codegeneai/Cloudflare Tunnel

Run a cloudflared connector on a GitHub Actions runner. Supports attaching to an existing tunnel via token, or creating an ephemeral named tunnel via the Cloudflare API.

View on GitHub

Trust Signals

Scorecard Score: not yet scored
Maintenance Recency: Activelast commit May 12, 2026
License: MIT

Pinned Snippet

workflow.ymlSHA-pinned

uses: codegeneai/cloudflare-tunnel-action@591b8c3e059b2e33950f9f588c82ac5e0bab8646 # v1.0.0

tags can be moved; commit SHAs can't. why a SHA?

Inputs

name	description	required	default
mode	"connect" (use existing tunnel-token) or "create" (create ephemeral tunnel via API).	no	connect
tunnel-token	Connector token for an existing tunnel. Required when mode=connect.	no	—
api-token	Cloudflare API token with Account: Cloudflare Tunnel: Edit scope. Required when mode=create.	no	—
account-id	Cloudflare account ID. Required when mode=create.	no	—
tunnel-name	Name for the ephemeral tunnel. Required when mode=create.	no	—
cleanup-on-exit	When mode=create, delete the tunnel in the post-step.	no	true
cloudflared-version	cloudflared release tag (e.g. "2026.3.0") or "latest". Pinned by default for reproducibility; use "latest" to opt into the newest release on every run.	no	2026.3.0
loglevel	cloudflared --loglevel (debug\|info\|warn\|error\|fatal).	no	info
metrics	Bind address for cloudflared --metrics. localhost:0 picks a free port.	no	localhost:0
wait-for-connections	Block until the connector reports at least one healthy edge connection.	no	true
wait-timeout-seconds	Maximum seconds to wait for a healthy connection.	no	60

Outputs

name	description
tunnel-id	The Cloudflare tunnel ID (UUID). Always set in mode=create; best-effort decode from the token in mode=connect (may be empty for opaque tokens).
tunnel-cname	The tunnel CNAME target: {tunnel-id}.cfargotunnel.com. Empty when tunnel-id is unknown.
metrics-url	Resolved cloudflared metrics URL (e.g. http://127.0.0.1:NNN). Useful for downstream `/ready` probes.