nx1x/Cloudflare WARP Setup
Headless Cloudflare WARP enrollment for GitHub Actions runners. Full network access via your Zero Trust org.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
Inputs
| name | description | required | default |
|---|---|---|---|
| organization | Cloudflare Zero Trust organization/team name (the subdomain in https://<team>.cloudflareaccess.com) | yes | — |
| auth-client-id | Cloudflare Access service token Client ID (used for headless device enrollment) | yes | — |
| auth-client-secret | Cloudflare Access service token Client Secret (used for headless device enrollment) | yes | — |
| mode | WARP connection mode: "warp" (full tunnel), "proxy" (local SOCKS5/HTTP proxy), "doh" (DNS-only), or "warp+doh" | no | warp |
| exclude-routes | CIDR ranges to exclude from the WARP tunnel (split-tunnel exclude mode, one per line). Example: "192.168.0.0/16" | no | "" |
| include-routes | CIDR ranges to include in the WARP tunnel (split-tunnel include-only mode, one per line). When set, ONLY these ranges are routed through WARP. | no | "" |
| test-connection | Verify WARP is connected after setup | no | true |
| test-host | Internal hostname or IP to ping for connection verification (optional, only used when test-connection is true) | no | "" |
| retry-count | Number of attempts when waiting for connection / pinging the test host | no | 3 |
| retry-delay | Seconds to wait between retry attempts | no | 5 |
Outputs
| name | description |
|---|---|
| warp-version | Installed cloudflare-warp client version (e.g. "2024.6.415") |
| connection-status | Final WARP connection status: "connected", "failed", or "skipped" |
| warp-ip | The runner's WARP tunnel IPv4 address on the CloudflareWARP interface (empty if interface unavailable) |