step-security/harden-runner
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

fix: ignore denied-endpoints on non-enterprise tier

Browse Source 
The deny list is an enterprise (TLS) tier feature. The non-TLS agent
does not understand denied_endpoints, so a config with only
denied-endpoints set was treated as block with an empty allow list,
blocking all egress for the job. Gate deny-list mode on the TLS check
and ignore denied-endpoints with an info message when the org is not
on the enterprise tier.
This commit is contained in:
Varun Sharma
2026-08-14 18:31:27 -07:00
parent 93b58ee491
commit 0f37afa338
3 changed files with 22 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
dist/pre/index.js
Vendored
+9 -1
View File
@@ -86126,10 +86126,18 @@ function resolveCacheHost() {
}
// Mirrors the agent's isDenyList() decision: the deny list is enforced
// only when there are no allowed endpoints. Allowed endpoints always win.
const isDenyListMode = confg.denied_endpoints !== "" && confg.allowed_endpoints === "";
let isDenyListMode = confg.denied_endpoints !== "" && confg.allowed_endpoints === "";
if (confg.denied_endpoints !== "" && confg.allowed_endpoints !== "") {
lib_core.info("Both allowed-endpoints and denied-endpoints are set. Only one of them should be set at a time. allowed-endpoints will be honored and denied-endpoints will be ignored.");
}
// The deny list is an enterprise (TLS) tier feature. The non-TLS agent
// does not understand denied_endpoints and would treat this config as
// block with an empty allow list, blocking all egress.
if (isDenyListMode && !(yield isTLSEnabled(github.context.repo.owner))) {
lib_core.info("denied-endpoints is supported on the enterprise tier only. Ignoring denied-endpoints for this run.");
confg.denied_endpoints = "";
isDenyListMode = false;
}
if (confg.egress_policy === "block" &&
confg.allowed_endpoints === "" &&
!isDenyListMode) {
dist/pre/index.js.map
Vendored
+1 -1
View File
File diff suppressed because one or more lines are too long
src/setup.ts
+12 -1
View File
@@ -275,7 +275,7 @@ async function resolveCacheHost(): Promise<string | undefined> {
// Mirrors the agent's isDenyList() decision: the deny list is enforced
// only when there are no allowed endpoints. Allowed endpoints always win.
const isDenyListMode =
let isDenyListMode =
confg.denied_endpoints !== "" && confg.allowed_endpoints === "";
if (confg.denied_endpoints !== "" && confg.allowed_endpoints !== "") {
@@ -284,6 +284,17 @@ async function resolveCacheHost(): Promise<string | undefined> {
);
}
// The deny list is an enterprise (TLS) tier feature. The non-TLS agent
// does not understand denied_endpoints and would treat this config as
// block with an empty allow list, blocking all egress.
if (isDenyListMode && !(await isTLSEnabled(context.repo.owner))) {
core.info(
"denied-endpoints is supported on the enterprise tier only. Ignoring denied-endpoints for this run."
);
confg.denied_endpoints = "";
isDenyListMode = false;
}
if (
confg.egress_policy === "block" &&
confg.allowed_endpoints === "" &&