Egress CI is in early-access beta: a GitHub Action, openwaf-dev/egress-action, that puts the outbound traffic of a job and of its containers behind an allowlist in .github/egress.yml. Connections and DNS queries are named and logged, what is outside the policy is reported (audit) or refused (enforce), what leaves is checked for secrets with the OpenWAF Egress detectors, and the job summary lists every destination.
The new pages cover the quickstart, the egress.yml reference, going from audit to enforce, Docker and builds, inspection and DLP, self-hosted runners, sending events to OpenWAF with GitHub OIDC, the limits and an FAQ.
To join the beta, write to support@openwaf.dev.