{"id":20594513,"url":"https://github.com/xiaotianxt/bypass-cloudflare-for-github-action","last_synced_at":"2026-02-26T02:01:57.779Z","repository":{"id":249160950,"uuid":"830637187","full_name":"xiaotianxt/bypass-cloudflare-for-github-action","owner":"xiaotianxt","description":"Automatically add the public IP of the GitHub Action runner to Cloudflare's firewall IP Access rules.","archived":false,"fork":false,"pushed_at":"2025-11-08T01:30:16.000Z","size":25,"stargazers_count":28,"open_issues_count":0,"forks_count":4,"subscribers_count":1,"default_branch":"main","last_synced_at":"2025-11-08T03:27:43.836Z","etag":null,"topics":["cloudflare","firewall","github-actions"],"latest_commit_sha":null,"homepage":"","language":null,"has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/xiaotianxt.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2024-07-18T16:56:52.000Z","updated_at":"2025-11-08T01:30:20.000Z","dependencies_parsed_at":"2024-07-18T22:30:54.603Z","dependency_job_id":"827d8309-a587-470b-b48b-507b1e978f09","html_url":"https://github.com/xiaotianxt/bypass-cloudflare-for-github-action","commit_stats":null,"previous_names":["xiaotianxt/bypass-cloudflare-for-github-action"],"tags_count":4,"template":false,"template_full_name":null,"purl":"pkg:github/xiaotianxt/bypass-cloudflare-for-github-action","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/xiaotianxt%2Fbypass-cloudflare-for-github-action","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/xiaotianxt%2Fbypass-cloudflare-for-github-action/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/xiaotianxt%2Fbypass-cloudflare-for-github-action/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/xiaotianxt%2Fbypass-cloudflare-for-github-action/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/xiaotianxt","download_url":"https://codeload.github.com/xiaotianxt/bypass-cloudflare-for-github-action/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/xiaotianxt%2Fbypass-cloudflare-for-github-action/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":29848633,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-02-25T22:37:40.667Z","status":"online","status_checked_at":"2026-02-26T02:00:06.774Z","response_time":89,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["cloudflare","firewall","github-actions"],"created_at":"2024-11-16T08:09:16.131Z","updated_at":"2026-02-26T02:01:57.773Z","avatar_url":"https://github.com/xiaotianxt.png","language":null,"funding_links":[],"categories":[],"sub_categories":[],"readme":"\u003ch1 align='center'\u003e\n\u003csamp\u003eBypass Cloudflare for GitHub Action\u003c/samp\u003e\n\u003c/h1\u003e\n\u003cp align='center'\u003e\n  \u003csamp\u003eNever receive 403 Forbidden from Cloudflare again.\u003c/samp\u003e\n\u003c/p\u003e\n\n\u003e [!NOTE]\n\u003e Version `v2.0.0` addresses Cloudflare API changes affecting Free plan users. It includes breaking changes, such as updated API token permissions. If you are on a paid Cloudflare plan and the old workflow still works for you, continue using `v1.1.1`.\n\nRequests from GitHub Action servers to a Cloudflare proxied host may be blocked by [Cloudflare's Web Application Firewall(WAF)](https://developers.cloudflare.com/support/troubleshooting/http-status-codes/4xx-client-error/) or [Bot Fight Mode](https://developers.cloudflare.com/bots/get-started/free/).\nThis action automatically manages IP whitelisting by creating a Cloudflare custom IP list and WAF rule to bypass Cloudflare protections for GitHub Actions runners.\n\n## Features\n- Automatically retrieves the public IP of the GitHub Action runner.\n- Checks if a Cloudflare custom IP list exists, creating it if needed.\n- Creates a custom WAF rule to bypass Cloudflare protections for IPs in the list (only on first setup).\n- Adds the runner's IP to the Cloudflare IP list.\n- Automatically cleans up by removing the IP from the list after the job completes.\n\n## Inputs\n| Input                    | Description                                                                                      | Required | Default |\n| ------------------------ | ------------------------------------------------------------------------------------------------ | -------- | ------- |\n| `cf_account_id`          | Cloudflare Account ID                                                                            | true     |         |\n| `cf_zone_id`             | Cloudflare Zone ID                                                                               | true     |         |\n| `cf_api_token`           | Cloudflare API Token                                                                             | true     |         |\n| `disable_bot_fight_mode` | Disable Bot Fight Mode during workflow execution (requires Zone Settings \u003e Edit permission)      | false    | `false` |\n| `bfm_propagation_delay`  | Seconds to wait after disabling Bot Fight Mode for settings to propagate                         | false    | `10`     |\n\n## Usage\nTo use this action, create a workflow in your repository's `.github/workflows` directory. Below is an example workflow file:\n\n```yaml\nname: Bypass Cloudflare for API Access\non: [push]\njobs:\n  manage-ip-whitelist:\n    runs-on: ubuntu-latest\n    steps:\n      - name: Checkout repository\n        uses: actions/checkout@v5\n      - name: Bypass Cloudflare for GitHub Action\n        uses: xiaotianxt/bypass-cloudflare-for-github-action@v2.1.0\n        with:\n          cf_account_id: ${{ secrets.CF_ACCOUNT_ID }}\n          cf_zone_id: ${{ secrets.CF_ZONE_ID }}\n          cf_api_token: ${{ secrets.CF_API_TOKEN }}\n      - name: Send request to Cloudflare-protected server\n        run: curl https://example.com/api\n```\n\n### With Bot Fight Mode Bypass\n\nIf you have [Super Bot Fight Mode (SBFM) or Bot Fight Mode (BFM)](https://developers.cloudflare.com/bots/get-started/super-bot-fight-mode/) enabled, WAF rules alone may not be sufficient as these modes [do not respect WAF skip rules](https://developers.cloudflare.com/bots/get-started/super-bot-fight-mode/). Use the `disable_bot_fight_mode` option to temporarily disable BFM during your workflow:\n\n```yaml\nname: Bypass Cloudflare with BFM Disabled\non: [push]\njobs:\n  manage-ip-whitelist:\n    runs-on: ubuntu-latest\n    steps:\n      - name: Checkout repository\n        uses: actions/checkout@v5\n      - name: Bypass Cloudflare for GitHub Action\n        uses: xiaotianxt/bypass-cloudflare-for-github-action@v2.1.0\n        with:\n          cf_account_id: ${{ secrets.CF_ACCOUNT_ID }}\n          cf_zone_id: ${{ secrets.CF_ZONE_ID }}\n          cf_api_token: ${{ secrets.CF_API_TOKEN }}\n          disable_bot_fight_mode: 'true'\n      - name: Send request to Cloudflare-protected server\n        run: curl https://example.com/api\n```\n\n\u003e [!NOTE]\n\u003e The `disable_bot_fight_mode` option requires **Zone Settings \u003e Edit** permission on your API token. The original BFM state is automatically restored after the job completes.\n\n## Set Repo Secrets\nRemember to add your Cloudflare Account ID, Zone ID, and API Token to your GitHub repository \u003e Secrets and Variables \u003e Actions as `CF_ACCOUNT_ID`, `CF_ZONE_ID`, and `CF_API_TOKEN` respectively.\n\nThis Action requires a Cloudflare API Token, not the Global API Key. To create an API token:\n\n1. Log in to the Cloudflare dashboard and click into an account.\n2. On the right sidebar, go to \"API\" \u003e \"Get your API token\".\n3. Click \"Account API Tokens\" \u003e \"Create Token\" \u003e \"Create Custom Token\".\n4. Create a custom token with the following permissions:\n   - **Account** \u003e **Account Filter Lists** \u003e **Edit** (required for IP list management)\n   - **Zone** \u003e **Zone WAF** \u003e **Edit** (required for custom WAF rules)\n   - **Zone** \u003e **Zone Settings** \u003e **Edit** (required only if using `disable_bot_fight_mode`)\n5. Set the token to access the zone you're working with.\n6. Create the token and save it securely.\n\n\u003e [!IMPORTANT]\n\u003e The first time this workflow runs, the Custom WAF Rule is created. After the first run, you can remove the `Zone WAF \u003e Edit` permission from the API token.\n\n## Limitations\n\n- Cloudflare Free plan allows only **one custom IP list** per zone. If you already use a custom list, this action cannot create an additional one. [Learn more](https://developers.cloudflare.com/waf/tools/lists/#limits).\n- Cloudflare Free plan allows only **five custom WAF rules** per zone. If you are already at the quota, the initial setup step that creates the bypass rule will fail. [Learn more](https://developers.cloudflare.com/waf/custom-rules/limits/).\n\n## How It Works\n\n1. **First Run (Setup)**: \n   - Checks if the IP list `bypass_cloudflare_for_github_action_list` exists\n   - If not found, creates the IP list and a custom WAF rule that skips Cloudflare protections for IPs in the list\n   - Adds the runner's IP to the list\n\n2. **Subsequent Runs**:\n   - Reuses the existing IP list\n   - Adds the runner's IP to the list\n\n3. **Cleanup**:\n   - After the job completes (success or failure), automatically removes the runner's IP from the list\n   - If `disable_bot_fight_mode` was enabled, restores the original Bot Fight Mode settings\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fxiaotianxt%2Fbypass-cloudflare-for-github-action","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fxiaotianxt%2Fbypass-cloudflare-for-github-action","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fxiaotianxt%2Fbypass-cloudflare-for-github-action/lists"}