Does not work with some container images

[wallies]

  semgrep:
    permissions:
      contents: read # for actions/checkout to fetch code
    name: semgrep-scan
    runs-on: ubuntu-20.04
    container:
      image: returntocorp/semgrep
    if: (github.actor != 'dependabot[bot]')
    steps:
    - name: Harden Runner
      uses: step-security/harden-runner@9b0655f430fba8c7001d4e38f8d4306db5c6e0ab
      with:
        egress-policy: audit

    - uses: actions/checkout@3df53dd32d858478710a6127bcd8b9d8b7182e16
    - run: semgrep ci || true

This fails with the below error

/bin/sh: sudo: not found
Error: Command failed: sudo mkdir -p /home/agent
/bin/sh: sudo: not found

[varunsh-coder]

Hi @wallies harden-runner does not work when run inside a container. It needs to be run on the ubuntu VM as it needs sudo access. So this line container: image: returntocorp/semgrep is causing the error. At the same time, it should not cause workflow to fail. I will solve that part, so it can detect it is in a container, and do a no op and write a warning message.

In this case is it possible for you to not use the container to run, but instead install semgrep using an Action?

[varunsh-coder]

@wallies the latest release

• does not fail the workflow if harden-runner is run in a container
• shows a message that the job will not be monitored (example)
• adds a limitations section to readme file to talk about this limitation

I have also linked to an issue in secure-workflows so app.stepsecurity.io does not add harden-runner if job is running in a container.

Please let me know if I can go ahead and close this issue?

[wallies]

Thanks @varunsh-coder. Works perfectly