Skip to content

feat: Update inputs for egress policy and additional checkout options #64

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
rbarker-dev merged 2 commits into from
May 19, 2026
Merged

feat: Update inputs for egress policy and additional checkout options #64

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
099b5d6
feat: Update inputs for egress policy and additional checkout options
rbarker-dev May 19, 2026
5b8edc9
chore: Update checkout output
rbarker-dev May 19, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
23 changes: 23 additions & 0 deletions .github/workflows/test.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -36,10 +36,13 @@ jobs:
uses: ./
id: test-all
with:
egress-policy: audit
checkout: true
checkout-fetch-depth: 0
checkout-ref: main
checkout-token: ${{ secrets.GITHUB_TOKEN }}
checkout-path: '.'
checkout-persist: true
checkout-submodules: false
setup-java: true
java-distribution: 'temurin'
Expand Down Expand Up @@ -83,6 +86,7 @@ jobs:
echo "::group::Verify Node.js Outputs"
echo "Node.js Version: ${{ steps.test-all.outputs.node-version }}"
echo "Node.js Cache Hit: ${{ steps.test-all.outputs.node-cache-hit }}"
echo "Node.js Registry URL: ${{ steps.test-all.outputs.node-registry-url }}"
node -v
npm -v
echo "::endgroup::"
Expand Down Expand Up @@ -114,6 +118,25 @@ jobs:
gomplate --version
echo "::endgroup::"

test-egress-policy:
name: Test Egress Policy Input
runs-on: ubuntu-latest
steps:
- name: Harden Runner
id: harden-runner
uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
with:
egress-policy: audit

- name: Checkout Repository
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

- name: Run Action with Explicit Egress Policy
uses: ./
id: test-egress-policy
with:
egress-policy: audit

Comment thread
rbarker-dev marked this conversation as resolved.
test-checkout:
name: Test Checkout Action
runs-on: ubuntu-latest
Expand Down
55 changes: 39 additions & 16 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@ Common steps for initializing a job for GitHub actions. This composite action co

## Features

- Security hardening with Step Security's Harden Runner
- Security hardening with Step Security's Harden Runner (configurable egress policy)
- Repository checkout with configurable options
- Multi-language support (Node.js, Java, Python, Go, Rust, Swift)
- Build tool setup (Gradle, Task, gomplate)
Expand All @@ -25,15 +25,23 @@ Common steps for initializing a job for GitHub actions. This composite action co

### Inputs

**Harden Runner**

| Input | Description | Required | Default | Options |
|---------------|----------------------------------------------|----------|---------|-------------------|
| egress-policy | Egress policy to apply to the runner | No | audit | `audit`/`block` |

**Repository Checkout**

| Input | Description | Required | Default | Options |
|----------------------|----------------------------------------------------------|----------|---------|----------------------------|
| checkout | Whether to checkout the repository | No | - | `true`/`false` |
| checkout-ref | The branch, tag or SHA to checkout | No | - | any `branch`/`tag`/`SHA` |
| checkout-token | Personal access token (PAT) used to fetch the repository | No | - | `Token` used for checkout |
| checkout-fetch-depth | Depth of commit history to fetch | No | 1 | `0` (full)/`1`/`2`/... |
| checkout-submodules | Whether to fetch submodules | No | false | `true`/`false`/`recursive` |
| Input | Description | Required | Default | Options |
|----------------------|------------------------------------------------------------------------------|----------|---------|----------------------------|
| checkout | Whether to checkout the repository | No | - | `true`/`false` |
| checkout-ref | The branch, tag or SHA to checkout | No | - | any `branch`/`tag`/`SHA` |
| checkout-token | Personal access token (PAT) used to fetch the repository | No | - | `Token` used for checkout |
| checkout-path | Path to checkout the repository into (relative to `${GITHUB_WORKSPACE}`) | No | `.` | any relative path |
| checkout-fetch-depth | Depth of commit history to fetch | No | 1 | `0` (full)/`1`/`2`/... |
| checkout-persist | Whether to configure the token with the local git config | No | true | `true`/`false` |
| checkout-submodules | Whether to fetch submodules | No | false | `true`/`false`/`recursive` |

**Java**

Expand Down Expand Up @@ -63,12 +71,13 @@ Common steps for initializing a job for GitHub actions. This composite action co

**Node.js**

| Input | Description | Required | Default |
|-------------------|-------------------------------------------------|----------|---------|
| setup-node | Whether to setup Node.js | No | - |
| node-version | Node.js version to use | No | - |
| node-cache | Package manager for caching (npm, yarn, pnpm) | No | - |
| node-check-latest | Whether to check for the latest Node.js version | No | - |
| Input | Description | Required | Default |
|-------------------|----------------------------------------------------------------------|----------|-------------------------------|
| setup-node | Whether to setup Node.js | No | - |
| node-version | Node.js version to use | No | - |
| node-cache | Package manager for caching (npm, yarn, pnpm) | No | - |
| node-check-latest | Whether to check for the latest Node.js version | No | - |
| node-registry | Registry URL to use for Node.js package installation and publishing | No | `https://registry.npmjs.org/` |

**Python**

Expand Down Expand Up @@ -118,8 +127,8 @@ Common steps for initializing a job for GitHub actions. This composite action co

**Gomplate**

| Input | Description | Required | Default |
|----------------|--------------------------|----------|---------|
| Input | Description | Required | Default |
|----------------|---------------------------|----------|---------|
| setup-gomplate | Whether to setup gomplate | No | false |

> [!NOTE]
Expand All @@ -146,8 +155,10 @@ Common steps for initializing a job for GitHub actions. This composite action co
- `gradle-version`: Version of Gradle that was setup

**Node.js Outputs**

- `node-cache-hit`: Boolean indicating if cache was hit
- `node-version`: The installed node version
- `node-registry-url`: The registry URL used for package installation and publishing

**Python Outputs**

Expand Down Expand Up @@ -221,5 +232,17 @@ Common steps for initializing a job for GitHub actions. This composite action co
python-cache: 'pip'
```

**Blocking Egress Traffic**

By default the Harden Runner step runs in `audit` mode. Set `egress-policy` to `block` to deny any
network traffic that has not been explicitly allowed by the runner's policy.

```yaml
- uses: PandasWhoCode/initialize-github-job@v1
with:
egress-policy: 'block'
checkout: 'true'
```

## License
This repository is licensed under the Apache 2.0 License. See the [LICENSE](LICENSE) file for details.
16 changes: 15 additions & 1 deletion action.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,10 @@ description: 'Common steps for initializing a job for GitHub actions'
author: 'PandasWhoCode'

inputs:
egress-policy:
description: 'Egress policy to apply to the runner (audit or block)'
required: false
default: 'audit'
checkout:
description: 'Whether to checkout the repository'
required: false
Expand All @@ -12,10 +16,18 @@ inputs:
checkout-token:
description: 'Personal access token (PAT) used to fetch the repository and set up task'
required: false
checkout-path:
description: 'The path to checkout the repository into (relative to ${GITHUB_WORKSPACE})'
required: false
default: '.'
checkout-fetch-depth:
description: 'Depth of commit history to fetch'
required: false
default: '1'
checkout-persist:
description: 'Whether to configure the token with the local git config'
required: false
default: 'true'
checkout-submodules:
description: 'Whether to checkout submodules (true/false/recursive)'
default: 'false'
Expand Down Expand Up @@ -217,7 +229,7 @@ runs:
id: harden-runner
uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
with:
egress-policy: audit
egress-policy: ${{ inputs.egress-policy }}

- name: Checkout Code Parameters
id: checkout-params
Expand All @@ -239,6 +251,8 @@ runs:
submodules: ${{ inputs.checkout-submodules }}
ref: ${{ inputs.checkout-ref }}
token: ${{ inputs.checkout-token }}
path: ${{ inputs.checkout-path }}
persist-credentials: ${{ inputs.checkout-persist }}

- name: Set Up Java Parameters
id: setup-java-params
Expand Down
Loading