Repository navigation
Release v2.21.0 - #684
Merged
Merged
Release v2.21.0#684
Conversation
bump linux tls-agent to v1.9.0 added denied endpoint changes
CodeBuild containers run as root without the `sudo` binary. Add a `useDirectPrivileges` flag to bypass `sudo` for directory creation, `chown`, and agent execution on CodeBuild. Also skip installation when running inside a container without root privileges.
Regenerated dist bundles with ncc on Node 24 to resolve the dist/pre/index.js.map conflict.
…f-v2 feat: avoid sudo when running as root
…oint inputs are set The agent enforces the deny list only when allowed-endpoints is empty (allowed endpoints always win). The action's cache-host discovery skip now uses the same rule, so setting both inputs no longer skips the discovery step while the agent enforces the allow list. Also log an info message when both inputs are set to clarify that allowed-endpoints is honored and denied-endpoints is ignored.
Look up the harden-runner cache entry before seeding it, so the constant-key reservation no longer fails with a misleading log line on every run after the first (#681). Guard the v2 lookup against the cache-miss response ({ok: false, signedDownloadUrl: ""}) whose empty URL previously threw, and seed the entry only on a miss, retrying the lookup once afterward. When the host still cannot be resolved, keep egress-policy set to block instead of silently switching to audit (#675). The agents allow the Actions cache endpoints implicitly, so this lookup is a defense-in-depth addition and its failure is safe to ignore. Fixes #675. Fixes #681.
The deny list is an enterprise (TLS) tier feature. The non-TLS agent does not understand denied_endpoints, so a config with only denied-endpoints set was treated as block with an empty allow list, blocking all egress for the job. Gate deny-list mode on the TLS check and ignore denied-endpoints with an info message when the org is not on the enterprise tier.
ashishkurmi
approved these changes
Aug 15, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Improvements to AWS CodeBuild Runner Support
Deny list feature for the enterprise tier
Minor bug fixes