Harden-Runner

Visit Website

Introduction

CI/CD runners handle secrets and build production artifacts, yet often lack the security monitoring that laptops and servers have, a gap exploited in breaches such as SolarWinds and Codecov. Traditional EDR tools struggle with ephemeral runners and cannot correlate events with workflow runs.

Harden-Runner provides security monitoring tailored to CI/CD runners on Linux, Windows and macOS. You add it as the first step of a job, starting in egress-policy: audit mode to see network calls and then moving to a block policy with allowed endpoints.

The README lists real detections: the compromised axios npm package dropping a remote access trojan, the Trivy compromise with a malicious v0.69.4 release and the tj-actions/changed-files compromise (CVE-2025-30066). StepSecurity’s wider platform covers developer machines, registries and repositories too.

The source code is at step-security/harden-runner on GitHub under the Apache-2.0 licence, with about 1,300 stars; the most recent commit was on 6 November 2026.

Features

1. Egress monitoring: See every network call.
2. Egress blocking: Allow-list endpoints.
3. Cross-platform runners: Linux, Windows and macOS.
4. Workflow correlation: Events tied to runs.
5. Real-world detections: Documented supply chain catches.

Pros

1. Easy adoption: One workflow step.
2. Free to use: Open source under the Apache-2.0 licence, so the core tool costs nothing to use.
3. Actively maintained: The repository had commits as recent as 6 November 2026.

Cons

1. Advanced features are paid: Some capabilities need StepSecurity plans.
2. GitHub Actions focus: Other CI systems not covered.

Usage and Links (Example)

steps:
  - uses: step-security/harden-runner@v2   # pin to a commit SHA in production
    with:
      egress-policy: audit
  - uses: actions/checkout@v4

Resources:

• Harden-Runner website
• GitHub repository

Pricing

Harden-Runner is free and open source under the Apache-2.0 licence.

Recommended for?

1. Any team running GitHub Actions with secrets.

Conclusion

Harden-Runner is one of the simplest high-value CI security controls.

Start in audit mode, then block.

On CheckOps, Harden-Runner is filed under the Release & CI gates and Security testing stages. Related tools listed here include zizmor, Socket, actionlint, Snyk, Semgrep and OSV-Scanner. A short trial on a real project, with your own code, data and pipeline, is usually the fastest way to choose between them, because fit matters more than feature lists. Facts here come from the official site, documentation and repository, checked on 11 November 2026.