From ae29fbc6ec8470e6da1cff677faaf08be9b234df Mon Sep 17 00:00:00 2001 From: "Dylan M. Taylor" Date: Wed, 11 Nov 2026 19:25:34 -0500 Subject: [PATCH] fix(sonarcloud): explicitly allow Ubuntu ESM HTTPS egress (#217) --- .github/workflows/sonarcloud.yml | 20 ++++++++++++-------- 1 file changed, 12 insertions(+), 8 deletions(-) diff --git a/.github/workflows/sonarcloud.yml b/.github/workflows/sonarcloud.yml index bfada68..96aa434 100644 --- a/.github/workflows/sonarcloud.yml +++ b/.github/workflows/sonarcloud.yml @@ -97,6 +97,8 @@ jobs: uses: step-security/harden-runner@1d88384fd173af6ecb012dfd0264a306b711241a # v2.22.4 with: egress-policy: block + # Ubuntu Pro APT hooks use esm.ubuntu.com for security-update metadata. + # Keep this explicit alongside the archive hosts instead of allowing all Ubuntu subdomains. allowed-endpoints: > *.amazonaws.com:443 *.crates.io:443 @@ -109,8 +111,6 @@ jobs: *.pythonhosted.org:443 *.sonarcloud.io:443 *.sonarsource.com:443 - *.ubuntu.com:80 - *.ubuntu.com:443 api.github.com:443 archive.ubuntu.com:80 archive.ubuntu.com:443 @@ -118,6 +118,7 @@ jobs: azure.archive.ubuntu.com:443 binaries.sonarsource.com:443 crates.io:443 + esm.ubuntu.com:443 files.pythonhosted.org:443 github.com:443 index.crates.io:443 @@ -172,6 +173,8 @@ jobs: uses: step-security/harden-runner@1d88384fd173af6ecb012dfd0264a306b711241a # v2.22.4 with: egress-policy: block + # Ubuntu Pro APT hooks use esm.ubuntu.com for security-update metadata. + # Keep this explicit alongside the archive hosts instead of allowing all Ubuntu subdomains. allowed-endpoints: > *.amazonaws.com:443 *.crates.io:443 @@ -184,8 +187,6 @@ jobs: *.pythonhosted.org:443 *.sonarcloud.io:443 *.sonarsource.com:443 - *.ubuntu.com:80 - *.ubuntu.com:443 api.github.com:443 archive.ubuntu.com:80 archive.ubuntu.com:443 @@ -193,6 +194,7 @@ jobs: azure.archive.ubuntu.com:443 binaries.sonarsource.com:443 crates.io:443 + esm.ubuntu.com:443 files.pythonhosted.org:443 github.com:443 index.crates.io:443 @@ -297,6 +299,8 @@ jobs: uses: step-security/harden-runner@1d88384fd173af6ecb012dfd0264a306b711241a # v2.22.4 with: egress-policy: block + # Ubuntu Pro APT hooks use esm.ubuntu.com for security-update metadata. + # Keep this explicit alongside the archive hosts instead of allowing all Ubuntu subdomains. allowed-endpoints: > *.amazonaws.com:443 *.crates.io:443 @@ -309,8 +313,6 @@ jobs: *.pythonhosted.org:443 *.sonarcloud.io:443 *.sonarsource.com:443 - *.ubuntu.com:80 - *.ubuntu.com:443 api.github.com:443 archive.ubuntu.com:80 archive.ubuntu.com:443 @@ -318,6 +320,7 @@ jobs: azure.archive.ubuntu.com:443 binaries.sonarsource.com:443 crates.io:443 + esm.ubuntu.com:443 files.pythonhosted.org:443 github.com:443 index.crates.io:443 @@ -414,6 +417,8 @@ jobs: uses: step-security/harden-runner@1d88384fd173af6ecb012dfd0264a306b711241a # v2.22.4 with: egress-policy: block + # Ubuntu Pro APT hooks use esm.ubuntu.com for security-update metadata. + # Keep this explicit alongside the archive hosts instead of allowing all Ubuntu subdomains. allowed-endpoints: > *.amazonaws.com:443 *.crates.io:443 @@ -426,8 +431,6 @@ jobs: *.pythonhosted.org:443 *.sonarcloud.io:443 *.sonarsource.com:443 - *.ubuntu.com:80 - *.ubuntu.com:443 api.github.com:443 archive.ubuntu.com:80 archive.ubuntu.com:443 @@ -435,6 +438,7 @@ jobs: azure.archive.ubuntu.com:443 binaries.sonarsource.com:443 crates.io:443 + esm.ubuntu.com:443 files.pythonhosted.org:443 github.com:443 index.crates.io:443