feat(security-scan): add optional runner input for self-hosted runners - #39
Conversation
Mirrors node-ci.yml's `runner` input (#38). All 9 scan jobs (vet, codeql, gitleaks, osv, dependency-review, snyk, semgrep, zizmor, actionlint) were hardcoded to `ubuntu-latest`; when GitHub-hosted runners are unavailable (exhausted minutes) every scan fails with no runner assigned. Adds a `runner` string input (default `ubuntu-latest`, fully backward compatible — existing callers are unchanged) and switches every job to `runs-on: ${{ inputs.runner }}`. Callers on self-hosted infra pass `runner: self-hosted`. harden-runner stays in `egress-policy: audit` on every job, which is self-hosted-safe (monitors rather than blocks).
|
Caution The consumer version of Gemini Code Assist on GitHub has been sunset. All code review activity has officially ceased. |
📝 WalkthroughWalkthroughThe reusable security scan workflow adds an optional ChangesSecurity scan runner configuration
Estimated code review effort: 2 (Simple) | ~5 minutes Possibly related PRs
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/security-scan.yml:
- Around line 82-93: Update the runner input contract and its description in the
workflow’s runner configuration to require Linux/Docker-capable labels, or
explicitly support multiple labels/groups so scheduling targets compatible
self-hosted runners. Preserve the ubuntu-latest default while removing the
unsafe implication that a generic single self-hosted label is sufficient.
- Around line 82-93: Update the reusable workflow’s runner selection around the
runner input to prevent pull_request and fork scans from using arbitrary
self-hosted labels. Allow self-hosted runners only for trusted/private PR
contexts or explicitly protected runner groups, while retaining ubuntu-latest as
the default. Review callers using secrets: inherit and avoid passing secrets
when execution targets a non-ephemeral runner unless the repository and PR
context are trusted.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: da641d08-7e57-4395-b03f-6ce183546d41
📒 Files selected for processing (1)
.github/workflows/security-scan.yml
| runner: | ||
| description: >- | ||
| Label(s) the scan jobs run on. Defaults to GitHub-hosted | ||
| `ubuntu-latest`; set to a self-hosted label (e.g. `self-hosted`) | ||
| to run on an org/repo self-hosted runner instead — useful when | ||
| GitHub-hosted minutes are exhausted. A single label string; | ||
| callers typically wire this to a repo variable so it can be | ||
| toggled without editing the workflow. Mirrors node-ci.yml's | ||
| `runner` input. | ||
| type: string | ||
| required: false | ||
| default: "ubuntu-latest" |
There was a problem hiding this comment.
🩺 Stability & Availability | 🟠 Major | 🏗️ Heavy lift
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== file exists and relevant lines =="
cat -n .github/workflows/security-scan.yml | sed -n '1,140p'
echo
echo "== runner input occurrences =="
rg -n "inputs\.runner|runner:|container:" .github/workflows/security-scan.yml
echo
echo "== workflow files with self-hosted runner examples in workflows =="
rg -n "self-hosted|runner:|container:" .github/workflows -g '*.yml' -g '*.yaml' || trueRepository: resq-software/.github
Length of output: 7807
🌐 Web query:
GitHub Actions job container self-hosted runner Docker Linux runtime requirements
💡 Result:
To use job containers or service containers with a self-hosted GitHub Actions runner, your infrastructure must meet specific requirements primarily focused on Linux and Docker support [1][2]. Requirements: - Operating System: You must use a Linux machine [1][2]. Job containers and service containers are not supported on self-hosted runners running Windows or macOS [3]. - Docker Engine: Docker must be installed and the Docker daemon must be running [1][2]. - Docker Access: The runner user must have permission to access the Docker daemon, typically by being a member of the docker group, or by ensuring the Docker socket (e.g., /var/run/docker.sock) is accessible [3]. - Connectivity: The host machine must be able to communicate with GitHub Actions over HTTPS (typically via port 443) [1]. Additional Context: - Limitations: Docker Hub rate limits apply to self-hosted runners, unlike GitHub-hosted runners which have an agreement with Docker to avoid these limits [4]. - Customization: On Linux, GitHub Actions allows for advanced customization of container creation (e.g., using Podman or Kubernetes) via a customization script triggered by environment variables on the runner [5]. - Workflow Configuration: When using a container for a job, you define the image in your workflow file under the jobs.<job_id>.container key [4][6]. If this is not set, steps run directly on the host machine unless they specifically call an action configured to run in a container [4]. If you are using Actions Runner Controller (ARC) on Kubernetes, "Docker-in-Docker" (DinD) mode is typically required, where the runner container shares the Docker socket with a sidecar [3].
Citations:
- 1: https://docs.github.com/en/actions/reference/runners/self-hosted-runners
- 2: https://docs.github.com/en/enterprise-cloud@latest/actions/tutorials/use-containerized-services/use-docker-service-containers
- 3: https://github.github.com/gh-aw/reference/self-hosted-runners/
- 4: https://docs.github.com/en/actions/how-tos/write-workflows/choose-where-workflows-run/run-jobs-in-a-container
- 5: https://github.com/github/docs/blob/main/content/actions/how-tos/manage-runners/self-hosted-runners/customize-containers.md
- 6: https://github.github.io/actions-cheat-sheet/actions-cheat-sheet.html
Constrain runner to Linux/Docker-capable labels.
The documented single-label self-hosted value does not guarantee a Linux Docker runtime, but semgrep runs with a job-level container. This can fail to schedule or be intentionally unsafe if routed to Windows/macOS/Linux without Docker; use Linux/Docker-specific labels or allow multiple labels/groups in the input contract.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/security-scan.yml around lines 82 - 93, Update the runner
input contract and its description in the workflow’s runner configuration to
require Linux/Docker-capable labels, or explicitly support multiple
labels/groups so scheduling targets compatible self-hosted runners. Preserve the
ubuntu-latest default while removing the unsafe implication that a generic
single self-hosted label is sufficient.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== workflow files =="
git ls-files .github/workflows || true
echo "== security-scan workflow excerpt =="
if [ -f .github/workflows/security-scan.yml ]; then
nl -ba .github/workflows/security-scan.yml | sed -n '1,140p'
fi
echo "== workflow calls/inputs references =="
rg -n "uses:.*/security-scan|security-scan|self-hosted|runner:|secrets: inherit|pull_request|security-scan.yml|node-ci" .github/workflows -S || true
echo "== git diff stat/name =="
git diff --stat HEAD~1..HEAD 2>/dev/null || git diff --stat 2>/dev/null || trueRepository: resq-software/.github
Length of output: 656
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== all workflow files =="
git ls-files .github/workflows || true
echo "== security-scan workflow excerpt =="
if [ -f .github/workflows/security-scan.yml ]; then
awk '{printf "%6d %s\n", NR, $0}' .github/workflows/security-scan.yml | sed -n '1,180p'
fi
echo "== runner/secrets/pull_request references =="
rg -n "uses:.*/security-scan|security-scan|self-hosted|runner:|secrets: inherit|pull_request|security-scan.yml|node-ci|pull_request|pull_request_target|trusted" .github/workflows -S || true
echo "== git diff stat/name =="
if git rev-parse HEAD~1 >/dev/null 2>&1; then
git diff --stat HEAD~1..HEAD
else
git diff --stat 2>/dev/null || true
fiRepository: resq-software/.github
Length of output: 13529
Gate self-hosted runners for PR-based security scans.
The reusable runner input defaults to GitHub-hosted but allows self-hosted labels in callers; one documented caller forwards all secrets with secrets: inherit, and other callers use secrets: inherit for their required checks. Restrict self-hosted usage for pull_request/fork scenarios to trusted/private PR sources or protected runner groups, and avoid inheriting secrets on non-ephemeral runners unless the repository and PR context are trusted. Audit-only runner hardening does not contain a compromised runner.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/security-scan.yml around lines 82 - 93, Update the
reusable workflow’s runner selection around the runner input to prevent
pull_request and fork scans from using arbitrary self-hosted labels. Allow
self-hosted runners only for trusted/private PR contexts or explicitly protected
runner groups, while retaining ubuntu-latest as the default. Review callers
using secrets: inherit and avoid passing secrets when execution targets a
non-ephemeral runner unless the repository and PR context are trusted.
1 participant
Mirrors node-ci.yml's
runnerinput (#38). All 9 scan jobs were hardcoded toubuntu-latest; when GitHub-hosted minutes are exhausted they fail with no runner assigned. Adds an optionalrunnerstring input (defaultubuntu-latest, backward compatible) and switches every job toruns-on: ${{ inputs.runner }}. harden-runner stays in audit mode (self-hosted-safe).Summary by CodeRabbit