arc-codecov-simulation.yml

name: "ARC: Network Filtering with Harden-Runner"
on:
  workflow_dispatch:

jobs:
  build:
    runs-on: self-hosted
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0
        with:
          egress-policy: block
          allowed-endpoints: >
            api.github.com:443
            *.docker.io:443
            ghcr.io:443
            github.com:443
            objects.githubusercontent.com:443
            nodejs.org:443
            production.cloudflare.docker.com:443
            registry.npmjs.org:443
      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
      - uses: actions/setup-node@3235b876344d2a9aa001b8d1453c930bba69e610 # v3.9.1
        with:
          node-version: 18
      - name: npm install
        run: |
          cd ./src/exfiltration-demo
          npm install
      - name: Publish to Registry
        uses: elgohr/Publish-Docker-Github-Action@eb53b3ec07136a6ebaed78d8135806da64f7c7e2 # v5
        with:
          name: ${{ github.repository }}/prod:latest
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
          registry: ghcr.io
          workdir: ./src/exfiltration-demo