From 2b5d015e09e66a17e4bf882fb4de5097307b4c17 Mon Sep 17 00:00:00 2001 From: Pepe Fagoaga Date: Fri, 27 Mar 2026 12:53:52 +0000 Subject: [PATCH] feat(security): add missing endpoints to allowlist (#10495) Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> --- .github/workflows/api-codeql.yml | 3 ++- .../workflows/api-container-build-push.yml | 23 ++++++++++--------- .github/workflows/api-container-checks.yml | 2 +- .github/workflows/sdk-codeql.yml | 1 + .github/workflows/sdk-container-checks.yml | 1 + .github/workflows/sdk-tests.yml | 19 +++++++++++++++ .github/workflows/ui-codeql.yml | 1 + .github/workflows/ui-container-checks.yml | 1 + 8 files changed, 38 insertions(+), 13 deletions(-) diff --git a/.github/workflows/api-codeql.yml b/.github/workflows/api-codeql.yml index 6578f7d90a..f424361fef 100644 --- a/.github/workflows/api-codeql.yml +++ b/.github/workflows/api-codeql.yml @@ -46,8 +46,9 @@ jobs: with: egress-policy: block allowed-endpoints: > - github.com:443 api.github.com:443 + github.com:443 + release-assets.githubusercontent.com:443 uploads.github.com:443 - name: Checkout repository diff --git a/.github/workflows/api-container-build-push.yml b/.github/workflows/api-container-build-push.yml index 7b97e386a9..7d38a4b4df 100644 --- a/.github/workflows/api-container-build-push.yml +++ b/.github/workflows/api-container-build-push.yml @@ -110,19 +110,20 @@ jobs: with: egress-policy: block allowed-endpoints: > - github.com:443 - registry-1.docker.io:443 - auth.docker.io:443 - production.cloudflare.docker.com:443 - debian.map.fastlydns.net:80 - release-assets.githubusercontent.com:443 - pypi.org:443 - files.pythonhosted.org:443 - www.powershellgallery.com:443 - aka.ms:443 - cdn.powershellgallery.com:443 _http._tcp.deb.debian.org:443 + aka.ms:443 + auth.docker.io:443 + cdn.powershellgallery.com:443 + dc.services.visualstudio.com:443 + debian.map.fastlydns.net:80 + files.pythonhosted.org:443 + github.com:443 powershellinfraartifacts-gkhedzdeaghdezhr.z01.azurefd.net:443 + production.cloudflare.docker.com:443 + pypi.org:443 + registry-1.docker.io:443 + release-assets.githubusercontent.com:443 + www.powershellgallery.com:443 - name: Checkout repository uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 diff --git a/.github/workflows/api-container-checks.yml b/.github/workflows/api-container-checks.yml index ec130663d6..2fa197162d 100644 --- a/.github/workflows/api-container-checks.yml +++ b/.github/workflows/api-container-checks.yml @@ -93,7 +93,7 @@ jobs: cdn.powershellgallery.com:443 _http._tcp.deb.debian.org:443 powershellinfraartifacts-gkhedzdeaghdezhr.z01.azurefd.net:443 - + get.trivy.dev:443 - name: Checkout repository uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 diff --git a/.github/workflows/sdk-codeql.yml b/.github/workflows/sdk-codeql.yml index 3bd6434d48..fa5056c2d6 100644 --- a/.github/workflows/sdk-codeql.yml +++ b/.github/workflows/sdk-codeql.yml @@ -55,6 +55,7 @@ jobs: allowed-endpoints: > api.github.com:443 github.com:443 + release-assets.githubusercontent.com:443 uploads.github.com:443 - name: Checkout repository diff --git a/.github/workflows/sdk-container-checks.yml b/.github/workflows/sdk-container-checks.yml index 449324cb32..dacf160a86 100644 --- a/.github/workflows/sdk-container-checks.yml +++ b/.github/workflows/sdk-container-checks.yml @@ -92,6 +92,7 @@ jobs: cdn.powershellgallery.com:443 _http._tcp.deb.debian.org:443 powershellinfraartifacts-gkhedzdeaghdezhr.z01.azurefd.net:443 + get.trivy.dev:443 - name: Checkout repository uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 diff --git a/.github/workflows/sdk-tests.yml b/.github/workflows/sdk-tests.yml index 679fe2824c..6e514916b1 100644 --- a/.github/workflows/sdk-tests.yml +++ b/.github/workflows/sdk-tests.yml @@ -39,6 +39,25 @@ jobs: files.pythonhosted.org:443 api.github.com:443 release-assets.githubusercontent.com:443 + *.amazonaws.com:443 + *.googleapis.com:443 + schema.ocsf.io:443 + registry-1.docker.io:443 + production.cloudflare.docker.com:443 + powershellinfraartifacts-gkhedzdeaghdezhr.z01.azurefd.net:443 + o26192.ingest.us.sentry.io:443 + management.azure.com:443 + login.microsoftonline.com:443 + keybase.io:443 + ingest.codecov.io:443 + graph.microsoft.com:443 + dc.services.visualstudio.com:443 + cloud.mongodb.com:443 + cli.codecov.io:443 + auth.docker.io:443 + api.vercel.com:443 + api.atlassian.com:443 + aka.ms:443 - name: Checkout repository uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 diff --git a/.github/workflows/ui-codeql.yml b/.github/workflows/ui-codeql.yml index d075872d45..c4ab182e92 100644 --- a/.github/workflows/ui-codeql.yml +++ b/.github/workflows/ui-codeql.yml @@ -51,6 +51,7 @@ jobs: allowed-endpoints: > api.github.com:443 github.com:443 + release-assets.githubusercontent.com:443 uploads.github.com:443 - name: Checkout repository diff --git a/.github/workflows/ui-container-checks.yml b/.github/workflows/ui-container-checks.yml index 246e15a8f9..10a910ace4 100644 --- a/.github/workflows/ui-container-checks.yml +++ b/.github/workflows/ui-container-checks.yml @@ -88,6 +88,7 @@ jobs: api.github.com:443 mirror.gcr.io:443 check.trivy.dev:443 + get.trivy.dev:443 - name: Checkout repository uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2