v2.20.1 keeps workflow jobs running on dependabot-owned Pull Requests from accessing repository secrets.

[zrhoffman]

What I did:
Updated step-security/harden-runner from v2.20.0 to v2.20.1 in my repository.

My complete configuration for the harden-runner GHA:

        with:
          egress-policy: audit

Expected result: Workflow jobs running on dependabot-opened Pull Requests can still access my repository secrets.

Actual result: Workflow jobs running on dependabot-opened Pull Requests cannot access repository secrets.

More info:

This is unexpected because egress-policy is set to audit, not block.

As a workaround, adding pipelines.actions.githubusercontent.com:443 to allowed-endpoints allows workflow jobs running on dependabot-opened Pull Requests to access repository secrets again under step-security/harden-runner@v2.20.1 and up:

          allowed-endpoints: |
            pipelines.actions.githubusercontent.com:443

[varunsh-coder]

@zrhoffman can you please share the workflow run if this was in a public repo? If it was in private repo using enterprise tier, can you please reach out to support@stepsecurity.io with the details?

[varunsh-coder]

@zrhoffman any update on this?