| mode | Enforcement mode: "enforce" (block connections) or "audit" (log only, no blocking) | no | enforce |
| allowed-hosts | Allowed hostnames, one per line (auto matches subdomains example.com would also match api.example.com) | no | — |
| allowed-cidrs | Allowed CIDR blocks, one per line | no | — |
| search-domains | DNS search-domain suffixes to strip before hostname-rule matching and bypass for unmatched DNS queries (e.g. .compute.internal), one per line. Each suffix needs at least two labels and cannot be a public suffix. | no | — |
| github-service-hosts | GitHub service hostnames to auto-allow on port 443 (one per line) | no | github.com
api.github.com
githubapp.com
actions.githubusercontent.com
release-assets.githubusercontent.com
avatars.githubusercontent.com
github.githubassets.com
|
| azure-infra-hosts | Azure infrastructure hostnames to auto-allow on port 443 (one per line) | no | trafficmanager.net
blob.core.windows.net
|
| config-file | Path to YAML/JSON config file for advanced rules | no | — |
| fail-on-unsupported | Fail the workflow if eBPF is not supported (vs warn and continue) | — | false |
| sudo-lockdown | Enable sudo lockdown to prevent firewall bypass | — | false |
| sudo-allow-commands | Command paths to allow via sudo when lockdown is enabled, one per line (e.g. /usr/bin/apt-get) | — | "" |
| dns-upstream | Upstream DNS server for forwarding queries (auto-detected from /etc/resolv.conf if not set) | — | "" |
| allow-existing-connections | Allow pre-existing TCP connections at startup (prevents blocking connections established before cargowall) | — | true |
| binary-path | Path to a pre-built cargowall binary (skips download, useful for CI testing) | no | — |
| debug | Enable debug logging | — | false |
| audit-summary | Generate audit summary in workflow summary (requires mode: audit or enforce) | — | true |
| skip-actions-api | Skip the GitHub Actions API call used to enrich audit-summary step names and job status. Falls back to local _diag data. Set to true on installations near the per-repo rate limit (1,000 req/hr). | — | false |
| github-token | GitHub token for fetching step timing in audit summary | — | ${{ github.token }} |
| api-url | CodeCargo API URL for audit upload and policy fetch (policy requires CodeCargo GitHub App installation). Requires permissions: id-token: write | no | https://app.codecargo.com |
| offline | Skip all CodeCargo API communication (audit upload and policy fetch) | — | false |
| job-id | The check run ID of the current job (populated from the workflow context by default; override if needed) | — | ${{ job.check_run_id }} |