step-security/harden-runner
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

docs: expand enterprise feature list and document custom VM and ubuntu-slim limitations

Browse Source
This commit is contained in:
Varun Sharma
2026-08-30 10:57:49 -07:00
parent b0eaf8d287
commit a447fba558
2 changed files with 7 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+5 -1
View File
@@ -147,6 +147,10 @@ Includes all features in the **Community** tier, plus:
- **Determine Minimum GITHUB_TOKEN Permissions:** Monitor outbound HTTPS requests to GitHub APIs to recommend the least-privilege permissions needed for your workflows, enhancing security by reducing unnecessary access.
- **View the Name and Path of Every File Written During the Build Process:** Gain visibility into every file written to the build environment, including the ability to correlate file writes with processes, ensuring complete transparency.
- **View Process Names and Arguments:** Monitor every process executed during the build process, along with its arguments, and navigate the process tree to detect suspicious activities.
- **Centralized Policy Store:** Manage egress policies centrally from the StepSecurity dashboard instead of editing each workflow file. Learn more in the [Policy Store documentation](https://docs.stepsecurity.io/github-actions/harden-runner/policy-store).
- **Baselines at Repository, Organization, and Cluster Level:** Create and manage baselines beyond the per-job level. Learn more in the [Baseline documentation](https://docs.stepsecurity.io/github-actions/harden-runner/baseline).
- **Suppression Rules:** Suppress expected detections to reduce alert noise. Learn more in the [Suppression Rules documentation](https://docs.stepsecurity.io/github-actions/harden-runner/suppression-rules).
- **Alert Notifications and SIEM Integration:** Receive alerts via email, Slack, and Microsoft Teams, and integrate detections with your SIEM solution.
For a detailed comparison and more information, please visit our [Pricing Page](https://www.stepsecurity.io/pricing).
@@ -156,7 +160,7 @@ Explore the full feature set in the [Features Documentation](https://docs.stepse
## StepSecurity Maintained Actions
Many popular third-party GitHub Actions are abandoned, maintained by a single person, or stuck on outdated runtimes. StepSecurity publishes [Maintained Actions](https://docs.stepsecurity.io/github-actions/actions/stepsecurity-maintained-actions): drop-in replacements that are actively maintained, security-reviewed, and kept current, including updates to the Node 24 runtime.
Many popular third-party GitHub Actions are abandoned or stuck on outdated runtimes. StepSecurity publishes [Maintained Actions](https://docs.stepsecurity.io/github-actions/actions/stepsecurity-maintained-actions): drop-in replacements that are actively maintained, security-reviewed, and kept current, including updates to the Node 24 runtime.
- **Free for public repositories**, no subscription required. Read the [announcement](https://www.stepsecurity.io/blog/stepsecurity-maintained-actions-are-now-free-for-public-repos).
- **~500 actions and growing.** [Browse the full catalog](https://app.stepsecurity.io/action-advisor?tab=maintained).
docs/limitations.md
+2 -1
View File
@@ -1,7 +1,8 @@
## Limitations
### GitHub-Hosted Runners
* Harden-Runner is not supported when [job is run in a container](https://docs.github.com/en/actions/using-jobs/running-jobs-in-a-container) with built-in labels such as `ubuntu-latest`, as it needs sudo access on the Ubuntu VM to run. The limitation is if the entire job is run in a container. However, such jobs can be monitored when using custom VM images with GitHub-hosted runners. This is also not a limitation for Self-Hosted runners.
* Harden-Runner is not supported when [job is run in a container](https://docs.github.com/en/actions/using-jobs/running-jobs-in-a-container) with built-in labels such as `ubuntu-latest`, as it needs sudo access on the Ubuntu VM to run. The limitation is if the entire job is run in a container. However, such jobs can be monitored when using [custom VM images with GitHub-hosted runners](https://docs.stepsecurity.io/github-actions/harden-runner#github-hosted-custom-vm), which requires the Enterprise tier. This is also not a limitation for Self-Hosted runners.
* Harden-Runner is not supported on `ubuntu-slim` runners. The agent relies on kernel-level features that require elevated capabilities, which are not available on `ubuntu-slim`. The action detects `ubuntu-slim` and exits cleanly with an informational log message, without monitoring the job. See [issue #627](https://github.com/step-security/harden-runner/issues/627) for details.
### Self-Hosted Actions Runner Controller (ARC) Runners