[pull] main from step-security:main - #57
Merged
Merged
Conversation
On AWS CodeBuild-hosted runners the Actions runner executes as root and the USER environment variable is not set, so the self-hosted install path ran 'sudo chown -R undefined /home/agent' and agent installation failed silently. Resolve the user via os.userInfo() when USER is unset, and skip the chown instead of failing when no user can be determined.
…vider CodeBuild-hosted runner VMs are ephemeral, so the persistent self-hosted agent mode does not fit: its machine-scoped config carries no run_id or one_time_key (process and file events are not attributed to the run) and the post step exits without flushing events before the VM is destroyed. Detect CODEBUILD_RUNNER_TYPE=GITHUB and route to the per-run bravo agent, which reports run-scoped insights and flushes on job end.
…arty provider" This reverts commit bf94c00.
…osted-vm is used The post step exited early for all self-hosted runners, so an agent deployed by the pre-step via deploy-on-self-hosted-vm never received the job-end signal (post_event.json) and never flushed process and file events. On ephemeral VMs such as AWS CodeBuild-hosted runners the VM is destroyed right after the job, losing those events. Record in GITHUB_STATE when the pre-step installs the agent on the VM and run the same Linux cleanup as GitHub-hosted in that case. Persistent self-hosted runners with a pre-installed agent keep the early exit.
…n-self-hosted-vm is used" This reverts commit 0ff0941.
…party provider" This reverts commit a3c333d.
Bump the TLS and bravo agent downloads to agent-ebpf v1.8.14 and update the corresponding SHA256 checksums. Non-TLS, macOS, and Windows agents are unchanged.
The bundle was previously built against a stale node_modules (@actions/cache 4.0.3) instead of the lockfile version (4.1.0), so the committed dist did not match a clean-install build and build-check failed.
The Global Block List shipped earlier but was never added to the README. It applies to both the Community and Enterprise tiers, so it is listed under Community (Free), which the Enterprise list already inherits.
feat: AWS CodeBuild-hosted runner support, eBPF agent v1.8.14, Global Block List docs
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
See Commits and Changes for more details.
Created by
pull[bot] (v2.0.0-alpha.4)
Can you help keep this open source service alive? 💖 Please sponsor : )