Github: Add rule type that verifies that harden runner is the first step

[JAORMX]

this adds a rule that verifies that the harden-runner action is part
of the first step of each workflow.

To test, you may call it as part of a profile that looks as follows:

---
version: v1
type: profile
name: harden-runner
context:
  provider: github
repository:
  - type: step_security_harden_runner_enabled
    def: {}

Signed-off-by: Juan Antonio Osorio [email protected]

[jhrozek]

Why do we point to trivy?

[JAORMX]

oops!!

[jhrozek]

The rule looks good, do you want to submit the placeholders for tests to get a green CI run?

[jhrozek]

Crap, I clicked the wrong button and closed the PR by accident. Sorry!

[JAORMX]

The rule looks good, do you want to submit the placeholders for tests to get a green CI run?

@jhrozek I can do that. However, I don't think we should block on that. External contributors wouldn't be able to add new rule types.

[jhrozek]

The rule looks good, do you want to submit the placeholders for tests to get a green CI run?

@jhrozek I can do that. However, I don't think we should block on that. External contributors wouldn't be able to add new rule types.

We don't have to block on that but should at least silence the warning by either writing a test or putting the placeholders in the test repo or else all subsequent PRs to this repo would fail this check.

[evankanderson]

So, two issues that are a gap from where we are today:

No remediations

This rule fires an alert, but despite the description of the remediation being pretty simple, we have no way to actually perform the remediation, because it involves:

1. Altering existing files, and we can only rewrite with mostly-fixed contents
2. We need to patch multiple arbitrary files, and we can only target a fixed number of fixed-name files.

Incomplete checks and remediation

This only does step 1 of the instructions.

1. Add the step-security/harden-runner GitHub Action to your GitHub Actions workflow file as the first step in each job. You can automate adding Harden-Runner Action to your workflow file by pasting your workflow in the StepSecurity online tool.
2. In the workflow logs and the job markdown summary, you will see a link to security insights and recommendations.
3. Click on the link (example link). You will see a process monitor view of network and file events correlated with each step of the job.
4. In the Recommended Policy tab, you'll find a recommended block policy based on outbound calls aggregated from the current and past runs of the job. You can update your workflow file with this policy, or alternatively, use the Policy Store to apply the policy without modifying the workflow file. From now on, any outbound calls not in the allowed list will be blocked.

I'm not sure how we'd do steps 3 & 4 to fill out the actual policy, assuming that Step Security provided an API for reading these recommendations. We'd run into both the problems from "no remediations" as well as not having a way to fetch the output.