resilience-cyber-security/Egress Guard

Whitelist outbound IPs for the remainder of a job and log blocked egress attempts.

Trust Signals

name	description	required	default
allowlist	Comma/space/newline separated hostnames or IPs/CIDRs to allow. Defaults to common package registries. To extend defaults, make the first entry "+default".	no	+default
mode	"enforce" to reject non-allowlisted egress, "training" to log and allow.	no	enforce
phase	"setup" to install rules, "report" to summarize logged destinations, "stop" to terminate refresh.	no	setup
refresh_interval_seconds	Seconds between allowlist refreshes (0 disables refresh loop).	no	300
github_meta_allowlist	When "true", include GitHub meta CIDRs in the allowlist.	no	false

no outputs