How to access Harden-Runner security insights
Last updated
Last updated
For each GitHub Actions workflow run, Harden-Runner monitors the run-time network, file, and process events and makes runtime insights available via the StepSecurity Web App.
There are four ways to find the insights link:
Step 1: Navigate to build log of your workflow file in Github Actions.
Step 2: Look for the Harden-Runner step in the log and click on the Insights link which appears in the logs as View security insights and recommended policy at: followed by a clickable URL (this is an example link).
Step 3: Once you click on the Insights link, you will be redirected to the Summary tab in the StepSecurity Web App. The Summary Page provides an overview of:
Outbound destinations contacted during the job execution.
HTTPS requests and the number of actions taken.
Detections (if any security risks were found).
StepSecurity provides a dashboard where you can view the latest GitHub Actions workflow runs monitored by Harden-Runner. This guide will help you navigate the dashboard and access insights for specific workflow runs.
Step 1: Navigate to https://app.stepsecurity.io/github/<GITHUB_ORG_NAME>/actions/dashboard
Step 2: In the left-hand menu, under Harden-Runner, click Latest Workflow Runs
Step 3: After opening the Latest Workflow Runs page, locate the workflow you want to inspect and click on it.
Step 4: . Once inside the workflow details page, navigate to the Summary tab.
Here, you can review:
Outbound destinations contacted during the workflow.
Security detections (if any were found).
Actions performed by the workflow.
Step 1: Navigate to the workflow run page
Step 2: Click "📄 View Full Report"
Step 3: Review the outbound connections allowed during the workflow execution.
To enable GitHub Checks, check out this guide.
Step 1: Navigate to the Pull Request
Step 2: View Check Details
Look at the checks summary under your pull request.
Identify any failed or successful checks.
Click on the “Details” link next to the StepSecurity Harden-Runner check.
Step 3: Access Insights URL
On the new page, select StepSecurity Harden-Runner from the list of workflow checks.
Find the Insights URL under the Workflow Run Insights section.
Click the Insights URL to proceed.
Step 4: Review Security Insights
The Insights page will display outbound traffic details, network events, and security findings.
Verify if any unauthorized outbound connections were detected.
Review the All Outbound Destinations and All Detections sections for further analysis.
