Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Task/readme update #76

Merged
merged 3 commits into from
Aug 5, 2024
Merged

Task/readme update #76

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
ccb1128
Update README.md
dhamijaabhi Aug 4, 2024
5713516
readme changes
raianand Aug 5, 2024
e7beefb
fix linting issues
raianand Aug 5, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
35 changes: 26 additions & 9 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,27 +2,39 @@
[![OSSF-Scorecard Score](https://img.shields.io/ossf-scorecard/github.com/koalalab-inc/bolt?label=openssf%20scorecard)](https://api.securityscorecards.dev/projects/github.com/koalalab-inc/bolt)
![GitHub License](https://img.shields.io/github/license/koalalab-inc/bolt)

## Secure GitHub Actions with 1 line of code
# BOLT:Secure GitHub Actions Runtime with 1 line of code
BOLT is an egress-filter and runtime security tool for your GitHub Actions environment.
### Usage
Add this step to jobs in your GitHub workflow file(s) to secure your runner:
```yaml
- name: Setup Bolt
uses: koalalab-inc/bolt@v1
```

## Transparent Egress Gateway for GitHub hosted runners

Bolt is a transparent egress gateway that can be used to control the egress traffic from GitHub hosted runners. It is packaged as a GitHub Action, which means you can easily add it to your workflows and start controlling the egress traffic from your pipelines.
BOLT is packaged as a GitHub Action, which means you can easily add it to your workflows and start controlling the egress traffic from your pipelines.

> [!NOTE]
>
> Supports both public and private repositories

## Why use BOLT?
Ther aftermath of [Solarwinds breach](https://en.wikipedia.org/wiki/2020_United_States_federal_government_data_breach) has led to [an increase in software supply chain attacks](https://linuxfoundation.eu/newsroom/the-rising-threat-of-software-supply-chain-attacks-managing-dependencies-of-open-source-projects).

CI/CD pipelines are the infrastructure of which the software is built, they are the keys to the cloud kingdom, and are high-leverage attack surfaces.

[OWASP top 10 CI/CD](https://owasp.org/www-project-top-10-ci-cd-security-risks/) and [CISA+NSA's joint guidance on defending CI/CD](https://www.cisa.gov/news-events/alerts/2023/06/28/cisa-and-nsa-release-joint-guidance-defending-continuous-integrationcontinuous-delivery-cicd) are really great starting points to understand the threat vectors surrounding CI/CD. An adaption of the same for GitHub environment would look a little like:

![CI:CD Threat Vectors](https://github.com/user-attachments/assets/99ed2591-6f8f-45f0-b6be-5e8133c19f96)

and specifically focussing on the CI runtime threat vectors(and their solution):

## Why?
![CI Runtime Threat Vectors](https://github.com/user-attachments/assets/c115b4d1-d42c-4e72-85a4-b61eeda83371)

Complex CI/CD environments are under increasing threat due to increase in software supply chain attacks. Modern CI/CDs (GitHub CI) allow third-party code in highly privledged CI environment.
BOLT covers both the threat vectors by

1. Transparent Egress filtering mechanism which allows traffic only to trusted domains
2. Detection of actions with Sudo permissions to prevent against file-tampering during build time.

GitHub hosted runners are a great way to run your CI/CD pipelines. However, they are not without their limitations. One of the most notable limitations is the lack of egress control. This means that any code running on a GitHub hosted runner can make requests to any external service. This can be a security risk, especially when running untrusted code.

## How to use Bolt - Video Introduction

Expand Down Expand Up @@ -99,7 +111,7 @@ It is an ordered list of rules. The first rule that matches the destination will
action: 'allow'
```

## Report
## Report in workflow logs
Once the job is over, bolt will add a egress traffic report to the job summary. The report will show the egress traffic and the rules that were applied. A sample report is shown below.

<hr>
Expand Down Expand Up @@ -152,4 +164,9 @@ This report was generated using this workflow file: [bolt-sample.yml](examples/b

> [!NOTE]
>
> We have removed SSL inspection features from Bolt. It had some compatibility issues with certain package managers. We will soon release a new version with improved SSL inspection capabilities.
> We have removed SSL inspection features from Bolt. It had some compatibility issues with certain package managers. We will soon release a new version with improved SSL inspection capabilities.


## Usage and Limitations

BOLT is available to use for private as well as public repository on GitHub hosted ubuntu runners. Contact us if you want to use BOLT on self-hosted runners.
Loading