chore: always pin harden-runner unless exempted

shubham-stepsecurity · shubham-stepsecurity · commit 63e0c2927a8a · 2025-04-21T09:04:43.000Z
diff --git a/remediation/workflow/secureworkflow.go b/remediation/workflow/secureworkflow.go
@@ -85,10 +85,12 @@ func SecureWorkflow(queryStringParams map[string]string, inputYaml string, svc d
 	}
 
 	if addHardenRunner {
+		// Always pin harden-runner unless exempted
+		pinHardenRunner := true
 		if pin.ActionExists(HardenRunnerActionPath, exemptedActions) {
-			pinActions = false
+			pinHardenRunner = false
 		}
-		secureWorkflowReponse.FinalOutput, addedHardenRunner, _ = hardenrunner.AddAction(secureWorkflowReponse.FinalOutput, HardenRunnerActionPathWithTag, pinActions, pinToImmutable)
+		secureWorkflowReponse.FinalOutput, addedHardenRunner, _ = hardenrunner.AddAction(secureWorkflowReponse.FinalOutput, HardenRunnerActionPathWithTag, pinHardenRunner, pinToImmutable)
 	}
 
 	// Setting appropriate flags
diff --git a/testfiles/secureworkflow/output/nopin.yml b/testfiles/secureworkflow/output/nopin.yml
@@ -15,7 +15,7 @@ jobs:
     runs-on: ubuntu-latest  
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@v2
+        uses: step-security/harden-runner@ebacdc22ef6c2cfb85ee5ded8f2e640f4c776dd5 # v2.0.0
         with:
           egress-policy: audit
 

Original file line number	Diff line number	Diff line change
`@@ -85,10 +85,12 @@ func SecureWorkflow(queryStringParams map[string]string, inputYaml string, svc d`
`85`	`85`	`}`
`86`	`86`
`87`	`87`	`if addHardenRunner {`
	`88`	`+ // Always pin harden-runner unless exempted`
	`89`	`+ pinHardenRunner := true`
`88`	`90`	`if pin.ActionExists(HardenRunnerActionPath, exemptedActions) {`
`89`		`- pinActions = false`
	`91`	`+ pinHardenRunner = false`
`90`	`92`	`}`
`91`		`- secureWorkflowReponse.FinalOutput, addedHardenRunner, _ = hardenrunner.AddAction(secureWorkflowReponse.FinalOutput, HardenRunnerActionPathWithTag, pinActions, pinToImmutable)`
	`93`	`+ secureWorkflowReponse.FinalOutput, addedHardenRunner, _ = hardenrunner.AddAction(secureWorkflowReponse.FinalOutput, HardenRunnerActionPathWithTag, pinHardenRunner, pinToImmutable)`
`92`	`94`	`}`
`93`	`95`
`94`	`96`	`// Setting appropriate flags`