Skip to main content

Release notes

What changed in each version of the Bullfrog GitHub Action, newest first. The action follows semantic versioning, but is still on major version 0: a minor version can contain a breaking change, called out where it does, and a patch version fixes a bug.

v0.11.1​

Fixed:

  • docker cp and docker exec are no longer refused for every container while enable-sudo: false.
  • DNS over TCP is now judged on every message a segment carries, not only the first, closing a data exfiltration channel via pipelined DNS queries.

v0.11.0​

warning

Breaking change: With enable-sudo: false, Bullfrog now refuses Docker requests that would hand a container control of the host, such as --privileged or a bind mount of a host path. A container that relied on one of these to run before v0.11.0 now fails instead. See Docker access is root for the full list of what's refused and how to work around it.

Added: Egress policies configured in the control plane can now override what a workflow file sets. See How policies reach a job.

Fixed:

  • The agent now allow-lists IPv6 (AAAA) addresses for allowed domains.
  • The agent filters container IPv6 egress.
  • The agent resets denied connections instead of dropping them silently.

v0.10.0​

Added: Support for ARM architecture and slim runners.

v0.9.3​

Fixed: The link to the control plane now redirects to the correct run attempt.

v0.9.2​

Fixed: An untrusted DNS server was blocked even in audit mode, and a custom DNS server couldn't be added.

v0.9.1​

Fixed: Docker info was sometimes missing due to a race condition.

v0.9.0​

warning

Breaking change: Default allowed domains have been restricted. Previously, github.com, api.github.com, and *.blob.core.windows.net were allowed by default. As of v0.9.0, these domains are no longer implicitly allowed. If your workflows depend on them, allowlist them explicitly with allowed-domains before upgrading.

Added:

  • Connection results are published to the Bullfrog platform.
  • The agent no longer depends on Tetragon, along with other reliability improvements.
  • The action runs on Node.js 24.

v0.8.4​

Fixed: DNS over TCP no longer bypasses domain filtering.

v0.8.3​

Fixed: The agent now starts correctly in private repositories.

v0.8.2​

Fixed: The agent flushes its DNS cache during initialization.

v0.8.1​

Fixed:

  • Connections made before the agent is ready are blocked again.
  • The agent supports the SRV DNS query type.

v0.8.0​

Added: The action verifies the agent's checksum before running it.

v0.7.0​

Added: The enable-sudo input.

v0.6.2​

Fixed: Connections made before the agent is ready are blocked.

v0.6.1​

Fixed:

  • File descriptors are closed correctly.
  • The Tetragon integration was simplified.

v0.6.0​

Changed: Internal inputs are now prefixed with an underscore to distinguish them from public inputs.

v0.5.5​

Fixed:

  • DNS server filtering moved from nftables into the agent.
  • Only a trusted local DNS server is allowed.

v0.5.4​

Fixed: The Tetragon SHA256 checksum is verified.

v0.5.3​

Fixed: A pre-release step was added to the release workflow.

v0.5.2​

Fixed: The agent binary is chmoded with sudo.

v0.5.1​

Fixed:

  • Fixed a problem with agent installation.
  • Annotations are grouped to avoid hitting GitHub's limit.

v0.5.0​

Added: The agent is fetched from a release, and the action reliably waits for it to be ready.

v0.4.1​

Fixed:

  • DNS is allowed during the build step.
  • Domains from a CNAME record are allowed dynamically, and the action waits on the agent.