Fix blocked egress trafic

NicolaVerbeeck · Feb 22, 2024 · 0318519 · 0318519
1 parent d41d7d9
commit 0318519
Show file tree

Hide file tree

Showing 2 changed files with 3 additions and 28 deletions.
diff --git a/.github/workflows/pr-cicd.yml b/.github/workflows/pr-cicd.yml
@@ -31,12 +31,7 @@ jobs:
         uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0
         with:
           disable-sudo: true
-          egress-policy: block
-          allowed-endpoints: >
-            github.com:443
-            pub.dartlang.org:443
-            pub.dev:443
-            storage.googleapis.com:443
+          egress-policy: audit
 
       - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
       - uses: dart-lang/setup-dart@fedb1266e91cf51be2fdb382869461a434b920a3 # v1.6.2
@@ -56,15 +51,7 @@ jobs:
         uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0
         with:
           disable-sudo: true
-          egress-policy: block
-          allowed-endpoints: >
-            api.github.com:443
-            codecov.io:443
-            github.com:443
-            pub.dartlang.org:443
-            pub.dev:443
-            storage.googleapis.com:443
-            uploader.codecov.io:443
+          egress-policy: audit
 
       - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
       - uses: dart-lang/setup-dart@fedb1266e91cf51be2fdb382869461a434b920a3 # v1.6.2

diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
@@ -35,19 +35,7 @@ jobs:
         uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0
         with:
           disable-sudo: true
-          egress-policy: block
-          allowed-endpoints: >
-            api.github.com:443
-            api.osv.dev:443
-            api.securityscorecards.dev:443
-            bestpractices.coreinfrastructure.org:443
-            fulcio.sigstore.dev:443
-            github.com:443
-            oss-fuzz-build-logs.storage.googleapis.com:443
-            rekor.sigstore.dev:443
-            sigstore-tuf-root.storage.googleapis.com:443
-            tuf-repo-cdn.sigstore.dev:443
-            www.bestpractices.dev:443
+          egress-policy: audit
 
       - name: "Checkout code"
         uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1