v2.2.4

Features

• Migrate the run action's sandbox to runc with seccomp support (#175)
  • run-isolated.sh now hands the sandboxed command to runc (the OCI reference runtime) instead of hand-rolled unshare/nsenter/setpriv namespace/mount/capability handling. Namespaces, capabilities, mounts, uid/gid, and a seccomp filter derived from Docker's own default profile are all declared in an OCI config.json and enforced by runc itself — including joining the proxy container's existing network namespace and dropping uid/gid without a user namespace. Resolves the previously-documented "No seccomp profile" Known Limitation.
• Add known_blocked_rules to mark expected blocked connections (#181)
  • In restrict mode, fail_on_blocked previously failed a step on any blocked connection, including ones you already expect and want blocked — a security check confirming a domain stays blocked, or a dependency that phones home to a known-noisy endpoint. known_blocked_rules (same wildcard/~regex syntax as allowed_*_rules) marks those destinations so they no longer fail the step, while still showing up in the Job Summary's Blocked Hosts table under a new "Expected" column. Available on both run and report.
• Give actionable errors when Docker/sudo is unavailable (e.g. ubuntu-slim) (#187)
  • setup/run/report previously let raw docker/sudo failures propagate as a generic "Unexpected error". A new describeDockerFailure() classifies Docker failures and names the runner requirement explicitly, calling out container-based hosted runners like ubuntu-slim when relevant. A new sudo preflight in run also fails fast with its own error instead of misattributing a missing-passwordless-sudo failure to the user's own run: command.

Documentation

• Add overview and architecture diagrams for the run action (#179)
  • Matches the diagrams transparent/explicit already have in the README and docs/security.md, illustrating run's different architecture: a runc-created host process connected to the proxy container by a single dedicated veth pair rather than a shared CNI bridge.
• Rewrite the README to treat run as an equal path to docker build (#180)
  • run was previously an "(Experimental)" bolt-on below the setup/report build engines; now that it's stable enough to promote, the README presents docker build and a plain run: step as two equally valid places to apply the same outbound-restriction technology. The full transparent/explicit engine breakdown moves out of "How It Works" into docs/reference.md.
• Use literal block scalars (|) for multiline rule examples (#182)
  • Replaces the folded scalar (>-) previously used in allowed_https_rules/allowed_http_rules/allowed_ip_rules examples, matching the run: | style already used elsewhere in the docs. Purely cosmetic — the parser splits rules on any whitespace.

Refactoring

• Replace the sandbox0 bridge with a direct veth connection to the proxy (#176)
  • The bridge existed only to give run-isolated.sh a stable, pre-known interface name to attach a veth to — init-iptables's -i sandbox0 rule matches on name regardless of when the device appears. Since the sandbox and its proxy are always connected 1:1, the veth's proxy-side end is now renamed directly to sandbox0 instead of being attached to a bridge.
• Extract a generic markdown table formatter from host-table rendering (#186)
  • Splits core/lib/markdown-table.js's table-building logic (headers, alignment, cell joining) from the host-row-specific rendering added in #181, so the formatter isn't coupled to one fixed Host/Rule/Reason/Count/Expected column set.
• Share image provenance verification between setup and run (#188)
  • Both actions independently implemented near-identical resolveVerifiedImage logic and their own error class with duplicated provenance codes. A new shared ActionError base class and verifyImageDigestOrThrow consolidate this into one testable component, giving it unit test coverage for the first time.
• Add a TypeScript build foundation (#189)
  • Adds tsc type-checking (allowJs/checkJs, strict: true) for the existing .js sources across core/lib, setup/src, run/src, report/src, and replaces Rollup with Rolldown for the dist build — laying the groundwork for the migration below without changing any source file's language yet.
• Migrate the remaining Node.js sources to TypeScript (#190)
  • Converts every .js file under core/lib, setup/src, run/src, report/src to .ts with real type annotations, removes all // @ts-nocheck escapes left from #189, and strengthens error codes from string to literal unions (ActionError<Code extends string>).
• Migrate the QuickJS-executed scripts to TypeScript (#191)
  • Converts the last plain JavaScript in the repo — the scripts run inside containers via QuickJS — completing the migration. Switches the QuickJS runtime from Bellard's original quickjs to quickjs-ng (what Alpine's quickjs package actually ships turned out to be the former, not the fork), and bundles each entry point into a single self-contained file with Rolldown instead of shipping raw sources.

CI / Maintenance

• Scope example workflow permissions to job level and make docker-login optional (#183)
  • The example workflows logged in to GHCR before every run, but setup's OCI registry client already falls back to anonymous pulls, and the public dash14/buildcage package needs no authentication. The docker/login-action step and its packages: read permission are now commented out (with a note to re-enable for self-hosting under a private package), and permissions moves from workflow level to job level, following least-privilege practice.

Dependencies

• Bump google.golang.org/grpc to v1.82.1, addressing an xDS RBAC authorization bypass and an HTTP/2 Rapid Reset mitigation bypass (GHSA-hrxh-6v49-42gf) (#184)
• Bump golang.org/x/sys to v0.45.0 in gen-seccomp-profile, clearing a .trivyignore entry for a Windows-only CVE that no longer applies (#177)
• Bump the setup test fixture's express to v5.2.1, clearing qs/path-to-regexp vulnerabilities from its package-lock.json (#178)
• Bump pnpm to v11.10.0 (#174)
• Bump golang:1.25-alpine Docker digest to 56961d7 (#138)
• Bump self-referential dash14/buildcage action pin to v2.2.3 (#173)

Full Changelog: v2.2.3...v2.2.4