egress: allow motd.ubuntu.com, esm.ubuntu.com and *.amazontrust.com:80 (#218)

Ubuntu's MOTD news and Ubuntu Pro (ESM) hooks reach motd.ubuntu.com and
esm.ubuntu.com; TLS revocation checks for Amazon-issued certificates go
to *.amazontrust.com over plain HTTP. Every Harden-Runner allow list now
names them.

.github/workflows/ast-grep.yml

@@ -40,6 +40,9 @@ jobs:
         with:
           egress-policy: block
           allowed-endpoints: >
+            *.amazontrust.com:80
+            esm.ubuntu.com:443
+            motd.ubuntu.com:443
             api.github.com:443
             github.com:443
             objects.githubusercontent.com:443

.github/workflows/gate.yml

@@ -123,6 +123,9 @@ jobs:
         with:
           egress-policy: audit
           allowed-endpoints: >
+            *.amazontrust.com:80
+            esm.ubuntu.com:443
+            motd.ubuntu.com:443
             *.crates.io:443
             *.github.com:443
             *.githubusercontent.com:443

.github/workflows/house-rules.yml

@@ -35,6 +35,9 @@ jobs:
         with:
           egress-policy: block
           allowed-endpoints: >
+            *.amazontrust.com:80
+            esm.ubuntu.com:443
+            motd.ubuntu.com:443
             api.github.com:443
             github.com:443
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

.github/workflows/packaging-lint.yml

@@ -24,6 +24,9 @@ jobs:
         with:
           egress-policy: block
           allowed-endpoints: >
+            *.amazontrust.com:80
+            esm.ubuntu.com:443
+            motd.ubuntu.com:443
             *.github.com:443
             *.githubusercontent.com:443
             *.microsoft.com:443

.github/workflows/sonarcloud.yml

@@ -100,6 +100,8 @@ jobs:
           # Ubuntu Pro APT hooks use esm.ubuntu.com for security-update metadata.
           # Keep this explicit alongside the archive hosts instead of allowing all Ubuntu subdomains.
           allowed-endpoints: >
+            *.amazontrust.com:80
+            motd.ubuntu.com:443
             *.amazonaws.com:443
             *.crates.io:443
             *.s3.amazonaws.com:443
@@ -176,6 +178,8 @@ jobs:
           # Ubuntu Pro APT hooks use esm.ubuntu.com for security-update metadata.
           # Keep this explicit alongside the archive hosts instead of allowing all Ubuntu subdomains.
           allowed-endpoints: >
+            *.amazontrust.com:80
+            motd.ubuntu.com:443
             *.amazonaws.com:443
             *.crates.io:443
             *.s3.amazonaws.com:443
@@ -302,6 +306,8 @@ jobs:
           # Ubuntu Pro APT hooks use esm.ubuntu.com for security-update metadata.
           # Keep this explicit alongside the archive hosts instead of allowing all Ubuntu subdomains.
           allowed-endpoints: >
+            *.amazontrust.com:80
+            motd.ubuntu.com:443
             *.amazonaws.com:443
             *.crates.io:443
             *.s3.amazonaws.com:443
@@ -453,6 +459,8 @@ jobs:
           # Ubuntu Pro APT hooks use esm.ubuntu.com for security-update metadata.
           # Keep this explicit alongside the archive hosts instead of allowing all Ubuntu subdomains.
           allowed-endpoints: >
+            *.amazontrust.com:80
+            motd.ubuntu.com:443
             *.amazonaws.com:443
             *.crates.io:443
             *.s3.amazonaws.com:443

.github/workflows/test-ast-grep.yml

@@ -27,6 +27,9 @@ jobs:
         with:
           egress-policy: block
           allowed-endpoints: >
+            *.amazontrust.com:80
+            esm.ubuntu.com:443
+            motd.ubuntu.com:443
             api.github.com:443
             github.com:443
             objects.githubusercontent.com:443

.github/workflows/test-freebsd.yml

@@ -28,6 +28,9 @@ jobs:
         with:
           egress-policy: block
           allowed-endpoints: >
+            *.amazontrust.com:80
+            esm.ubuntu.com:443
+            motd.ubuntu.com:443
             api.github.com:443
             github.com:443
             archive.ubuntu.com:80

.github/workflows/test-house-rules.yml

@@ -29,6 +29,9 @@ jobs:
         with:
           egress-policy: block
           allowed-endpoints: >
+            *.amazontrust.com:80
+            esm.ubuntu.com:443
+            motd.ubuntu.com:443
             api.github.com:443
             github.com:443
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

.github/workflows/test-install-apt-packages.yml

@@ -40,6 +40,9 @@ jobs:
         with:
           egress-policy: block
           allowed-endpoints: >
+            *.amazontrust.com:80
+            esm.ubuntu.com:443
+            motd.ubuntu.com:443
             api.github.com:443
             github.com:443
             archive.ubuntu.com:80

.github/workflows/windows-arm64.yml

@@ -60,6 +60,9 @@ jobs:
         with:
           egress-policy: audit
           allowed-endpoints: >
+            *.amazontrust.com:80
+            esm.ubuntu.com:443
+            motd.ubuntu.com:443
             *.crates.io:443
             *.github.com:443
             *.githubusercontent.com:443
@@ -114,6 +117,9 @@ jobs:
         with:
           egress-policy: audit
           allowed-endpoints: >
+            *.amazontrust.com:80
+            esm.ubuntu.com:443
+            motd.ubuntu.com:443
             *.crates.io:443
             *.github.com:443
             *.githubusercontent.com:443