CargoWall GitHub Action

The official GitHub Action for CargoWall — an eBPF-based network firewall for GitHub Actions runners that monitors and controls outbound connections during CI/CD runs.

Secure your GitHub Actions workflows with eBPF-based network egress filtering. Prevent supply chain attacks, block data exfiltration, and control outbound connections at the kernel level.

For concepts, architecture, and platform capabilities, see the main CargoWall repository.

Features

• eBPF-based filtering: Uses kernel-level filtering for high performance and reliability
• Hostname filtering: Allow/deny based on domain names
  • Subdomains are automatically allowed (i.e. example.com would also allow api.example.com), with */** wildcards when you need tighter control — see How Hostnames Match
  • CNAME chains of allowed hosts are followed transparently — if an allowed host resolves through a moving CDN edge, the chain’s target names and IPs are allowed automatically, so you don’t have to wildcard churning CDN targets
• CIDR filtering: Allow/deny based on…