main.yml

name: Cloudflare Gateway DNS Filter (Block + Allow)

on:
  push:
  # schedule:
  #   - cron: "0 0 * * 5"   # Every Friday midnight UTC
  workflow_dispatch:

jobs:
  run:
    name: Sync Block & Allow Lists
    permissions: write-all
    runs-on: ubuntu-latest
    timeout-minutes: 30

    env:
      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      CF_API_TOKEN: ${{ secrets.CF_API_TOKEN }}
      CF_IDENTIFIER: ${{ secrets.CF_IDENTIFIER }}
      # Block sources
      ADLIST_URLS: ${{ vars.ADLIST_URLS }}
      DYNAMIC_BLACKLIST: ${{ vars.DYNAMIC_BLACKLIST }}
      # Allow sources
      WHITELIST_URLS: ${{ vars.WHITELIST_URLS }}
      DYNAMIC_WHITELIST: ${{ vars.DYNAMIC_WHITELIST }}

    steps:
      - name: Checkout Repository
        uses: actions/checkout@main
        with:
          fetch-depth: 0

      - name: Install Python
        uses: actions/setup-python@main
        with:
          python-version: "3.11"

      - name: Cache Cloudflare state
        id: cache-cloudflare
        uses: actions/cache@main
        with:
          path: cloudflare_cache.json
          key: ${{ runner.os }}-cloudflare-cache-${{ github.run_id }}
          restore-keys: |
            ${{ runner.os }}-cloudflare-cache-

      - name: Run — Sync Block & Allow to Cloudflare Gateway
        run: python -m src run