Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How to harden GitHub Actions

wiz.io

Post reply on HN
Print view View original

61–70 of 74 posts

Re: How to harden GitHub Actions

#61

Post by woodruffw »

maenbalja wrote: post #53

Timely article... I recently learned about self-hosted runners and set one up on a Hetzner instance. Pretty smooth experience overall. If your action contains any SSH commands and you'd like to avoid setting up a firewall with 5000+ rules[0], I would recommend self-hosting a runner to help secure your target server's SSH port. [0] https://api.github.com/meta

FWIW: Self-hosted runners are non-trivial to secure[1]; the defaults GitHub gives you are not necessarily secure ones, particularly if your self-hosted runner executes workflows from public repositories.

(Self-hosted runners are great for many other reasons, not least of which is that they're a lot cheaper. But I've seen a lot of people confuse GitHub Actions' latent security issues with something that self-hosted runners can fix, which is not per se the case.)

[1]: https://docs.github.com/en/actions/security-for-github-actio...

Re: How to harden GitHub Actions

#63

Post by fallard »

mdaniel wrote: post #28
cedws wrote: post #11

Earlier quoted context omitted.

I came across this the other day but I couldn’t really grok how it works. Does it run at a higher privilege level than the workflow or the same? Can a sophisticated enough attack just bypass it?

I spent a few seconds clicking into it before the newfound 429 responses from GitHub caused me to lose interest I believe a sufficiently sophisticated attacker could unwind the netfilter and DNS change, but in my experience every action that you're taking during a blind attack is one more opportunity for things to go off the rails. The increased instructions (especially ones referencing netfilter and DNS changes) als…

Hey, I'm one of the co-author of Bullfrog. As you say, a sophisticated and targeted attack could indeed bypass our action. It's meant for blocking mostly opportunistic attacks.

I don't think any egress filtering could properly block everything, given actions will need to interact with Github APIs to function and it would always be possible to exfiltrate data in any private repo hosted on Github. While some solutions can access the outbound HTTP requests payload before it gets encrypted using eBPF, in order to detect egress to untrusted Github org/repos, this isn't a silver bullet either because this relies on targeting specific encryption binaries used by the software/OS. A sophisticated attack could always use a separate obscure or custom encryption binaries to evade detection by eBPF based tools.

So like you say, it's better than nothing, but it's not perfect and there are definitely developer experience tradeoff in using it.

PS: I'm no eBPF expert, so I'd be happy if someone can prove me wrong on my theory :)

Re: How to harden GitHub Actions

#64

Post by maenbalja »

woodruffw wrote: post #61
maenbalja wrote: post #53

Timely article... I recently learned about self-hosted runners and set one up on a Hetzner instance. Pretty smooth experience overall. If your action contains any SSH commands and you'd like to avoid setting up a firewall with 5000+ rules[0], I would recommend self-hosting a runner to help secure your target server's SSH port. [0] https://api.github.com/meta

FWIW: Self-hosted runners are non-trivial to secure[1]; the defaults GitHub gives you are not necessarily secure ones, particularly if your self-hosted runner executes workflows from public repositories. (Self-hosted runners are great for many other reasons, not least of which is that they're a lot cheaper. But I've seen a lot of people confuse GitHub Actions' latent security issues with something that self-hosted ru…

Hm that's good to know, thanks for the link. I'm just using the runner for private solo projects atm so I think my setup will do for now. But I definitely didn't consider the implications of using it on a private project with other contributors yikes.

Re: How to harden GitHub Actions

#65

Post by tuananh »

jquaint wrote: post #40
tuananh wrote: post #37

Earlier quoted context omitted.

renovate can be configured to do that too :)

Do you have an example config? Trying to get the same behavior with renovate :)

here's one that i use https://github.com/tuananh/hyper-mcp/blob/main/.github/renov...

Re: How to harden GitHub Actions

#66

Post by ebfe1 »

loginatnine wrote: post #45
ebfe1 wrote: post #30

After tj-actions hack, I put together a little tool to go through all of github actions in repository to replace them with commit hash of the version https://github.com/santrancisco/pmw It has a few "features" which allowed me to go through a repository quickly: - It prompts user and recommend the hash, it also provides user the url to the current tag/action to double check the hash value matches and review the code…

This is good, just bear in mind that if you put the hash of an external composite action and that action pulls on another one without a hash, you're still vulnerable on that transitive dependency.

oh damn - that is a great point! thanks matey!

Re: How to harden GitHub Actions

#67

Post by ebfe1 »

newman314 wrote: post #47
ebfe1 wrote: post #30

After tj-actions hack, I put together a little tool to go through all of github actions in repository to replace them with commit hash of the version https://github.com/santrancisco/pmw It has a few "features" which allowed me to go through a repository quickly: - It prompts user and recommend the hash, it also provides user the url to the current tag/action to double check the hash value matches and review the code…

I don't know if your tool already does this but it would be helpful if there is an option to output the version as a comment of the form action@commit # semantic version Makes it easy to quickly determine what version the hash corresponds to. Thanks.

Yeap - that is exactly what it does ;)

Example:

uses: ncipollo/release-action@440c8c1cb0ed28b9f43e4d1d670870f059653174 #v1.16.0

And for anything that previously had @master, it becomes the following with the hash on the day it was pinned with "master-{date}" as comment:

uses: ravsamhq/notify-slack-action@b69ef6dd56ba780991d8d48b61d94682c5b92d45 #master-2025-04-04

Re: How to harden GitHub Actions

#69

Post by pabs3 »

tomrod wrote: post #2

I support places that use GH Actions like its going out of style. This article is useful. I wonder how we get out of the morass of supply chain attacks, realistically.

Review every single line of source code before use, and bootstrap from source without any binaries.

https://github.com/crev-dev https://bootstrappable.org/ https://lwn.net/Articles/983340/

Re: How to harden GitHub Actions

#70

Post by guappa »

tomrod wrote: post #4
guappa wrote: post #3

Earlier quoted context omitted.

We use linux distributions.

How do apt, dnf, and apk prevent malicious software from getting into repositories?

You have a 2nd independent sets of eyes looking at software, rather than "absolutely nobody" like it is if you use npm and friends?
Post reply on HN