feat: enforce block-mode egress for release-rust's plan and build jobs (#30)

[purpleclay]

closes #31

Summary by CodeRabbit

• Security

  • Hardened release automation by blocking unapproved network access and allowing only verified service endpoints.
  • Added endpoint checks for build dependencies and release provenance generation.

• Reliability

  • Release builds now validate available, reviewed Zig package mirrors and fail clearly when none are usable.

• Documentation

  • Added guidance for maintaining, comparing, and verifying the reviewed Zig mirror list.
  • Added configuration to keep mirror data and spelling-check settings properly tracked.

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: 86991363-dce0-4f46-be17-e3fc6b7269df

📥 Commits

Reviewing files that changed from the base of the PR and between 9ffaad0 and ea0c48a.

📒 Files selected for processing (7)

• .github/workflows/release-rust.yml
• .github/workflows/release.yml
• .github/zig-mirrors.md
• .github/zig-mirrors.txt
• .github/zizmor.yml
• .gitignore
• typos.toml

---

📝 Walkthrough

Walkthrough

Changes

Release egress hardening

Layer / File(s)	Summary
Reviewed Zig mirror selection .github/workflows/release-rust.yml, .github/zig-mirrors.*, .gitignore, typos.toml	The plan job intersects live Zig mirrors with the committed reviewed list and adds the resulting endpoints to the build matrix. Documentation and spellcheck exceptions support the committed list.
Rust build and provenance allowlists .github/workflows/release-rust.yml	Build jobs now block egress and use matrix-specific endpoint allowlists. The provenance job uses a fixed allowlist. Build step names are normalized without changing commands.
Release workflow policy updates .github/workflows/release.yml, .github/zizmor.yml	The release workflow blocks egress to explicit GitHub and release-assets endpoints. Zizmor references the updated workflow location.

Estimated code review effort: 3 (Moderate) | ~25 minutes

Sequence Diagram(s)

sequenceDiagram
  participant PlanJob
  participant ZigUpstream
  participant ReviewedList
  participant BuildMatrix
  participant BuildRunner
  PlanJob->>ZigUpstream: Fetch live community mirrors
  PlanJob->>ReviewedList: Read committed reviewed mirrors
  PlanJob->>BuildMatrix: Pass the live/reviewed intersection
  BuildMatrix->>BuildRunner: Apply target-specific allowed endpoints
  BuildRunner-->>PlanJob: Build with blocked egress

Loading

Possibly related issues

• purpleclay/release-workflows#23 — The PR moves release workflow egress from audit mode to block mode and adds reviewed Zig mirror allowlists.

Possibly related PRs

• purpleclay/release-workflows#25 — Both changes modify Zig mirror selection and egress handling in release-rust.yml.
• purpleclay/release-workflows#30 — Both changes refine egress hardening across the release workflows and zizmor configuration.
• purpleclay/release-workflows#2 — This PR hardens the reusable Rust release workflow introduced there.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch 31-zig-mirror-allowlist

---

_{Comment @coderabbitai help to get the list of available commands.}