feat: enforce block-mode egress for release-rust's plan and build jobs - #30
Merged
Conversation
📝 WalkthroughWalkthroughRelease workflows now block runner egress and use explicit endpoint allowlists. The Rust workflow builds target-specific lists, including dynamic Zig community mirrors, and applies them to planning, build, and provenance jobs. Zizmor ignore references now match the updated workflow location. ChangesWorkflow egress hardening
Estimated code review effort: 3 (Moderate) | ~20 minutes Sequence Diagram(s)sequenceDiagram
participant PlanJob
participant ZigMirrors
participant TargetMatrix
participant BuildJob
participant ProvenanceJob
PlanJob->>ZigMirrors: Fetch community mirror endpoints
ZigMirrors-->>PlanJob: Return mirror list
PlanJob->>TargetMatrix: Assign target-specific allowlist
TargetMatrix->>BuildJob: Pass allowed-endpoints
BuildJob->>BuildJob: Enforce blocked egress
ProvenanceJob->>ProvenanceJob: Enforce GitHub and Sigstore allowlist
Possibly related PRs
🚥 Pre-merge checks | ✅ 3 | ❌ 2❌ Failed checks (1 warning, 1 inconclusive)
✅ Passed checks (3 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/ci.yml:
- Around line 67-118: The matrix planner is duplicated, so hardening tests can
diverge from production behavior. In .github/workflows/ci.yml lines 67-118,
replace the inline planner with a call to the shared implementation and pass the
fixed test targets; in .github/workflows/release-rust.yml lines 95-137, move the
planner logic into that shared implementation while retaining the production
workflow as its caller. Ensure both workflows use the same matrix and
endpoint-policy generation.
In @.github/workflows/release-rust.yml:
- Around line 95-111: Update the release workflow’s Cargo endpoint setup around
common_endpoints to support caller-specific registry, source-replacement, and
Git dependency hosts: add a validated caller endpoint input and include its
approved values in the Cargo allowlist, or add an equivalent pre-build
validation that rejects unsupported Cargo sources before invoking Cargo.
Preserve the existing zigbuild endpoint handling and ensure untrusted endpoint
values cannot bypass validation.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro
Run ID: 18bc9115-5393-497f-9222-d17c862529d2
📒 Files selected for processing (4)
.github/workflows/ci.yml.github/workflows/release-rust.yml.github/workflows/release.yml.github/zizmor.yml
purpleclay
commented
Jul 31, 2026
purpleclay
force-pushed
the
23-switch-egress-policy-to-block
branch
from
July 31, 2026 13:48
5953898 to
55393b3
Compare
There was a problem hiding this comment.
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
.github/workflows/release-rust.yml (1)
94-131: 🩺 Stability & Availability | 🟠 Major | 🏗️ Heavy lift
actions/upload-artifact@v7requires endpoint allowlist entries missing from bothcommon_endpointsandzigbuild_endpoints.Every build job step
upload_archive(line 239) runsactions/upload-artifact@v7. The v4+ versions of this action use a dedicated backend separate fromgithub.com. Required endpoints include:
actions.githubusercontent.com(Actions artifact/cache/log services)*.blob.core.windows.net(Azure Blob Storage for artifact data storage)Neither
common_endpointsnorzigbuild_endpointsincludes these hosts. Withegress-policy: blockenabled on the build job (line 152), every build leg will fail at the upload step after a successful compile, blocking all releases.Before merging with block mode enabled, run the workflow with
egress-policy: auditon the build job and check the Harden-Runner Insights page to capture the actual artifact-upload endpoints. Then add them to the allowed lists. Use the GitHub Meta API (curl https://api.github.com/meta | jq .domains.actions) to retrieve the authoritative current list of Actions endpoints.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/release-rust.yml around lines 94 - 131, The endpoint allowlists used by the build matrix omit hosts required by actions/upload-artifact@v7. Update common_endpoints and zigbuild_endpoints to include the authoritative Actions domains from the GitHub Meta API, including actions.githubusercontent.com and the required Azure Blob Storage hosts; first validate the actual upload endpoints in audit mode, then ensure every upload_archive job succeeds with egress-policy block.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Outside diff comments:
In @.github/workflows/release-rust.yml:
- Around line 94-131: The endpoint allowlists used by the build matrix omit
hosts required by actions/upload-artifact@v7. Update common_endpoints and
zigbuild_endpoints to include the authoritative Actions domains from the GitHub
Meta API, including actions.githubusercontent.com and the required Azure Blob
Storage hosts; first validate the actual upload endpoints in audit mode, then
ensure every upload_archive job succeeds with egress-policy block.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro
Run ID: 7ed36103-b098-4435-b4e1-2ff6b9d6dfb8
📒 Files selected for processing (3)
.github/workflows/release-rust.yml.github/workflows/release.yml.github/zizmor.yml
Closes #23 `build`'s harden_runner moves from audit to block, with the allowed endpoints computed per matrix leg rather than static: - `plan` now assembles two endpoint sets — one for zigbuild (linux) legs, one for native (macOS) legs — and bakes the appropriate one into each matrix entry alongside runs-on/zigbuild, verified against real harden-runner audit logs rather than guessed - the zig mirror allowlist is fetched live from ziglang.org's own authoritative mirror list, since mlugg/setup-zig picks a mirror at random per run (confirmed: two real runs picked two different ones) — allowlisting whichever one we'd happened to observe would have been incomplete - `plan` gets its own harden_runner (block, ziglang.org only), since fetching that mirror list is the first time this job reaches the network Signed-off-by: purpleclay <purpleclaygh@gmail.com>
purpleclay
force-pushed
the
23-switch-egress-policy-to-block
branch
from
July 31, 2026 16:21
55393b3 to
0266693
Compare
There was a problem hiding this comment.
Actionable comments posted: 3
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/release-rust.yml:
- Around line 107-110: Update the endpoint construction in the release workflow
to stop deriving allowed endpoints directly from the mutable
community-mirrors.txt response. Use a reviewed repository-owned mirror list or
filter the fetched hosts against an explicit approved set before assigning
zig_mirrors, and preserve only validated hosts for Zig build steps.
- Line 111: Update the zigbuild_endpoints assignment in the release workflow to
include the Actions cache host identified by harden-runner audit logs,
preserving the existing endpoint values so setup_zig can restore and save the
Zig tarball successfully.
- Around line 265-277: Add pipelines.actions.githubusercontent.com:443 to the
allowed-endpoints list used by the harden-runner step in the release workflow,
preserving the existing block policy and all current endpoints.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro
Run ID: 4f3ffee5-6538-43f0-941d-e6099a0743e5
📒 Files selected for processing (3)
.github/workflows/release-rust.yml.github/workflows/release.yml.github/zizmor.yml
purpleclay
added a commit
that referenced
this pull request
Aug 1, 2026
#30) Closes #23 `build`'s harden_runner moves from audit to block, with the allowed endpoints computed per matrix leg rather than static: - `plan` now assembles two endpoint sets — one for zigbuild (linux) legs, one for native (macOS) legs — and bakes the appropriate one into each matrix entry alongside runs-on/zigbuild, verified against real harden-runner audit logs rather than guessed - the zig mirror allowlist is fetched live from ziglang.org's own authoritative mirror list, since mlugg/setup-zig picks a mirror at random per run (confirmed: two real runs picked two different ones) — allowlisting whichever one we'd happened to observe would have been incomplete - `plan` gets its own harden_runner (block, ziglang.org only), since fetching that mirror list is the first time this job reaches the network Signed-off-by: purpleclay <purpleclaygh@gmail.com>
This was referenced Aug 1, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
closes #23
Summary by CodeRabbit
Security
Maintenance