Runtime Security for Third-Party GitHub Actions Runners: Bitrise, Blacksmith, Depot, Namespace, and Warp

Supply chain attacks targeting GitHub Actions workflows pose consistent risks regardless of the runner infrastructure used. Third-party runner providers like Bitrise, Blacksmith, Depot, Namespace, and Warp are increasingly adopted for performance and specialized hardware, but they inherit the same threat model as GitHub-hosted runners. Malicious dependencies or compromised actions can still access sensitive secrets and execute harmful payloads. Harden-Runner v2.20.0 now supports these third-party runners, providing runtime security through egress monitoring, policy enforcement, and threat detection.

AI-extracted · verify before operational use