How to enable network and runtime monitoring (Harden-Runner) for runners

Adding Harden-Runner to GitHub-Hosted Runners

You can integrate Harden-Runner into your workflows in three ways:

1. Secure Workflow (Recommended for Specific Workflow Files)

Use Secure Workflow to quickly and securely add Harden-Runner to individual workflows via an interactive setup.

Follow the interactive demo for Secure Workflow:

2. Secure Repo (Recommended for Entire Repositories)

Apply Harden-Runner across all workflows in your repository with a single configuration using Secure Repo.

Follow the interactive demo for Secure Repo:

3. Policy Driven PRs (Recommended for Production)

Policy-driven automation lets StepSecurity automatically generate GitHub Issues or Pull Requests to enable runtime monitoring (Harden-Runner) across your organization.

Follow this interactive walkthrough to see how it works:

Adding Harden-Runner to Self-Hosted Runners

For self-hosted runners, you install the Harden-Runner agent on the runner itself. Once the agent is deployed, it monitors every job on that runner, so you do not need to add the Harden-Runner Action to your workflows for audit mode.

To get started:

1. In the StepSecurity app, go to Harden-Runner → Installation.
2. Select your runner environment, for example ARC (Actions Runner Controller) or Self-Hosted VM (virtual machine).
3. Follow the setup instructions shown for that environment.

To apply Policy Store policies on self-hosted runners, also configure the StepSecurity pre-job hook. See Runner Job Hooks.