Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 8 additions & 2 deletions pkg/workflow/data/ecosystem_domains.json
Original file line number Diff line number Diff line change
Expand Up @@ -54,7 +54,8 @@
"www.microsoft.com",
"oneocsp.microsoft.com"
],
"dart": ["pub.dev", "pub.dartlang.org"],
"clojure": ["repo.clojars.org", "clojars.org"],
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

New clojure ecosystem entry looks good! Consider also adding clojars.org mirrors or CDN domains if Clojure projects commonly fetch from them.

"dart": ["pub.dev", "pub.dartlang.org", "storage.googleapis.com"],
"fonts": ["fonts.googleapis.com", "fonts.gstatic.com"],
"github": [
"*.githubusercontent.com",
Expand All @@ -66,9 +67,11 @@
"codeload.github.com",
"github.githubassets.com"
],
"elixir": ["hex.pm", "repo.hex.pm", "builds.hex.pm", "cdn.hex.pm", "fastly.hex.pm"],
"go": ["go.dev", "golang.org", "proxy.golang.org", "sum.golang.org", "pkg.go.dev", "goproxy.io", "storage.googleapis.com"],
"terraform": ["releases.hashicorp.com", "apt.releases.hashicorp.com", "yum.releases.hashicorp.com", "registry.terraform.io"],
"haskell": ["haskell.org", "*.hackage.haskell.org", "get-ghcup.haskell.org", "downloads.haskell.org"],
"kotlin": ["ge.jetbrains.com", "packages.jetbrains.team", "kotlin.bintray.com"],
"java": [
"www.java.com",
"jdk.java.net",
Expand Down Expand Up @@ -96,7 +99,8 @@
"central.sonatype.com",
"maven.google.com",
"dl.google.com",
"repo.gradle.org"
"repo.gradle.org",
"downloads.gradle-dn.com"
],
"linux-distros": [
"deb.debian.org",
Expand Down Expand Up @@ -166,7 +170,9 @@
],
"ruby": ["rubygems.org", "api.rubygems.org", "rubygems.pkg.github.com", "bundler.rubygems.org", "gems.rubyforge.org", "gems.rubyonrails.org", "index.rubygems.org", "cache.ruby-lang.org", "*.rvm.io"],
"rust": ["crates.io", "index.crates.io", "static.crates.io", "sh.rustup.rs", "static.rust-lang.org"],
"scala": ["repo.scala-sbt.org", "scala-ci.typesafe.com", "repo.typesafe.com", "jitpack.io", "dl.bintray.com"],
"swift": ["download.swift.org", "swift.org", "cocoapods.org", "cdn.cocoapods.org"],
"zig": ["ziglang.org", "pkg.machengine.org"],
"github-actions": [
"productionresultssa0.blob.core.windows.net",
"productionresultssa1.blob.core.windows.net",
Expand Down
24 changes: 21 additions & 3 deletions pkg/workflow/domains.go
Original file line number Diff line number Diff line change
Expand Up @@ -154,6 +154,14 @@ var runtimeToEcosystem = map[string]string{
"bun": "node", // bun.sh is in the node ecosystem
"deno": "node", // deno.land is in the node ecosystem
"uv": "python", // uv is a Python package manager
"clojure": "clojure",
"dart": "dart",
"elixir": "elixir",
"kotlin": "kotlin",
"php": "php",
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nice addition of new runtime-to-ecosystem mappings. The php entry is added here but I don't see a corresponding "php" key added in ecosystem_domains.json in this diff — worth verifying the PHP ecosystem domains are already present.

"scala": "scala",
"swift": "swift",
"zig": "zig",
}

// getDomainsFromRuntimes extracts ecosystem domains based on the specified runtimes
Expand Down Expand Up @@ -226,14 +234,17 @@ func getDomainsFromRuntimes(runtimes map[string]any) []string {
//
// # Supported ecosystem identifiers:
// - "defaults": basic infrastructure (certs, JSON schema, Ubuntu, package mirrors)
// - "clojure": Clojure/Clojars
// - "containers": container registries (Docker, GHCR, etc.)
// - "dotnet": .NET and NuGet ecosystem
// - "dart": Dart/Flutter ecosystem
// - "dotnet": .NET and NuGet ecosystem
// - "elixir": Elixir/Hex
// - "github": GitHub domains (*.githubusercontent.com, github.githubassets.com, etc.)
// - "github-actions": GitHub Actions blob storage domains
// - "go": Go ecosystem
// - "terraform": HashiCorp/Terraform
// - "haskell": Haskell ecosystem
// - "java": Java/Maven/Gradle
// - "kotlin": Kotlin/JetBrains
// - "linux-distros": Linux distribution package repositories
// - "node": Node.js/NPM/Yarn
// - "perl": Perl/CPAN
Expand All @@ -242,8 +253,10 @@ func getDomainsFromRuntimes(runtimes map[string]any) []string {
// - "python": Python/PyPI/Conda
// - "ruby": Ruby/RubyGems
// - "rust": Rust/Cargo/Crates
// - "scala": Scala/SBT
// - "swift": Swift/CocoaPods
// - "github-actions": GitHub Actions blob storage domains
// - "terraform": HashiCorp/Terraform
// - "zig": Zig
func GetAllowedDomains(network *NetworkPermissions) []string {
if network == nil {
domainsLog.Print("No network permissions specified, using defaults")
Expand Down Expand Up @@ -295,25 +308,30 @@ func GetAllowedDomains(network *NetworkPermissions) []string {
var ecosystemPriority = []string{
"node-cdns", // before "node" — more specific CDN sub-ecosystem
"rust", // before "python" — crates.io/index.crates.io/static.crates.io are native Rust domains
"clojure",
"containers",
"dart",
Copy link

Copilot AI Feb 20, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The dart ecosystem shares the domain storage.googleapis.com with the go ecosystem. Since dart is positioned before go in the ecosystemPriority list, GetDomainEcosystem will resolve storage.googleapis.com to dart rather than go. Consider adding an inline comment similar to the existing rust/python comment (line 310) to document this intentional ordering decision and help future maintainers understand why dart must be positioned before go.

Suggested change
"dart",
"dart", // before "go" — both share storage.googleapis.com; prefer Dart resolution

Copilot uses AI. Check for mistakes.
"defaults",
"dotnet",
"elixir",
"fonts",
"github",
"github-actions",
"go",
"haskell",
"java",
"kotlin",
"linux-distros",
"node",
"perl",
"php",
"playwright",
"python",
"ruby",
"scala",
"swift",
"terraform",
"zig",
}

// GetDomainEcosystem returns the ecosystem identifier for a given domain, or empty string if not found.
Expand Down
4 changes: 2 additions & 2 deletions pkg/workflow/domains_test.go
Original file line number Diff line number Diff line change
Expand Up @@ -852,11 +852,11 @@ func TestGetDomainsFromRuntimes(t *testing.T) {
expectEmpty: true,
},
{
name: "elixir has no ecosystem mapping",
name: "elixir runtime adds elixir ecosystem domains",
runtimes: map[string]any{
"elixir": map[string]any{"version": "1.15"},
},
expectEmpty: true,
expectContains: []string{"hex.pm", "repo.hex.pm"},
},
Copy link

Copilot AI Feb 20, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The TestGetDomainsFromRuntimes test suite includes a test case for the elixir runtime mapping, but is missing test cases for the other newly added runtime mappings: clojure, kotlin, scala, zig, dart, php, and swift. Consider adding test cases for these runtimes to ensure their ecosystem mappings work correctly.

Suggested change
},
},
{
name: "clojure runtime adds clojure ecosystem domains",
runtimes: map[string]any{
"clojure": map[string]any{"version": "1.11"},
},
expectContains: []string{"clojars.org", "repo.clojars.org"},
},
{
name: "kotlin runtime adds kotlin ecosystem domains",
runtimes: map[string]any{
"kotlin": map[string]any{"version": "1.9"},
},
expectContains: []string{"repo.maven.apache.org", "gradle.org"},
},
{
name: "scala runtime adds scala ecosystem domains",
runtimes: map[string]any{
"scala": map[string]any{"version": "3.3"},
},
expectContains: []string{"repo.maven.apache.org", "scala-lang.org"},
},
{
name: "zig runtime adds zig ecosystem domains",
runtimes: map[string]any{
"zig": map[string]any{"version": "0.12"},
},
expectContains: []string{"ziglang.org", "pkg.machengine.org"},
},
{
name: "dart runtime adds dart ecosystem domains",
runtimes: map[string]any{
"dart": map[string]any{"version": "3.3"},
},
expectContains: []string{"pub.dev", "pub.dartlang.org"},
},
{
name: "php runtime adds php ecosystem domains",
runtimes: map[string]any{
"php": map[string]any{"version": "8.3"},
},
expectContains: []string{"packagist.org", "repo.packagist.org"},
},
{
name: "swift runtime adds swift ecosystem domains",
runtimes: map[string]any{
"swift": map[string]any{"version": "5.9"},
},
expectContains: []string{"swift.org", "swiftpackageindex.com"},
},

Copilot uses AI. Check for mistakes.
}

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -472,7 +472,7 @@ jobs:
timeout-minutes: 5
run: |
set -o pipefail
sudo -E awf --env-all --container-workdir "${GITHUB_WORKSPACE}" --allow-domains '*.githubusercontent.com,*.jsr.io,*.pythonhosted.org,adoptium.net,anaconda.org,api.adoptium.net,api.business.githubcopilot.com,api.enterprise.githubcopilot.com,api.foojay.io,api.github.com,api.githubcopilot.com,api.individual.githubcopilot.com,api.npms.io,api.nuget.org,api.snapcraft.io,archive.apache.org,archive.ubuntu.com,azure.archive.ubuntu.com,azuresearch-usnc.nuget.org,azuresearch-ussc.nuget.org,binstar.org,bootstrap.pypa.io,builds.dotnet.microsoft.com,bun.sh,cdn.azul.com,cdn.jsdelivr.net,central.sonatype.com,ci.dot.net,codeload.github.com,conda.anaconda.org,conda.binstar.org,crates.io,crl.geotrust.com,crl.globalsign.com,crl.identrust.com,crl.sectigo.com,crl.thawte.com,crl.usertrust.com,crl.verisign.com,crl3.digicert.com,crl4.digicert.com,crls.ssl.com,dc.services.visualstudio.com,deb.nodesource.com,deno.land,dist.nuget.org,dl.google.com,dlcdn.apache.org,dot.net,dotnet.microsoft.com,dotnetcli.blob.core.windows.net,download.eclipse.org,download.java.net,download.oracle.com,esm.sh,files.pythonhosted.org,get.pnpm.io,github-cloud.githubusercontent.com,github-cloud.s3.amazonaws.com,github.com,github.githubassets.com,go.dev,golang.org,googleapis.deno.dev,googlechromelabs.github.io,goproxy.io,gradle.org,host.docker.internal,index.crates.io,jcenter.bintray.com,jdk.java.net,json-schema.org,json.schemastore.org,jsr.io,keyserver.ubuntu.com,lfs.github.com,maven.apache.org,maven.google.com,maven.oracle.com,maven.pkg.github.com,nodejs.org,npm.pkg.github.com,npmjs.com,npmjs.org,nuget.org,nuget.pkg.github.com,nugetregistryv2prod.blob.core.windows.net,objects.githubusercontent.com,ocsp.digicert.com,ocsp.geotrust.com,ocsp.globalsign.com,ocsp.identrust.com,ocsp.sectigo.com,ocsp.ssl.com,ocsp.thawte.com,ocsp.usertrust.com,ocsp.verisign.com,oneocsp.microsoft.com,packagecloud.io,packages.cloud.google.com,packages.microsoft.com,pip.pypa.io,pkg.go.dev,pkgs.dev.azure.com,plugins-artifacts.gradle.org,plugins.gradle.org,ppa.launchpad.net,proxy.golang.org,pypi.org,pypi.python.org,raw.githubusercontent.com,registry.bower.io,registry.npmjs.com,registry.npmjs.org,registry.yarnpkg.com,repo.anaconda.com,repo.continuum.io,repo.gradle.org,repo.grails.org,repo.maven.apache.org,repo.spring.io,repo.yarnpkg.com,repo1.maven.org,s.symcb.com,s.symcd.com,security.ubuntu.com,services.gradle.org,skimdb.npmjs.com,static.crates.io,storage.googleapis.com,sum.golang.org,telemetry.enterprise.githubcopilot.com,ts-crl.ws.symantec.com,ts-ocsp.ws.symantec.com,www.java.com,www.microsoft.com,www.npmjs.com,www.npmjs.org,yarnpkg.com' --log-level info --proxy-logs-dir /tmp/gh-aw/sandbox/firewall/logs --enable-host-access --image-tag 0.20.2 --skip-pull --enable-api-proxy \
sudo -E awf --env-all --container-workdir "${GITHUB_WORKSPACE}" --allow-domains '*.githubusercontent.com,*.jsr.io,*.pythonhosted.org,adoptium.net,anaconda.org,api.adoptium.net,api.business.githubcopilot.com,api.enterprise.githubcopilot.com,api.foojay.io,api.github.com,api.githubcopilot.com,api.individual.githubcopilot.com,api.npms.io,api.nuget.org,api.snapcraft.io,archive.apache.org,archive.ubuntu.com,azure.archive.ubuntu.com,azuresearch-usnc.nuget.org,azuresearch-ussc.nuget.org,binstar.org,bootstrap.pypa.io,builds.dotnet.microsoft.com,bun.sh,cdn.azul.com,cdn.jsdelivr.net,central.sonatype.com,ci.dot.net,codeload.github.com,conda.anaconda.org,conda.binstar.org,crates.io,crl.geotrust.com,crl.globalsign.com,crl.identrust.com,crl.sectigo.com,crl.thawte.com,crl.usertrust.com,crl.verisign.com,crl3.digicert.com,crl4.digicert.com,crls.ssl.com,dc.services.visualstudio.com,deb.nodesource.com,deno.land,dist.nuget.org,dl.google.com,dlcdn.apache.org,dot.net,dotnet.microsoft.com,dotnetcli.blob.core.windows.net,download.eclipse.org,download.java.net,download.oracle.com,downloads.gradle-dn.com,esm.sh,files.pythonhosted.org,get.pnpm.io,github-cloud.githubusercontent.com,github-cloud.s3.amazonaws.com,github.com,github.githubassets.com,go.dev,golang.org,googleapis.deno.dev,googlechromelabs.github.io,goproxy.io,gradle.org,host.docker.internal,index.crates.io,jcenter.bintray.com,jdk.java.net,json-schema.org,json.schemastore.org,jsr.io,keyserver.ubuntu.com,lfs.github.com,maven.apache.org,maven.google.com,maven.oracle.com,maven.pkg.github.com,nodejs.org,npm.pkg.github.com,npmjs.com,npmjs.org,nuget.org,nuget.pkg.github.com,nugetregistryv2prod.blob.core.windows.net,objects.githubusercontent.com,ocsp.digicert.com,ocsp.geotrust.com,ocsp.globalsign.com,ocsp.identrust.com,ocsp.sectigo.com,ocsp.ssl.com,ocsp.thawte.com,ocsp.usertrust.com,ocsp.verisign.com,oneocsp.microsoft.com,packagecloud.io,packages.cloud.google.com,packages.microsoft.com,pip.pypa.io,pkg.go.dev,pkgs.dev.azure.com,plugins-artifacts.gradle.org,plugins.gradle.org,ppa.launchpad.net,proxy.golang.org,pypi.org,pypi.python.org,raw.githubusercontent.com,registry.bower.io,registry.npmjs.com,registry.npmjs.org,registry.yarnpkg.com,repo.anaconda.com,repo.continuum.io,repo.gradle.org,repo.grails.org,repo.maven.apache.org,repo.spring.io,repo.yarnpkg.com,repo1.maven.org,s.symcb.com,s.symcd.com,security.ubuntu.com,services.gradle.org,skimdb.npmjs.com,static.crates.io,storage.googleapis.com,sum.golang.org,telemetry.enterprise.githubcopilot.com,ts-crl.ws.symantec.com,ts-ocsp.ws.symantec.com,www.java.com,www.microsoft.com,www.npmjs.com,www.npmjs.org,yarnpkg.com' --log-level info --proxy-logs-dir /tmp/gh-aw/sandbox/firewall/logs --enable-host-access --image-tag 0.20.2 --skip-pull --enable-api-proxy \
-- /bin/bash -c '/usr/local/bin/copilot --add-dir /tmp/gh-aw/ --log-level all --log-dir /tmp/gh-aw/sandbox/agent/logs/ --add-dir "${GITHUB_WORKSPACE}" --disable-builtin-mcps --allow-all-tools --allow-all-paths --share /tmp/gh-aw/sandbox/agent/logs/conversation.md --prompt "$(cat /tmp/gh-aw/aw-prompts/prompt.txt)"${GH_AW_MODEL_DETECTION_COPILOT:+ --model "$GH_AW_MODEL_DETECTION_COPILOT"}' 2>&1 | tee -a /tmp/gh-aw/agent-stdio.log
env:
COPILOT_AGENT_RUNNER_TYPE: STANDALONE
Expand Down
Loading