g0lab/g0efilter
Filter egress traffic from GitHub Actions runners. Non-allowlisted connections are blocked, or logged in audit mode, using nftables and TLS SNI / HTTP Host inspection. A summary of decisions is added to the job summary.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
Inputs
| name | description | required | default |
|---|---|---|---|
| allowed-domains | Newline-separated domains to allow. Supports wildcards (*.example.com) and regex patterns (/^cache-[0-9]+\.example\.com$/). Required GitHub Actions infrastructure is always allowed so the workflow can run. | no | "" |
| allowed-ips | Newline-separated IPs/CIDRs to allow. The runner's DNS resolvers are always allowed. | no | "" |
| egress-policy | Egress policy to apply. Use `block` to enforce, or `audit` to log would-be-blocked traffic without blocking it. | no | block |
| mode | Filtering mode. Use `https` for TLS SNI / HTTP Host inspection, `dns` for resolution filtering, or `dns-strict` to also drop connections to IPs never resolved through the proxy (and not IP-allowlisted). | no | https |
| log-level | g0efilter log level: `TRACE`, `DEBUG`, `INFO`, `WARN`, or `ERROR`. | no | INFO |
| lockdown-runner | GitHub-hosted runners only. After the filter starts, disable later passwordless sudo and restrict the Docker socket so subsequent steps cannot remove the hardening, and skip teardown. Unsafe on self-hosted runners: leftover nftables rules persist and can break later jobs. | no | false |
| image | g0efilter container image to run. Defaults to the image matching the action's release tag, for example `uses: g0lab/g0efilter@v0.6.0` runs `g0efilter:v0.6.0`. When referenced from a branch, defaults to `g0efilter:latest`. | no | "" |
Outputs
no outputs