You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
@@ -63,6 +64,9 @@ Learn how Harden-Runner works through the video below, which shows how it detect
63
64
64
65
This guide walks you through the steps to set up and use Harden-Runner in your CI/CD workflows. For more details, refer to the [official documentation](https://docs.stepsecurity.io/harden-runner).
65
66
67
+
> [!NOTE]
68
+
> The Community tier is free for **public repositories on GitHub-hosted runners** and includes the core feature set. Advanced features, private repositories, and self-hosted runners (including ARC) require the Enterprise tier. See [Features and Pricing Tiers](#features-and-pricing-tiers) for what is in each tier.
69
+
66
70
### **Step 1: Add Harden-Runner to Your Workflow**
67
71
68
72
To integrate Harden-Runner, follow these steps:
@@ -72,7 +76,7 @@ To integrate Harden-Runner, follow these steps:
@@ -108,12 +112,23 @@ Run your workflow. Once completed:
108
112
109
113
---
110
114
111
-
## Features
115
+
## Features and Pricing Tiers
116
+
117
+
Harden-Runner offers a comprehensive suite of features to enhance the security of your CI/CD workflows, available in two tiers: **Community** (free) and **Enterprise** (paid). Two things determine what you get: **where your workflows run** decides whether the free tier is available at all, and **your tier** decides which features you get. The feature lists below show what is in each tier.
118
+
119
+
| Where your workflows run | What's available |
120
+
|--------------------------|------------------|
121
+
| Public repositories on GitHub-hosted runners | **Community** features free; **Enterprise** features require a paid plan |
| Self-hosted runners, including ARC and bare metal (public or private repositories) | **Enterprise** (paid) only |
112
124
113
-
Harden-Runner offers a comprehensive suite of features to enhance the security of your CI/CD workflows, available in two tiers: **Community** (Free) and **Enterprise** (Paid).
125
+
> [!IMPORTANT]
126
+
> **Self-hosted runners require an Enterprise subscription, even for public repositories.** Without a subscription, the Harden-Runner action is a no-op on self-hosted runners: the step succeeds and your workflow passes, but nothing is monitored and no insights are generated. To enable Harden-Runner on your self-hosted runners, [start a free trial](https://www.stepsecurity.io/start-free).
114
127
115
128
### Community (Free)
116
129
130
+
Available for public repositories running on GitHub-hosted runners:
131
+
117
132
- **CI/CD-Aware Event Correlation:** Each outbound network connection, file operation, and process execution is mapped to the exact step, job, and workflow where it occurs.
118
133
- **Automated Baseline Creation:** Harden-Runner builds a baseline for each job based on past outbound network connections.
119
134
- **Anomaly Detection:** Once the baseline is created, any future outbound calls not in the baseline trigger a detection.
@@ -126,19 +141,34 @@ Harden-Runner offers a comprehensive suite of features to enhance the security o
126
141
Includes all features in the **Community** tier, plus:
127
142
128
143
- **Support for Private Repositories:** Extend Harden-Runner's security capabilities to your private GitHub repositories.
129
-
- **Support for Self-Hosted Runners:** Apply security controls and monitoring to self-hosted GitHub Actions runners.
130
-
- **GitHub Checks Integration:** Enable GitHub Checks for Harden-Runner—if the baseline remains unchanged, the check passes; if it changes, the check fails, showing new outbound connections.
144
+
- **Support for Self-Hosted Runners:** Apply security controls and monitoring to self-hosted GitHub Actions runners (VM, bare metal, and ARC), for both public and private repositories.
145
+
- **GitHub Checks Integration:** Enable GitHub Checks for Harden-Runner. If the baseline remains unchanged, the check passes; if it changes, the check fails, showing new outbound connections.
131
146
- **View Outbound GitHub API calls at the Job Level:** Monitor HTTPS requests to GitHub APIs
132
147
- **Determine Minimum GITHUB_TOKEN Permissions:** Monitor outbound HTTPS requests to GitHub APIs to recommend the least-privilege permissions needed for your workflows, enhancing security by reducing unnecessary access.
133
148
- **View the Name and Path of Every File Written During the Build Process:** Gain visibility into every file written to the build environment, including the ability to correlate file writes with processes, ensuring complete transparency.
134
149
- **View Process Names and Arguments:** Monitor every process executed during the build process, along with its arguments, and navigate the process tree to detect suspicious activities.
150
+
- **Centralized Policy Store:** Manage egress policies centrally from the StepSecurity dashboard instead of editing each workflow file. Learn more in the [Policy Store documentation](https://docs.stepsecurity.io/github-actions/harden-runner/policy-store).
151
+
- **Baselines at Repository, Organization, and Cluster Level:** Create and manage baselines beyond the per-job level. Learn more in the [Baseline documentation](https://docs.stepsecurity.io/github-actions/harden-runner/baseline).
152
+
- **Suppression Rules:** Suppress expected detections to reduce alert noise. Learn more in the [Suppression Rules documentation](https://docs.stepsecurity.io/github-actions/harden-runner/suppression-rules).
153
+
- **Alert Notifications and SIEM Integration:** Receive alerts via email, Slack, and Microsoft Teams, and integrate detections with your SIEM solution.
135
154
136
155
For a detailed comparison and more information, please visit our [Pricing Page](https://www.stepsecurity.io/pricing).
137
156
138
157
Explore the full feature set in the [Features Documentation](https://docs.stepsecurity.io/harden-runner).
139
158
140
159
---
141
160
161
+
## StepSecurity Maintained Actions
162
+
163
+
Many popular third-party GitHub Actions are abandoned or stuck on outdated runtimes. StepSecurity publishes [Maintained Actions](https://docs.stepsecurity.io/github-actions/actions/stepsecurity-maintained-actions): drop-in replacements that are actively maintained, security-reviewed, and kept current, including updates to the Node 24 runtime.
164
+
165
+
- **Free for public repositories**, no subscription required. Read the [announcement](https://www.stepsecurity.io/blog/stepsecurity-maintained-actions-are-now-free-for-public-repos).
166
+
- **~500 actions and growing.** [Browse the full catalog](https://app.stepsecurity.io/action-advisor?tab=maintained).
167
+
- **Actively maintained:** dependency updates, runtime upgrades (such as Node 24), and defined SLAs for patching vulnerabilities.
168
+
- **Hardened release process:** manual secure code review before onboarding, signed commits, mandatory peer review, and tag protection.
169
+
170
+
---
171
+
142
172
## Trusted By and Case Studies
143
173
144
174
Harden-Runner is trusted by over 11,000 leading open-source projects and enterprises, including Microsoft, Google, Kubernetes, and more.
@@ -164,14 +194,14 @@ Harden-Runner is trusted by over 11,000 leading open-source projects and enterpr
164
194
165
195
Harden-Runner is designed to work seamlessly across a variety of runner environments, providing consistent security insights and protections regardless of where your workflows execute. For self-hosted runners, audit mode is deployed directly to the runner infrastructure without requiring any changes to your existing workflows. For more details, refer to the [official documentation](https://docs.stepsecurity.io/harden-runner).
166
196
167
-
| Environment Type | Compatibility | Audit Mode Deployment | Workflow Changes for Audit/Block Mode |
Copy file name to clipboardExpand all lines: docs/limitations.md
+2-1Lines changed: 2 additions & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,7 +1,8 @@
1
1
## Limitations
2
2
3
3
### GitHub-Hosted Runners
4
-
* Harden-Runner is not supported when [job is run in a container](https://docs.github.com/en/actions/using-jobs/running-jobs-in-a-container) with built-in labels such as `ubuntu-latest`, as it needs sudo access on the Ubuntu VM to run. The limitation is if the entire job is run in a container. However, such jobs can be monitored when using custom VM images with GitHub-hosted runners. This is also not a limitation for Self-Hosted runners.
4
+
* Harden-Runner is not supported when [job is run in a container](https://docs.github.com/en/actions/using-jobs/running-jobs-in-a-container) with built-in labels such as `ubuntu-latest`, as it needs sudo access on the Ubuntu VM to run. The limitation is if the entire job is run in a container. However, such jobs can be monitored when using [custom VM images with GitHub-hosted runners](https://docs.stepsecurity.io/github-actions/harden-runner#github-hosted-custom-vm), which requires the Enterprise tier. This is also not a limitation for Self-Hosted runners.
5
+
* Harden-Runner is not supported on `ubuntu-slim` runners. The agent relies on kernel-level features that require elevated capabilities, which are not available on `ubuntu-slim`. The action detects `ubuntu-slim` and exits cleanly with an informational log message, without monitoring the job. See [issue #627](https://github.com/step-security/harden-runner/issues/627) for details.
0 commit comments