# Egress CI documentation for the early-access beta

> Documentation for OpenWAF Egress CI, a GitHub Action that limits a CI job's outbound traffic to an allowlist, checks it for secrets and can send its events to OpenWAF.

[Egress CI](https://developers.openwaf.dev/egress/ci/quickstart/) is in early-access beta: a GitHub Action, `openwaf-dev/egress-action`, that puts the outbound traffic of a job and of its containers behind an allowlist in `.github/egress.yml`. Connections and DNS queries are named and logged, what is outside the policy is reported (`audit`) or refused (`enforce`), what leaves is checked for secrets with the [OpenWAF Egress](https://developers.openwaf.dev/egress/) detectors, and the job summary lists every destination.

The new pages cover the [quickstart](https://developers.openwaf.dev/egress/ci/quickstart/), the [egress.yml reference](https://developers.openwaf.dev/egress/ci/reference/), going [from audit to enforce](https://developers.openwaf.dev/egress/ci/audit-to-enforce/), [Docker and builds](https://developers.openwaf.dev/egress/ci/docker/), [inspection and DLP](https://developers.openwaf.dev/egress/ci/inspect-and-dlp/), [self-hosted runners](https://developers.openwaf.dev/egress/ci/self-hosted-runners/), [sending events to OpenWAF](https://developers.openwaf.dev/egress/ci/send-events/) with GitHub OIDC, the [limits](https://developers.openwaf.dev/egress/ci/limits/) and an [FAQ](https://developers.openwaf.dev/egress/ci/faq/).

To join the beta, write to support@openwaf.dev.