Getting Started

Get runtime visibility into your GitHub Actions workflows in under 5 minutes

Step 1: Add Harden-Runner to Your Workflow

Open your GitHub Actions workflow file (e.g., .github/workflows/<workflow-name>.yml) and add the following as the first step in each job:

steps:
  - uses: step-security/harden-runner@v2
    with:
      egress-policy: audit

Step 2: View Your First Security Insights

Run your workflow. Once it completes, review the workflow logs and the job markdown summary. Look for a link to security insights and recommendations.

Github Actions build log

Click the link to open the Insights page, where you'll see:

Network events: Outbound network calls correlated with each step.

File events: File writes tracked during the job.

StepSecurity Insights Network Events page

What's Next?

You now have audit-mode visibility into your CI/CD pipeline. From here you can:

• Set up network blocking to restrict outbound traffic to allowed endpoints
• Use Secure Repo to add Harden-Runner across all your repositories at once
• Use OSS Package Search to catch compromised packages in PRs

Tip: You can skip manual YAML editing. Use Secure Workflow to add Harden-Runner to a single workflow automatically, or Secure Repo to secure all workflow files in a repository at once.