{
  "slug": "doctl-firewall-rules-support-optional-action-f611339cdc1c",
  "title": "doctl firewall rules support optional action",
  "tools": [
    "doctl"
  ],
  "tags": [
    "agent"
  ],
  "introduced_at": "2026-09-18T11:27:24.000Z",
  "announced_at": "2026-09-18T11:27:24.000Z",
  "effective_at": null,
  "date_basis": "source-publication",
  "status": "unknown",
  "how": {
    "incantation": "When adding cloud firewall rules with doctl v1.169.0, include `action:allow` or `action:deny` in each rule string to set its action; omitted action defaults to allow.",
    "examples": [
      "doctl compute firewall add-rules <firewall-id> --inbound-rules \"protocol:tcp,ports:22,address:<source-CIDR>,action:deny\"",
      "doctl compute firewall add-rules <firewall-id> --outbound-rules \"protocol:tcp,ports:22,address:<destination-CIDR>,action:allow\""
    ],
    "gotchas": [
      "Version: v1.169.0",
      "<firewall-id> (required): Cloud firewall ID.",
      "--inbound-rules: Comma-separated rule keys; needs protocol, ports, and source location. Optional `action` accepts `allow` or `deny`; omitted defaults to allow. Supported source keys: address, droplet_id, load_balancer_uid, kubernetes_id, tag.",
      "--outbound-rules: Comma-separated rule keys; needs protocol, ports, and destination location. Optional `action` accepts `allow` or `deny`; omitted defaults to allow. Supported destination keys: address, droplet_id, load_balancer_uid, kubernetes_id, tag.",
      "action: Rule action: `allow` or `deny`. These are allowed values for the same key, not mutually exclusive fields.",
      "Prerequisite: Install doctl, create a DigitalOcean personal access token, then authorize doctl with `doctl auth init`.",
      "The action field is optional and defaults to allow on the API side.",
      "Existing commands and scripts that omit action continue to work unchanged.",
      "Docs conflict: A current DigitalOcean configure-rules page says doctl does not support `action` and recommends using the API for deny rules, conflicting with the v1.169.0 release note and the current add-rules CLI reference. That page does not establish behavior at v1.169.0; follow the version-specific release note."
    ]
  },
  "why_it_matters": "Add inbound or outbound cloud firewall rules with an explicit allow or deny action.",
  "before": "Create rules without an explicit action, which use the API’s default-allow behavior.",
  "sources": [
    "https://github.com/digitalocean/doctl/releases/tag/v1.169.0",
    "https://github.com/digitalocean/doctl/pull/1963",
    "https://docs.digitalocean.com/reference/doctl/reference/compute/firewall/add-rules/",
    "https://docs.digitalocean.com/products/networking/firewalls/how-to/configure-rules/"
  ],
  "rank": 0.97029,
  "judge": {
    "publish": true,
    "judge_model": "codex-cli/gpt-6-luna+typesafe/jev-1.13.0",
    "prompt_version": "extract-v7+enrich-v2+judge-v2x3+jev-publish-v1"
  },
  "review_state": "approved",
  "provenance": {
    "run_id": "wave2a-20261017",
    "verdict_id": "wave2a-20261017:wave2a-20261017-a3194a0e801720f4-1:gate",
    "evidence_hash": "82e7a841521442f6bbc5e6528f6298f5b51b5f9859056335e20928d351caadad"
  },
  "review": {
    "draft_hash": "08baa1a6b0a38894c4e6a81136aa0ef8245af167e4d4b5b446c07913bff5e6e7",
    "reviewer": "publication-gate",
    "reviewed_at": "2026-10-07T00:00:00.000Z",
    "decision": "wave2a-20261017:gate",
    "reason": "3 of 3 judge runs approved with p_yes >= 0.9 (mean 0.97 >= 0.9; 2 needed) and Jev gave 0.75 (>= 0.6 needed)."
  }
}