step-security/harden-runner

Health v2 · maintenance only

Adoption not part of the score

1258 stars · 111 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

Harden-Runner is a CI/CD security agent that acts like an EDR for GitHub Actions runners, monitoring network egress, file integrity, and process activity in real time. It detects compromised dependencies and malicious workflow behavior, and has caught several real-world supply chain attacks such as the tj-actions/changed-files and axios npm compromises.

Use cases

• detect compromised npm packages in CI builds
• monitor network egress from GitHub Actions runners
• prevent secrets exfiltration during CI/CD pipelines
• harden GitHub Actions workflows against supply chain attacks
• get alerts when a build step downloads from unexpected domains
• audit file and process activity on CI runners
• comply with software supply chain security requirements

When to choose

• you run builds on GitHub Actions and want runtime security monitoring
• you need to detect malicious dependencies or exfiltration attempts in CI
• you want an EDR-like agent tailored to ephemeral CI/CD runners
• you need egress filtering and file integrity monitoring for build pipelines

When to avoid

• you need security monitoring for developer laptops or production servers rather than CI runners
• you use CI systems other than GitHub Actions without the enterprise plan
• you only need static dependency scanning rather than runtime detection

Facets

service · maturity active

security monitoring ci-cd alerting tracing security developer-tools windows cloud self-hosted github-actions supply-chain-security edr egress-filtering ebpf runtime-security ci-cd-security hardening devops automation linux macos docker

Member repositories

For agents

markdown · JSON · MCP: product_card(name="step-security/harden-runner")