daniel543x/craft-common-actions
1
0 Fork 0
mirror of https://github.com/storytold/craft-common-actions.git synced 2026-11-15 15:02:24 +00:00
Code Issues Packages Projects Releases Wiki Activity

egress: allow *.kernel.org and *.dotsrc.org wherever apt mirrors are allowed (#203)

Browse Source 
Block-mode Harden-Runner still flagged apt's lookups under these zones
(_https._tcp.mirrors.edge.kernel.org, _https._tcp.mirrors.dotsrc.org),
and apt failures are breaking CI across the org. Allow the whole zones on
443 next to the existing mirror hosts.
This commit is contained in:
Dylan M. Taylor authored and GitHub committed 2026-11-11 11:20:38 -05:00
1 parent 3f541b8904
commit 95e8d67389
6 files changed
+17 -1
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

.github/workflows/gate.yml
+2
View File
@@ -139,6 +139,8 @@ jobs:
ftp.tu-chemnitz.de:443
github.com:443
index.crates.io:443
*.dotsrc.org:443
*.kernel.org:443
mirrors.dotsrc.org:443
mirrors.edge.kernel.org:443
objects.githubusercontent.com:443
.github/workflows/packaging-lint.yml
+2
View File
@@ -35,6 +35,8 @@ jobs:
azure.archive.ubuntu.com:80
azure.archive.ubuntu.com:443
github.com:443
*.dotsrc.org:443
*.kernel.org:443
mirrors.dotsrc.org:443
mirrors.edge.kernel.org:443
objects.githubusercontent.com:443
.github/workflows/sonarcloud.yml
+8
View File
@@ -123,6 +123,8 @@ jobs:
index.crates.io:443
keys.openpgp.org:443
keyserver.ubuntu.com:443
*.dotsrc.org:443
*.kernel.org:443
mirrors.dotsrc.org:443
mirrors.edge.kernel.org:443
objects.githubusercontent.com:443
@@ -196,6 +198,8 @@ jobs:
index.crates.io:443
keys.openpgp.org:443
keyserver.ubuntu.com:443
*.dotsrc.org:443
*.kernel.org:443
mirrors.dotsrc.org:443
mirrors.edge.kernel.org:443
objects.githubusercontent.com:443
@@ -319,6 +323,8 @@ jobs:
index.crates.io:443
keys.openpgp.org:443
keyserver.ubuntu.com:443
*.dotsrc.org:443
*.kernel.org:443
mirrors.dotsrc.org:443
mirrors.edge.kernel.org:443
objects.githubusercontent.com:443
@@ -434,6 +440,8 @@ jobs:
index.crates.io:443
keys.openpgp.org:443
keyserver.ubuntu.com:443
*.dotsrc.org:443
*.kernel.org:443
mirrors.dotsrc.org:443
mirrors.edge.kernel.org:443
objects.githubusercontent.com:443
.github/workflows/test-freebsd.yml
+2
View File
@@ -38,6 +38,8 @@ jobs:
archive.ubuntu.com:443
azure.archive.ubuntu.com:443
security.ubuntu.com:443
*.dotsrc.org:443
*.kernel.org:443
mirrors.dotsrc.org:443
mirrors.edge.kernel.org:443
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
.github/workflows/test-install-apt-packages.yml
+2
View File
@@ -52,6 +52,8 @@ jobs:
security.ubuntu.com:443
ports.ubuntu.com:80
ports.ubuntu.com:443
*.dotsrc.org:443
*.kernel.org:443
mirrors.dotsrc.org:443
mirrors.edge.kernel.org:443
ftp.tu-chemnitz.de:443
actions/configure-apt-mirrors/configure-apt-mirrors.sh
+1 -1
View File
@@ -15,7 +15,7 @@
# install-riscv64-cross pins amd64 and riscv64 to one pair of mirrors so both architectures match.
#
# A job whose Harden-Runner policy blocks egress must allow these hosts on port 443:
# amd64: mirrors.edge.kernel.org, mirrors.dotsrc.org
# amd64: mirrors.edge.kernel.org, mirrors.dotsrc.org (the workflows allow *.kernel.org, *.dotsrc.org)
# arm64: mirrors.dotsrc.org, ftp.tu-chemnitz.de
# A blocked mirror only fails its check and goes to the end of the list. apt's SRV lookups
# (_https._tcp.<host>) are turned off: Harden-Runner blocks those names, and apt does not need them.