPolicy(sent);
3742
}
43+
44+
constduration=Date.now()-startTime;
45+
console.log(
46+
`[harden-runner] sendAllowedEndpoints completed in${duration}ms (sent${sent} endpoints)`
47+
);
3848
}
3949

4050
functionapplyPolicy(count:number):void{

‎src/cleanup.ts

Lines changed: 10 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@ import * as fs from "fs";
22
import*ascpfrom"child_process";
33
import*ascommonfrom"./common";
44
importisDockerfrom"is-docker";
5-
import{isArcRunner}from"./arc-runner";
5+
import{isARCRunner}from"./arc-runner";
66
import{isGithubHosted}from"./tls-inspect";
77
(async()=>{
88
console.log("[harden-runner] post-step");
@@ -16,7 +16,7 @@ import { isGithubHosted } from "./tls-inspect";
1616
return;
1717
}
1818

19-
if(isArcRunner()){
19+
if(isARCRunner()){
2020
console.log(`[!]${common.ARC_RUNNER_MESSAGE}`);
2121
return;
2222
}
@@ -82,13 +82,16 @@ import { isGithubHosted } from "./tls-inspect";
8282

8383
vardisable_sudo=process.env.STATE_disableSudo;
8484
vardisable_sudo_and_containers=process.env.STATE_disableSudoAndContainers;
85-
85+
8686
if(disable_sudo!=="true"&&disable_sudo_and_containers!=="true"){
8787
try{
88-
varjournalLog=cp.execSync("sudo journalctl -u agent.service --lines=1000",{
89-
encoding:"utf8",
90-
maxBuffer:1024*1024*10// 10MB buffer
91-
});
88+
varjournalLog=cp.execSync(
89+
"sudo journalctl -u agent.service --lines=1000",
90+
{
91+
encoding:"utf8",
92+
maxBuffer:1024*1024*10,// 10MB buffer
93+
}
94+
);
9295
console.log("agent.service log:");
9396
console.log(journalLog);
9497
}catch(error){

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp