Egress policy fields

Fields on a policy created under Policies in the Bullfrog platform.

Scope fields

A policy applies to a job only when all three scope fields match. Matching is case-insensitive, and * matches any sequence of characters. Each field accepts letters, numbers, and the characters -, _, ., /, and *, up to 200 characters.

Repo

string | Required | No default

Matched against the repository name alone, without the owner. A policy already belongs to one organization, so web-app is the correct form and my-org/web-app matches nothing.

Workflow file

string | Required | No default

Matched against the workflow's file path, relative to the repository root, such as .github/workflows/release.yml.

Job

string | Required | No default

Matched against the job's id, meaning the key under jobs: in the workflow file. Not the job's name.

Settings

Name

string | Required | No default

A label for the policy, up to 200 characters. Shown in the policy list. Has no effect on matching.

Egress policy

string | Required | Default: Audit

What Bullfrog does with a connection to a destination the allowlists don't cover.

Possible values:

• Audit: Records every connection and allows all traffic.
• Block: Drops connections to destinations not in Allowed domains or Allowed IPs.

DNS policy

string | Required | Default: Allowed domains only

Which DNS queries the agent resolves. Takes effect only when Egress policy is Block, and the field is shown only in that mode.

Possible values:

• Allowed domains only: Resolves only the domains in Allowed domains.
• Any domain: Resolves any domain.

Sudo policy

string | Required | Default: Disable

Whether the job's steps may run commands with sudo. Takes effect only when Egress policy is Block, and the field is shown only in that mode.

Possible values:

• Disable: Withholds sudo, and filters the Docker API for requests equivalent to host root.
• Enable: Permits sudo.

Allowed domains

string | Optional | Default: empty

Domains the job may connect to, one per line. Blank lines are ignored. A leading *. matches any subdomain at any depth but not the apex domain.

Allowed IPs

string | Optional | Default: empty

IP addresses the job may connect to, one per line. Blank lines are ignored. Accepts IPv4, IPv6, and CIDR ranges.

Mode defaults

Changing Egress policy in the form resets the two dependent settings to that mode's defaults:

Egress policy	DNS policy	Sudo policy
Audit	Any domain	Enable
Block	Allowed domains only	Disable

Combination across matching policies

When several policies match one job, all of them apply. Bullfrog derives a single configuration:

Field	Combination
Allowed domains	Union of every matching policy's entries.
Allowed IPs	Union of every matching policy's entries.
Egress policy	Block if any match sets it, otherwise Audit.
DNS policy	Allowed domains only if any match sets it, otherwise Any domain.
Sudo policy	Disable if any match sets it, otherwise Enable.

Permissions

Role	View	Create, edit, delete
Admin	Yes	Yes
Member	Yes	No