Skip to main content

Get started with the Bullfrog GitHub Action

Add Bullfrog to a job in audit mode, run it, and read the list of outbound connections it recorded.

Before you begin​

  • A GitHub repository you can push to
  • A workflow that runs on ubuntu-latest, or permission to add one
  • Bullfrog GitHub Action v0.11.0

Step 1: Add the action to a job​

Create .github/workflows/bullfrog-demo.yml with this content. Bullfrog is the first step, before actions/checkout:

name: Bullfrog demo

on: push

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: bullfrogsec/bullfrog@7dee337d4575320b6d8cbe9a56d48d2fb765963a # v0.11.1

      - uses: actions/checkout@v4

      - name: Fetch a page
        run: curl -sS https://example.com > /dev/null

You didn't set egress-policy, so the job runs in audit mode. Bullfrog records connections and blocks nothing.

Step 2: Run the workflow​

Commit and push the file:

git add .github/workflows/bullfrog-demo.yml
git commit -m "Add Bullfrog in audit mode"
git push

The push triggers the workflow. Open the Actions tab of your repository and wait for the build job to finish. It succeeds: nothing is blocked in audit mode.

Step 3: Read the connections Bullfrog recorded​

Open the workflow run and select Summary. Below the job list you'll find the Bullfrog results for the build job, one row per connection, including the request to example.com your curl step made.

Each row names the destination, the port, the protocol, and the decision Bullfrog took. For what the other columns mean, see Review connections in a job summary.

What you accomplished​

You ran a job under Bullfrog and got a complete list of the destinations it reached. That list is the input to an allowlist.

Next, turn it into an enforced one: Switch a job to block mode.