From 95e8d673894eb9483c8d441382861e2eed43df5b Mon Sep 17 00:00:00 2001
From: "Dylan M. Taylor" <dylan@dylanmtaylor.com>
Date: Wed, 11 Nov 2026 11:20:38 -0500
Subject: [PATCH] egress: allow *.kernel.org and *.dotsrc.org wherever apt
 mirrors are allowed (#203)

Block-mode Harden-Runner still flagged apt's lookups under these zones
(_https._tcp.mirrors.edge.kernel.org, _https._tcp.mirrors.dotsrc.org),
and apt failures are breaking CI across the org. Allow the whole zones on
443 next to the existing mirror hosts.
---
 .github/workflows/gate.yml                             | 2 ++
 .github/workflows/packaging-lint.yml                   | 2 ++
 .github/workflows/sonarcloud.yml                       | 8 ++++++++
 .github/workflows/test-freebsd.yml                     | 2 ++
 .github/workflows/test-install-apt-packages.yml        | 2 ++
 actions/configure-apt-mirrors/configure-apt-mirrors.sh | 2 +-
 6 files changed, 17 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/gate.yml b/.github/workflows/gate.yml
index 50c708c..f69ccb8 100644
--- a/.github/workflows/gate.yml
+++ b/.github/workflows/gate.yml
@@ -139,6 +139,8 @@ jobs:
             ftp.tu-chemnitz.de:443
             github.com:443
             index.crates.io:443
+            *.dotsrc.org:443
+            *.kernel.org:443
             mirrors.dotsrc.org:443
             mirrors.edge.kernel.org:443
             objects.githubusercontent.com:443
diff --git a/.github/workflows/packaging-lint.yml b/.github/workflows/packaging-lint.yml
index 7ec28c2..c0ca676 100644
--- a/.github/workflows/packaging-lint.yml
+++ b/.github/workflows/packaging-lint.yml
@@ -35,6 +35,8 @@ jobs:
             azure.archive.ubuntu.com:80
             azure.archive.ubuntu.com:443
             github.com:443
+            *.dotsrc.org:443
+            *.kernel.org:443
             mirrors.dotsrc.org:443
             mirrors.edge.kernel.org:443
             objects.githubusercontent.com:443
diff --git a/.github/workflows/sonarcloud.yml b/.github/workflows/sonarcloud.yml
index d43a1ea..b740564 100644
--- a/.github/workflows/sonarcloud.yml
+++ b/.github/workflows/sonarcloud.yml
@@ -123,6 +123,8 @@ jobs:
             index.crates.io:443
             keys.openpgp.org:443
             keyserver.ubuntu.com:443
+            *.dotsrc.org:443
+            *.kernel.org:443
             mirrors.dotsrc.org:443
             mirrors.edge.kernel.org:443
             objects.githubusercontent.com:443
@@ -196,6 +198,8 @@ jobs:
             index.crates.io:443
             keys.openpgp.org:443
             keyserver.ubuntu.com:443
+            *.dotsrc.org:443
+            *.kernel.org:443
             mirrors.dotsrc.org:443
             mirrors.edge.kernel.org:443
             objects.githubusercontent.com:443
@@ -319,6 +323,8 @@ jobs:
             index.crates.io:443
             keys.openpgp.org:443
             keyserver.ubuntu.com:443
+            *.dotsrc.org:443
+            *.kernel.org:443
             mirrors.dotsrc.org:443
             mirrors.edge.kernel.org:443
             objects.githubusercontent.com:443
@@ -434,6 +440,8 @@ jobs:
             index.crates.io:443
             keys.openpgp.org:443
             keyserver.ubuntu.com:443
+            *.dotsrc.org:443
+            *.kernel.org:443
             mirrors.dotsrc.org:443
             mirrors.edge.kernel.org:443
             objects.githubusercontent.com:443
diff --git a/.github/workflows/test-freebsd.yml b/.github/workflows/test-freebsd.yml
index 41d3f0d..95e6a75 100644
--- a/.github/workflows/test-freebsd.yml
+++ b/.github/workflows/test-freebsd.yml
@@ -38,6 +38,8 @@ jobs:
             archive.ubuntu.com:443
             azure.archive.ubuntu.com:443
             security.ubuntu.com:443
+            *.dotsrc.org:443
+            *.kernel.org:443
             mirrors.dotsrc.org:443
             mirrors.edge.kernel.org:443
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
diff --git a/.github/workflows/test-install-apt-packages.yml b/.github/workflows/test-install-apt-packages.yml
index a2bce36..4e38ecb 100644
--- a/.github/workflows/test-install-apt-packages.yml
+++ b/.github/workflows/test-install-apt-packages.yml
@@ -52,6 +52,8 @@ jobs:
             security.ubuntu.com:443
             ports.ubuntu.com:80
             ports.ubuntu.com:443
+            *.dotsrc.org:443
+            *.kernel.org:443
             mirrors.dotsrc.org:443
             mirrors.edge.kernel.org:443
             ftp.tu-chemnitz.de:443
diff --git a/actions/configure-apt-mirrors/configure-apt-mirrors.sh b/actions/configure-apt-mirrors/configure-apt-mirrors.sh
index 43e891f..ce3f4c6 100755
--- a/actions/configure-apt-mirrors/configure-apt-mirrors.sh
+++ b/actions/configure-apt-mirrors/configure-apt-mirrors.sh
@@ -15,7 +15,7 @@
 # install-riscv64-cross pins amd64 and riscv64 to one pair of mirrors so both architectures match.
 #
 # A job whose Harden-Runner policy blocks egress must allow these hosts on port 443:
-#   amd64: mirrors.edge.kernel.org, mirrors.dotsrc.org
+#   amd64: mirrors.edge.kernel.org, mirrors.dotsrc.org (the workflows allow *.kernel.org, *.dotsrc.org)
 #   arm64: mirrors.dotsrc.org, ftp.tu-chemnitz.de
 # A blocked mirror only fails its check and goes to the end of the list. apt's SRV lookups
 # (_https._tcp.<host>) are turned off: Harden-Runner blocks those names, and apt does not need them.