News for hackers. Stuff that matters.

A comment on How to Harden GitHub Actions: The Unofficial Guide.

Re:How to Harden GitHub Actions: The Unofficial Guide by maenbalja on Thursday May 08, 2025 @02:31PM (#43929611)
Timely article... I recently learned about self-hosted runners and set one up on a Hetzner instance. Pretty smooth experience overall. If your action contains any SSH commands and you'd like to avoid setting up a firewall with 5000+ rules[0], I would recommend self-hosting a runner to help secure your target server's SSH port.

[0] https://api.github.com/meta

[ Parent | on HN ]
Re:How to Harden GitHub Actions: The Unofficial Guide by woodruffw on Thursday May 08, 2025 @05:56PM (#43931767)
FWIW: Self-hosted runners are non-trivial to secure[1]; the defaults GitHub gives you are not necessarily secure ones, particularly if your self-hosted runner executes workflows from public repositories.

(Self-hosted runners are great for many other reasons, not least of which is that they're a lot cheaper. But I've seen a lot of people confuse GitHub Actions' latent security issues with something that self-hosted runners can fix, which is not per se the case.)

[1]: https://docs.github.com/en/actions/security-for-github-actio...

[ Parent | on HN ]
Re:How to Harden GitHub Actions: The Unofficial Guide by maenbalja on Thursday May 08, 2025 @08:31PM (#43932712)
Hm that's good to know, thanks for the link. I'm just using the runner for private solo projects atm so I think my setup will do for now. But I definitely didn't consider the implications of using it on a private project with other contributors yikes.
[ Parent | on HN ]