ci: flip harden-runner to egress block mode with per-job allowlists (SLSA phase 5)

.github/workflows/codeql.yml

@@ -26,10 +26,24 @@ jobs:
       packages: read # fetch CodeQL query packs
       contents: read
     steps:
-      - name: Harden runner (egress audit)
+      - name: Harden runner (egress block)
         uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
         with:
-          egress-policy: audit
+          egress-policy: block
+          allowed-endpoints: >
+            *.actions.githubusercontent.com:443
+            api.github.com:443
+            codeload.github.com:443
+            dl.google.com:443
+            github.com:443
+            go.dev:443
+            objects.githubusercontent.com:443
+            proxy.golang.org:443
+            raw.githubusercontent.com:443
+            release-assets.githubusercontent.com:443
+            storage.googleapis.com:443
+            sum.golang.org:443
+            uploads.github.com:443
       - name: Checkout
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:

.github/workflows/dependency-review.yml

@@ -15,10 +15,20 @@ jobs:
   dependency-review:
     runs-on: ubuntu-latest
     steps:
-      - name: Harden runner (egress audit)
+      - name: Harden runner (egress block)
         uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
         with:
-          egress-policy: audit
+          egress-policy: block
+          allowed-endpoints: >
+            *.actions.githubusercontent.com:443
+            api.deps.dev:443
+            api.github.com:443
+            api.securityscorecards.dev:443
+            codeload.github.com:443
+            github.com:443
+            objects.githubusercontent.com:443
+            raw.githubusercontent.com:443
+            release-assets.githubusercontent.com:443
       - name: Checkout
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:

.github/workflows/govulncheck.yml

@@ -21,10 +21,24 @@ jobs:
   govulncheck:
     runs-on: ubuntu-latest
     steps:
-      - name: Harden runner (egress audit)
+      - name: Harden runner (egress block)
         uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
         with:
-          egress-policy: audit
+          egress-policy: block
+          allowed-endpoints: >
+            *.actions.githubusercontent.com:443
+            api.github.com:443
+            codeload.github.com:443
+            dl.google.com:443
+            github.com:443
+            go.dev:443
+            objects.githubusercontent.com:443
+            proxy.golang.org:443
+            raw.githubusercontent.com:443
+            release-assets.githubusercontent.com:443
+            storage.googleapis.com:443
+            sum.golang.org:443
+            vuln.go.dev:443
       - name: Checkout
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:

.github/workflows/release.yml

@@ -18,10 +18,29 @@ jobs:
       id-token: write      # OIDC token for Sigstore signing of provenance
       attestations: write  # store the build-provenance attestation
     steps:
-      - name: Harden runner (egress audit)
+      - name: Harden runner (egress block)
         uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
         with:
-          egress-policy: audit
+          egress-policy: block
+          allowed-endpoints: >
+            *.actions.githubusercontent.com:443
+            api.github.com:443
+            codeload.github.com:443
+            dl.google.com:443
+            fulcio.sigstore.dev:443
+            get.anchore.io:443
+            github.com:443
+            go.dev:443
+            objects.githubusercontent.com:443
+            proxy.golang.org:443
+            raw.githubusercontent.com:443
+            rekor.sigstore.dev:443
+            release-assets.githubusercontent.com:443
+            storage.googleapis.com:443
+            sum.golang.org:443
+            toolbox-data.anchore.io:443
+            tuf-repo-cdn.sigstore.dev:443
+            uploads.github.com:443
 
       - name: Checkout
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

.github/workflows/testvet.yml

@@ -9,10 +9,23 @@ jobs:
   testvet:
     runs-on: ubuntu-latest
     steps:
-      - name: Harden runner (egress audit)
+      - name: Harden runner (egress block)
         uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
         with:
-          egress-policy: audit
+          egress-policy: block
+          allowed-endpoints: >
+            *.actions.githubusercontent.com:443
+            api.github.com:443
+            codeload.github.com:443
+            dl.google.com:443
+            github.com:443
+            go.dev:443
+            objects.githubusercontent.com:443
+            proxy.golang.org:443
+            raw.githubusercontent.com:443
+            release-assets.githubusercontent.com:443
+            storage.googleapis.com:443
+            sum.golang.org:443
       - name: Checkout
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:

.github/workflows/zizmor.yml

@@ -20,10 +20,20 @@ jobs:
       contents: read
       security-events: write # upload SARIF findings to code scanning
     steps:
-      - name: Harden runner (egress audit)
+      - name: Harden runner (egress block)
         uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
         with:
-          egress-policy: audit
+          egress-policy: block
+          allowed-endpoints: >
+            *.actions.githubusercontent.com:443
+            api.github.com:443
+            codeload.github.com:443
+            ghcr.io:443
+            github.com:443
+            objects.githubusercontent.com:443
+            pkg-containers.githubusercontent.com:443
+            raw.githubusercontent.com:443
+            release-assets.githubusercontent.com:443
       - name: Checkout
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:

docs/SLSA.md

@@ -5,11 +5,13 @@ Software Artifacts) posture of `github.com/threatcl/spec`. It states where we
 are today, where we're going, and maps every planned change to a specific SLSA
 **track** and **level**.
 
-> **Status:** Phases 0–4 complete. Phase 2 rulesets are active on the repo
+> **Status:** Phases 0–5 complete. Phase 2 rulesets are active on the repo
 > (commit + tag signing in force); the first attested release is produced when
 > the next `vX.Y.Z` tag is pushed (see [Verification](#verification)). Phase 4
 > adds scanning (govulncheck, dependency-review, zizmor, CodeQL), runner
 > hardening, and per-release SBOMs — mirroring `threatcl/threatcl`'s phase 5.
+> Phase 5 flips harden-runner from egress *auditing* to egress *enforcement*
+> (`block` + per-job `allowed-endpoints`) on every workflow job.
 
 ## What this repo is (and why it matters for SLSA)
 
@@ -103,6 +105,7 @@ Source and Build tracks trustworthy (and improve OpenSSF Scorecard).
 | **4** | CodeQL with `security-extended` | Hygiene — SAST over the library source |
 | **4** | harden-runner (egress audit) + `persist-credentials: false` on every job | Hygiene — runner egress visibility; no ambient git credentials after checkout |
 | **4** | SPDX SBOM per released archive (checksummed + attested) | Strengthens Build-track artifact transparency |
+| **5** | harden-runner `egress-policy: block` + per-job `allowed-endpoints` on every job | Hygiene — egress *enforcement*: a compromised dependency or action can no longer exfiltrate to arbitrary hosts |
 
 ### Caveat on "Build L3" via native GitHub attestations
 
@@ -150,6 +153,15 @@ bounded — the high-value compiled-binary provenance belongs downstream in the
   `golang.org/x/net` (v0.55.0), and `github.com/go-jose/go-jose/v4` (v4.1.4).
   All new actions are SHA-pinned with version comments and least-privilege
   `permissions`.
+- [x] **Phase 5** — Egress enforcement (mirrors `threatcl/threatcl` phase 6):
+  every job's harden-runner flipped from `egress-policy: audit` to `block`
+  with an explicit per-job `allowed-endpoints` list, derived from the
+  StepSecurity audit baselines observed since Phase 4 landed, plus
+  documented cache-miss paths (Go toolchain/module infra) and, for the
+  release job — which has not yet run under harden-runner — the publish
+  endpoints (release upload, Sigstore keyless signing). If a release fails
+  on a blocked endpoint, fix the list on `main` and re-tag the next patch
+  version; a failed run publishes nothing.
 
 ## Maintainer checklist — GitHub settings (Phase 2)