Skip to content

Commit 1adb8fc

Browse files
varunsh-codervarunsh-coder
authored
Update tutorials (step-security#151)
1 parent 73ed74a commit 1adb8fc

38 files changed

Lines changed: 446 additions & 379 deletions

‎.github/workflows/arc-codecov-simulation.yml‎

Lines changed: 24 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,9 @@
1-
name: 3. ARC Codecov Simulation
1+
name: "ARC: Network Filtering with Harden-Runner"
22
on:
33
workflow_dispatch:
4-
4+
55
jobs:
6-
arc-codecov-simulation:
6+
build:
77
runs-on: self-hosted
88
steps:
99
- name: Harden Runner
@@ -12,10 +12,26 @@ jobs:
1212
egress-policy: block
1313
allowed-endpoints: >
1414
api.github.com:443
15+
*.docker.io:443
16+
ghcr.io:443
1517
github.com:443
16-
18+
objects.githubusercontent.com:443
19+
nodejs.org:443
20+
production.cloudflare.docker.com:443
21+
registry.npmjs.org:443
1722
- uses: actions/checkout@v3
18-
19-
# Codecov Scenario: Exfiltrate data to attacker's endpoint
20-
- name: Data Exfiltration To Attacker Controller Endpoint
21-
run: curl pastebin.com -L
23+
- uses: actions/setup-node@v3
24+
with:
25+
node-version: 18
26+
- name: npm install
27+
run: |
28+
cd ./src/exfiltration-demo
29+
npm install
30+
- name: Publish to Registry
31+
uses: elgohr/Publish-Docker-Github-Action@v5
32+
with:
33+
name: ${{ github.repository }}/prod:latest
34+
username: ${{ github.actor }}
35+
password: ${{ secrets.GITHUB_TOKEN }}
36+
registry: ghcr.io
37+
workdir: ./src/exfiltration-demo

‎.github/workflows/arc-secure-by-default.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
1-
name: 2. Secure-By-Default ARC Cluster-Level Policy
1+
name: "ARC: Secure-By-Default Cluster-Level Policy"
22
on:
33
workflow_dispatch:
4-
4+
55
jobs:
66
direct-ip-hosted:
77
runs-on: ubuntu-latest

‎.github/workflows/arc-solarwinds-simulation.yml‎

Lines changed: 15 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
name: 4. ARC SolarWinds Simulation
1+
name: "ARC: File Monitoring with Harden-Runner"
22
on:
33
workflow_dispatch:
44

@@ -7,10 +7,18 @@ jobs:
77
runs-on: self-hosted
88
steps:
99
- uses: actions/checkout@v3
10-
11-
# SolarWinds Scenario: Overwrite calc.go to inject backdoor
12-
- name: File Overwrite with mv
10+
- uses: actions/setup-node@v3
11+
with:
12+
node-version: 18
13+
- name: npm install
1314
run: |
14-
code='package main\n\nfunc main(){\nprintln("code added")\n}'
15-
printf "$code" > calc1.go
16-
mv calc1.go calc.go
15+
cd ./src/backdoor-demo
16+
npm install
17+
- name: Publish to Registry
18+
uses: elgohr/Publish-Docker-Github-Action@v5
19+
with:
20+
name: ${{ github.repository }}/prod:latest
21+
username: ${{ github.actor }}
22+
password: ${{ secrets.GITHUB_TOKEN }}
23+
registry: ghcr.io
24+
workdir: ./src/backdoor-demo

‎.github/workflows/arc-zero-effort-observability.yml‎

Lines changed: 18 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,14 +1,24 @@
1-
name: 1. Zero-effort Observability
1+
name: "ARC: Zero-effort Observability"
22
on:
33
workflow_dispatch:
44

55
jobs:
6-
observability:
6+
build:
77
runs-on: self-hosted
8-
permissions:
9-
contents: read
108
steps:
11-
- uses: actions/checkout@v2
12-
13-
- name: Build Docker image
14-
run: docker build .
9+
- uses: actions/checkout@v3
10+
- uses: actions/setup-node@v3
11+
with:
12+
node-version: 18
13+
- name: npm install
14+
run: |
15+
cd ./src/exfiltration-demo
16+
npm install
17+
- name: Publish to Registry
18+
uses: elgohr/Publish-Docker-Github-Action@v5
19+
with:
20+
name: ${{ github.repository }}/prod:latest
21+
username: ${{ github.actor }}
22+
password: ${{ secrets.GITHUB_TOKEN }}
23+
registry: ghcr.io
24+
workdir: ./src/exfiltration-demo

‎.github/workflows/ci.yml‎

Lines changed: 0 additions & 20 deletions
This file was deleted.

‎.github/workflows/hosted-file-monitor-with-hr.yml‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
name: "Hosted: File Monitoring with Harden-Runner"
2+
on:
3+
workflow_dispatch:
4+
5+
jobs:
6+
build:
7+
runs-on: ubuntu-latest
8+
steps:
9+
- uses: step-security/harden-runner@v2
10+
with:
11+
egress-policy: audit
12+
- uses: actions/checkout@v3
13+
- name: npm install
14+
run: |
15+
cd ./src/backdoor-demo
16+
npm install
17+
- name: Publish to Registry
18+
uses: elgohr/Publish-Docker-Github-Action@v5
19+
with:
20+
name: ${{ github.repository }}/prod:latest
21+
username: ${{ github.actor }}
22+
password: ${{ secrets.GITHUB_TOKEN }}
23+
registry: ghcr.io
24+
workdir: ./src/backdoor-demo

‎.github/workflows/hosted-file-monitor-without-hr.yml‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
name: "Hosted: File Monitoring without Harden-Runner"
2+
on:
3+
workflow_dispatch:
4+
5+
jobs:
6+
build:
7+
runs-on: ubuntu-latest
8+
steps:
9+
- uses: actions/checkout@v3
10+
- name: npm install
11+
run: |
12+
cd ./src/backdoor-demo
13+
npm install
14+
- name: Publish to Registry
15+
uses: elgohr/Publish-Docker-Github-Action@v5
16+
with:
17+
name: ${{ github.repository }}/prod:latest
18+
username: ${{ github.actor }}
19+
password: ${{ secrets.GITHUB_TOKEN }}
20+
registry: ghcr.io
21+
workdir: ./src/backdoor-demo

‎.github/workflows/hosted-network-filtering-hr.yml‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
name: "Hosted: Network Filtering with Harden-Runner"
2+
on:
3+
workflow_dispatch:
4+
5+
jobs:
6+
build:
7+
runs-on: ubuntu-latest
8+
steps:
9+
- name: Harden Runner
10+
uses: step-security/harden-runner@v2
11+
with:
12+
disable-sudo: true
13+
egress-policy: block
14+
allowed-endpoints: >
15+
ghcr.io:443
16+
github.com:443
17+
registry.npmjs.org:443
18+
- uses: actions/checkout@v3
19+
- name: npm install
20+
run: |
21+
cd ./src/exfiltration-demo
22+
npm install
23+
- name: Publish to Registry
24+
uses: elgohr/Publish-Docker-Github-Action@v5
25+
with:
26+
name: ${{ github.repository }}/prod:latest
27+
username: ${{ github.actor }}
28+
password: ${{ secrets.GITHUB_TOKEN }}
29+
registry: ghcr.io
30+
workdir: ./src/exfiltration-demo

‎.github/workflows/hosted-network-monitoring-hr.yml‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
name: "Hosted: Network Monitoring with Harden-Runner"
2+
on:
3+
workflow_dispatch:
4+
5+
jobs:
6+
build:
7+
runs-on: ubuntu-latest
8+
steps:
9+
- uses: step-security/harden-runner@v2
10+
with:
11+
egress-policy: audit
12+
- uses: actions/checkout@v3
13+
- name: npm install
14+
run: |
15+
cd ./src/exfiltration-demo
16+
npm install
17+
- name: Publish to Registry
18+
uses: elgohr/Publish-Docker-Github-Action@v5
19+
with:
20+
name: ${{ github.repository }}/prod:latest
21+
username: ${{ github.actor }}
22+
password: ${{ secrets.GITHUB_TOKEN }}
23+
registry: ghcr.io
24+
workdir: ./src/exfiltration-demo

‎.github/workflows/hosted-network-without-hr.yml‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
name: "Hosted: Network Monitoring without Harden-Runner"
2+
on:
3+
workflow_dispatch:
4+
5+
jobs:
6+
build:
7+
runs-on: ubuntu-latest
8+
steps:
9+
- uses: actions/checkout@v3
10+
- name: npm install
11+
run: |
12+
cd ./src/exfiltration-demo
13+
npm install
14+
- name: Publish to Registry
15+
uses: elgohr/Publish-Docker-Github-Action@v5
16+
with:
17+
name: ${{ github.repository }}/prod:latest
18+
username: ${{ github.actor }}
19+
password: ${{ secrets.GITHUB_TOKEN }}
20+
registry: ghcr.io
21+
workdir: ./src/exfiltration-demo

0 commit comments

Comments
 (0)