What's Changed

• Fixed security rules not initializing on GHES self-hosted runners
• Fixed GHES connectivity in block mode by implicitly allowing the GHES hostname

Full Changelog: v2.22.0...v2.22.1

What's Changed

• Linux ARM64 support for community tier
• GHES support for self-hosted VMs (enterprise tier)
• MacOS and Windows runner deny list support for block policy (enterprise tier).

Full Changelog: v2.21.1...v2.22.0

What's Changed

• Improved performance of the disable-sudo feature.
• Fixed an issue in the Community tier where new endpoints required by the GitHub Actions runner were not being implicitly allowed in block mode.
• Fixed the Harden-Runner post step failing on Linux distributions that do not have a merged /usr filesystem layout (for example Debian 11), where /usr/bin/echo does not exist. This mainly affected self-hosted runners.
• Documentation updates: clarified which features are in the Community (free) vs Enterprise tier.

Full Changelog: v2.21.0...v2.21.1

What's Changed

• Support for denied endpoints in block mode. This is included in the enterprise tier. Customers can deny outbound calls, for example, to public package registries.
• Improved Support for AWS CodeBuild GitHub Actions Runners.
• Bug fixes.

Full Changelog: v2.20.1...v2.21.0

What's Changed

• AWS CodeBuild-hosted runner support
• Implicitly allow single-labeled (internal) domains in block-mode

Full Changelog: v2.20.0...v2.20.1

What's Changed

• Support for block policy for MacOS and Windows GitHub-hosted runners
• Support for Bitrise MacOS GitHub Actions runners
• HTTPS monitoring support for Bun for Linux runners (enterprise tier)

Full Changelog: v2.19.4...v2.20.0

What's Changed

• Improvements for HTTPS Monitoring for the Enterprise tier of Harden Runner

Full Changelog: v2.19.3...v2.19.4

What's Changed

• Default to audit mode when api-key missing with use-policy-store by @varunsh-coder in #665

Full Changelog: v2.19.2...v2.19.3

What's Changed

• Update the Harden Runner agent for enterprise tier to use go 1.26 and fix minor bugs.

Full Changelog: v2.19.1...v2.19.2

What's Changed

• fix: detect ubuntu-slim runners early and bail out by @devantler in #657

What the fix changes

• Harden-Runner will detect ubuntu-slim runners and exit cleanly with an informational log message, instead of post harden runner step failing on chown: invalid user: 'undefined'.

What the fix does not do

• Jobs running on ubuntu-slim will not be monitored by Harden-Runner. The agent relies on kernel-level features (that require elevated capabilities).
• Per GitHub's docs on single-CPU runners: "The container for ubuntu-slim runners runs in unprivileged mode. This means that some operations requiring elevated privileges such as mounting file systems, using Docker-in-Docker, or accessing low-level kernel features are not supported." Those low-level kernel features are what the agent needs, so monitoring inside the unprivileged container is not feasible today.

For StepSecurity enterprise customers
If your security posture requires that workflows are always monitored, you can block the use of ubuntu-slim via workflow run policies see the Runner Label Policy docs. This lets you enforce that jobs only run on monitored runner types.

New Contributors

• @devantler made their first contribution in #657

Full Changelog: v2.19.0...v2.19.1