ironsh/Iron Proxy
Enforce default-deny egress in GitHub Actions. Block unexpected outbound requests and audit all traffic.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Activelast commit Jun 3, 2026
- License
- MIT
Pinned Snippet
uses: ironsh/iron-proxy-action@fa1fd82ec32396d044deba7040a6db576bec927a # v0.1.4tags can be moved; commit SHAs can't. why a SHA?
Inputs
| name | description | required | default |
|---|---|---|---|
| version | Version of Iron Proxy to install | no | 0.16.0 |
| egress-rules | Path to the egress rules file | no | egress-rules.yaml |
| disable-sudo | Remove sudo access for the runner user to prevent subsequent steps from bypassing the proxy | no | true |
| upstream-resolver | Upstream DNS resolver address | no | 8.8.8.8:53 |
| disable-docker | Remove the runner user from the docker group to prevent subsequent steps from bypassing the proxy | no | true |
| warn | Log denied requests but do not block them | no | false |
| tls-mode | TLS handling mode: "mitm" terminates TLS with an ephemeral CA so requests can be inspected by method, path, and body; "sni-only" inspects only the ClientHello SNI hostname and needs no custom CA | no | mitm |
| otel-env | Newline-separated KEY=VALUE pairs of OpenTelemetry environment variables (e.g. OTEL_EXPORTER_OTLP_ENDPOINT) passed to the iron-proxy process to enable telemetry export. See https://docs.iron.sh/guides/otel-export | no | "" |
Outputs
no outputs