Skip to main content

Troubleshooting

This guide helps you resolve common issues when using Bullfrog in your GitHub Actions workflows.

Reviewing Blocked Connections​

When connections are blocked or logged, you can view them in the workflow summary.

How to Access the Workflow Summary​

  1. Navigate to your workflow run in GitHub Actions
  2. Select the Summary section
  3. Look for the Bullfrog Results in each job summary

What You'll See​

The summary includes:

  • Allowed Connections: Connections that matched your allow list
  • Blocked Connections: Connections that were blocked (in block mode)
  • Unauthorized Connections: Connections that would be blocked (in audit mode)

Each entry shows:

  • Timestamp
  • Destination IP address and port
  • Domain name (if available)
  • Protocol (TCP/UDP/DNS)
  • Decision
  • Reason for the decision
  • Process metadata (executable path, command arguments)

Issue: Wildcard Not Working​

Symptoms:

  • Added *.example.com but example.com still blocked
  • Subdomains still being blocked

Causes:

  • Wildcards don't match the base domain
  • Incorrect wildcard syntax

Solutions:

Add both base domain and wildcard:

allowed-domains: |
  example.com       # Base domain
  *.example.com     # Subdomains

Issue: Bullfrog Not Running​

Symptoms:

  • The bullfrog step is failing with an error
  • No Bullfrog output in logs
  • Connections not being monitored

Causes:

  • Bullfrog not added as first step
  • Using unsupported runner (Windows/macOS)
  • Using container job

Solutions:

  1. Ensure Bullfrog is first step:
steps:
  - uses: bullfrogsec/bullfrog@c8e5fff94e0050c0cef9b9596c55cf3d9c53ba2c # v0.9.2
  - uses: actions/checkout@v4 # Other steps after
  1. Verify runner OS:
runs-on: ubuntu-latest # ✅ Supported
# runs-on: windows-latest  # ❌ Not supported
  1. Check you're not using container jobs:
jobs:
  build:
    runs-on: ubuntu-latest
    # container: node:18  # ❌ Remove this

Community Support​

Next Steps​