Skip to main content

Connect your organization to the Bullfrog platform

Install the Bullfrog GitHub App on an organization, point a workflow at the control plane, and watch its connection results arrive.

Before you begin​

  • Owner access to the GitHub organization you want to connect. Installing a GitHub App requires it.
  • A repository in that organization with a workflow running on ubuntu-latest
  • Bullfrog GitHub Action v0.11.0

Step 1: Sign in​

Open app.bullfrogsec.com and select Continue with GitHub. Authorize the OAuth request. Bullfrog reads your profile, your email, and your organization memberships.

Step 2: Install the GitHub App​

You land on the organization picker, which lists your personal account and every organization you belong to. Each card shows whether the app is already installed.

Select the organization you want to connect. GitHub's installation screen opens.

Choose which repositories the app can access. Select All repositories, or Only select repositories and pick them. This choice lives on GitHub: there's no repository picker inside Bullfrog, and you change it later from the same GitHub screen.

Select Install. GitHub returns you to Bullfrog's confirmation page.

Step 3: Create an API token​

The action needs a token to submit its results.

  1. In the left navigation, select Settings, then the API Tokens tab.
  2. Enter a name. Use letters, numbers, hyphens, and underscores only.
  3. Select Create.

The token appears once, in a modal. Copy it now: you can't display it again.

Step 4: Store the token as an Actions secret​

In GitHub, open your organization's Settings, then Secrets and variables → Actions, and select New organization secret.

Name it BULLFROG_API_KEY, paste the token as the value, and choose which repositories can read it.

An organization secret means one token serves every repository. A repository secret works too, under Settings → Secrets and variables → Actions in that repository.

Step 5: Pass the token to the action​

Add api-token to the Bullfrog step in your workflow:

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: bullfrogsec/bullfrog@7dee337d4575320b6d8cbe9a56d48d2fb765963a # v0.11.1
        with:
          egress-policy: audit
          api-token: ${{ secrets.BULLFROG_API_KEY }}

      - uses: actions/checkout@v4
      - run: npm ci

Commit and push.

Step 6: Find the run in Bullfrog​

Wait for the job to finish, then return to Bullfrog and select Workflow Runs. Your run appears in the table with its repository, workflow, branch, and a count of authorized and unauthorized connections.

Select the row to open the run and see every connection the job made, grouped by job.

The job summary in GitHub now carries a View detailed results link back to this page.

What you accomplished​

Every job in your organization that carries api-token now reports to one place, and you can see the network behavior of your workflows without opening each run in GitHub.

Next, decide centrally what those jobs are allowed to reach: Enforce an egress policy across your organization.