[Issue]: Missing documentation for how to define policy

[jsoref]

Repository

https://github.com/check-spelling-sandbox/check-spelling/

Workflow run URL

https://github.com/check-spelling-sandbox/check-spelling/actions/runs/28179445065

Adoption path

Firewall enabled label for standard runners (ubuntu-24.04-firewall)

What happened?

I got a list of urls:

jq -r '.decision[].url' firewall-decisions-Check\ Spelling-83464733421.json|perl -pe 's<(\w+://[^/]+)/.*><$1>'|sort -u 
http://azure.archive.ubuntu.com:80
https://api.github.com
https://broker.actions.githubusercontent.com
https://github.com
https://launch.actions.githubusercontent.com
https://productionresultssa3.blob.core.windows.net
https://raw.githubusercontent.com
https://results-receiver.actions.githubusercontent.com
https://run-actions-3-azure-eastus.actions.githubusercontent.com

I'd like to write a policy.

What did you expect to happen?

I expected enough documentation for me to convert this domain list into a policy.

Steps to reproduce

1. Switch to `runs-on: ubuntu-24.04-firewall` -- see https://github.com/check-spelling-sandbox/check-spelling/actions/runs/28179445065/workflow#L83
2. Push
3. Visit https://github.com/check-spelling-sandbox/check-spelling/actions/runs/28179445065 (note that there's no anchor for `Artifacts` which is incredibly frustrating)
4. Download the [firewall-decisions-Check Spelling-83464733421](https://github.com/check-spelling-sandbox/check-spelling/actions/runs/28179445065/artifacts/7882192658) file
5. Expand it
6. Review it and decide that those protocol-domain pairs would be fine -- note that I'd want to be slightly more tolerant of things, so I expect to want to change `https://run-actions-3-azure-eastus.actions.githubusercontent.com` to `https://run-actions-*-azure-*.actions.githubusercontent.com` or `https://*.actions.githubusercontent.com` where `*` does not match `.`, and similarly change `https://productionresultssa3.blob.core.windows.net` to `https://productionresults*.blob.core.windows.net` or similar -- preferably with direct guidance for these domains since they're GitHub/Microsoft hosted and I'm not a GitHub/Microsoft Network Engineer.
7. Want to make changes to my workflow to allow only these adjusted protocol-domains, but I'm stuck wondering what I need to do

Additional context

https://github.com/github-early-access/actions-native-egress-firewall/blob/97f578e571ae989d9ebbc020ed7696f5893ab59e/README.md makes no reference to how to write a policy.

[steiza]

Hey @jsoref!

Yeah, so we were torn between getting audit mode out as fast as possible for the technical preview (which is what we ended up doing) or waiting until we had an enforcement mode as well (which we decided would not be part of the technical preview).

We are working on how to specify an enforcement policy, but we're still figuring out the details (and then have to implement it), so I don't currently have a timeline for you on when enforcement policy will be available. It's very likely that enforcement policy would be part of the public preview (after the technical preview we're currently in), but that also does not yet have a date at this time.