Fence 🛡️

A GitHub Action for hardening CI/CD pipelines with bounded egress filtering and runner lockdown.

Quick Start ⚡

Add Fence as the first step in a supported GitHub-hosted Linux job:

- uses: openai/fence@<commit-sha> # pin@vX.Y.Z

This starts Fence in block mode with an empty user allowlist on a GitHub-hosted x64 job using ubuntu-24.04 or ubuntu-latest. Replace <commit-sha> with the full action_commit value and vX.Y.Z with the tag from the same release; release notes provide the ready-to-copy line with a Dependabot-friendly # pin@vX.Y.Z comment. main is source-only and does not contain a runnable production bundle. Put Fence before checkout and any other steps you want it to constrain.

Read more: Getting started with Fence

Examples 🧪

Start with a complete job that activates Fence before checkout:

jobs:
  test:
    runs-on: ubuntu-24.04
    steps:
      - uses: openai/fence@<fence-commit-sha>
      - uses: actions/checkout@<checkout-commit-sha>
      - run: script/test

Run in audit mode first to see what would need review before enabling blocking:

- uses: openai/fence@<commit-sha>
  with:
    mode: audit

The audit summary suggests allowlist entries for observed hostnames and direct IPv4 or IPv6 destinations.

Allow GitHub artifact uploads, including GitHub Pages deployments and GitHub Actions caches, while keeping other network restrictions in place:

- uses: openai/fence@<commit-sha>
  with:
    allow_github_artifacts: true

This setting is off by default. It permits up to four exact GitHub-shaped results-storage accounts on HTTPS and makes artifact storage available to the job. Enable it only when the workflow needs artifacts: later steps may also use the permitted accounts to upload data. Fence does not allow all Azure Blob Storage.

Allow one or more HTTPS hostnames:

- uses: openai/fence@<commit-sha>
  with:
    allowlist: |
      api.example.com
      artifacts.example.com

Allow custom TCP, UDP, or CIDR destinations:

- uses: openai/fence@<commit-sha>
  with:
    allowlist: |
      registry.example.com:8443
      udp://dns.example.com:53
      cidr 192.0.2.0/24 udp 123
      cidr 2001:db8::/64 tcp 443

Keep Docker/container access available while still applying network restrictions and disabling passwordless sudo:

- uses: openai/fence@<commit-sha>
  with:
    container_policy: unsafe_preser