Daily Firewall Report2026-09-06

[github-actions[bot]]

🔥 Executive Summary

Date: 2026-09-06 (report covers the last 24 hours of workflow activity)

This report analyzed 261 firewall-enabled workflow runs across 95 distinct workflows in the github/gh-aw repository. Overall firewall activity was dominated by an extreme outlier: a single workflow (PR Code Quality Reviewer) accounted for over 500,000 blocked requests to registry.npmjs.org:443 across just 7 runs — this appears to be a retry/polling loop rather than normal traffic and skews the aggregate block rate heavily. Outside of that outlier, blocked traffic volumes were modest and mostly involved expected infrastructure domains (Go module proxies, GitHub API, npm registry, telemetry endpoints) being denied due to allowlist gaps.

Note: Chart generation via the firewall-chart-generator sub-agent did not return usable output (no CHART1_URL/CHART2_URL or error field after two attempts), so trend charts are omitted from this report.

📊 Key Metrics

Metric	Value
Total network requests monitored	519,104
✅ Allowed	17,692
🚫 Blocked	501,412
Block rate	96.6%
Total unique blocked domains	23

Terminology Note: The 96.6% block rate is almost entirely driven by one workflow's repeated denied calls to registry.npmjs.org (500,250 of 501,412 blocked requests, ~99.8%). Excluding that outlier, the block rate across the remaining 260 runs is closer to 0.6% (1,162 blocked / 18,854 total non-outlier requests), which is a much more representative baseline for firewall health.

🚫 Top Blocked Domains

Domain	Times Blocked	Workflows	Category
registry.npmjs.org:443	500,250	Matt Pocock Skills Reviewer, PR Code Quality Reviewer, Tidy	Development Services
proxy.golang.org:443	398	Daily Syntax Error Quality Check, Design Decision Gate 🏗️, Terminal Stylist	Development Services
api.github.com:443	313	Contribution Check, Daily Go Test Parallelizer, Daily Observability Report for AWF Firewall and MCP Gateway, Daily Syntax Error Quality Check, PR Sous Chef +2 more	Development Services
github.com:443	140	Contribution Check, Daily Go Test Parallelizer, Daily Malicious Code Scan Agent, Daily Rendering Scripts Verifier, Design Decision Gate 🏗️ +7 more	Development Services
ab.chatgpt.com:443	99	Daily Credit Limit Test, Daily Evals Feature Report, Daily Go Test Parallelizer, Daily Observability Report for AWF Firewall and MCP Gateway, Daily Storify +9 more	Analytics/Tracking
o205451.ingest.us.sentry.io:443	99	Agent Performance Analyzer, Code Scanning Fixer, Constraint Solving, Contribution Check, Copilot PR Prompt Pattern Analysis +21 more	Analytics/Tracking
api.anthropic.com:443	58	Agent Job Health Monitor, Claude Code User Documentation Review, Copilot Agent Prompt Clustering Analysis, Copilot Session Insights, Daily Caveman Optimizer +13 more	Development Services
golang.org:443	13	Terminal Stylist	Development Services
pypi.org:443	6	Daily Go Test Parallelizer	Development Services
go.opentelemetry.io:443	5	Terminal Stylist	Development Services
google.golang.org:443	5	Terminal Stylist	Development Services
raw.githubusercontent.com:443	4	Daily Go Test Parallelizer	Development Services
charm.land:443	4	Terminal Stylist	Other
cloud.google.com:443	3	Terminal Stylist	CDN
cafe.github.com:443	3	Daily Go Test Parallelizer	Other
codeload.github.com:443	2	Daily Rendering Scripts Verifier	Development Services
go.uber.org:443	2	Terminal Stylist	Development Services
go.yaml.in:443	2	Terminal Stylist	Development Services
storage.googleapis.com:443	2	Delight	CDN
gonum.org:443	1	Terminal Stylist	Development Services
gopkg.in:443	1	Terminal Stylist	Development Services
mtalk.google.com:5228	1	Multi-Device Docs Tester	Other
www.gstatic.com:443	1	Multi-Device Docs Tester	CDN

(4a–4d Policy Rule Attribution omitted: no policy_analysis data was present in any of the 261 analyzed run summaries.)

View Detailed Request Patterns by Workflow

Workflow: PR Code Quality Reviewer (7 runs analyzed)

Domain	Blocked Count	Allowed Count	Block Rate	Category
registry.npmjs.org:443	500,239	0	100%	Development Services

• Total blocked requests: 500,243 (includes 4 blocked to other minor domains)
• Total unique blocked domains: likely 1 dominant + minor
• Most frequently blocked domain: registry.npmjs.org:443
• Anomaly flag: this volume (avg. ~71,000 blocked requests/run) strongly suggests a retry storm or misconfigured install step repeatedly hitting the registry rather than distinct legitimate requests.

Workflow: Terminal Stylist (runs analyzed across period)

Domain	Blocked Count	Category
golang.org:443	13	Development Services
go.opentelemetry.io:443	5	Development Services
google.golang.org:443	5	Development Services
charm.land:443	4	Other
cloud.google.com:443	3	CDN
go.uber.org:443	2	Development Services
go.yaml.in:443	2	Development Services
gonum.org:443	1	Development Services
gopkg.in:443	1	Development Services

• Total blocked requests: 370 (including proxy.golang.org contribution)
• Most frequently blocked domain: proxy.golang.org:443 / golang.org:443
• Likely cause: Go module dependency resolution reaching module proxy/source domains not on the allowlist.

Workflow: Daily Go Test Parallelizer (runs analyzed)

Domain	Blocked Count	Category
api.github.com:443	(part of 313 total)	Development Services
github.com:443	(part of 140 total)	Development Services
ab.chatgpt.com:443	(part of 99 total)	Analytics/Tracking
pypi.org:443	6	Development Services
raw.githubusercontent.com:443	4	Development Services
cafe.github.com:443	3	Other

• Total blocked requests: 340
• Most frequently blocked domain: api.github.com:443 / github.com:443
• Likely cause: GitHub API/content calls during Go test setup not covered by the network allowlist.

Workflow: Daily Syntax Error Quality Check (runs analyzed)

• Total blocked requests: 142
• Most frequently blocked domain: proxy.golang.org:443 / api.github.com:443

(Remaining workflows each contributed ≤26 blocked requests — see the complete domain list below for full attribution.)

View Complete Blocked Domains List

Domain	Total Blocks	Workflows (sample)
ab.chatgpt.com:443	99	14 workflows incl. Daily Credit Limit Test, Daily Evals Feature Report, Daily Go Test Parallelizer, Daily Storify
api.anthropic.com:443	58	18 workflows incl. Agent Job Health Monitor, Claude Code User Documentation Review, Copilot Session Insights
api.github.com:443	313	7 workflows incl. Contribution Check, Daily Go Test Parallelizer, PR Sous Chef
cafe.github.com:443	3	Daily Go Test Parallelizer
charm.land:443	4	Terminal Stylist
cloud.google.com:443	3	Terminal Stylist
codeload.github.com:443	2	Daily Rendering Scripts Verifier
github.com:443	140	12 workflows incl. Contribution Check, Daily Malicious Code Scan Agent, Design Decision Gate 🏗️
go.opentelemetry.io:443	5	Terminal Stylist
go.uber.org:443	2	Terminal Stylist
go.yaml.in:443	2	Terminal Stylist
golang.org:443	13	Terminal Stylist
gonum.org:443	1	Terminal Stylist
google.golang.org:443	5	Terminal Stylist
gopkg.in:443	1	Terminal Stylist
mtalk.google.com:5228	1	Multi-Device Docs Tester
o205451.ingest.us.sentry.io:443	99	26 workflows (widely shared Sentry telemetry endpoint)
proxy.golang.org:443	398	Daily Syntax Error Quality Check, Design Decision Gate 🏗️, Terminal Stylist
pypi.org:443	6	Daily Go Test Parallelizer
raw.githubusercontent.com:443	4	Daily Go Test Parallelizer
registry.npmjs.org:443	500,250	Matt Pocock Skills Reviewer, PR Code Quality Reviewer, Tidy
storage.googleapis.com:443	2	Delight
www.gstatic.com:443	1	Multi-Device Docs Tester

🛡️ Security Recommendations

1. Investigate the PR Code Quality Reviewer npm retry storm immediately. 500,239 blocked requests to registry.npmjs.org in 7 runs (avg. ~71,500/run) is not normal npm traffic — this is almost certainly a broken retry loop (e.g., an npm install/npx step retrying on every failure without backoff) that is generating firewall noise, wasting CI minutes, and could mask real issues. Recommend: add registry.npmjs.org to the allowlist for this workflow if npm access is legitimately needed, and separately fix the retry logic regardless.

2. Allowlist common Go tooling domains for Terminal Stylist and other Go-based workflows: proxy.golang.org, golang.org, go.opentelemetry.io, google.golang.org, go.uber.org, go.yaml.in, gonum.org, gopkg.in are all legitimate Go module ecosystem domains. Their appearance as blocked (with 0 allowed count) suggests the network allowlist for Go-based workflows needs to include the module proxy domain set.

3. Review GitHub API domain coverage (api.github.com, github.com, cafe.github.com, codeload.github.com, raw.githubusercontent.com) for workflows like Daily Go Test Parallelizer, Contribution Check, and Design Decision Gate. These are legitimate GitHub endpoints and should likely be allowlisted rather than blocked, especially since some also show partial "allowed" counts (e.g., github.com:443 had 6 allowed vs 140 blocked), indicating inconsistent/partial allowlist coverage rather than a clean deny.

4. ab.chatgpt.com and o205451.ingest.us.sentry.io appear across a very wide set of workflows (14 and 26 respectively) with mixed allow/block outcomes (e.g., Sentry had 696 allowed vs only 99 blocked). This pattern suggests these are shared telemetry/analytics endpoints baked into the base engine image — worth allowlisting centrally at the firewall policy level (rather than per-workflow) if the traffic is confirmed benign, to reduce noise across many unrelated workflows.

5. No suspicious/unknown external domains observed. All blocked domains map to recognizable developer tooling, GitHub infrastructure, or telemetry providers — no evidence of exfiltration attempts or unexpected third-party domains in this period.

6. Policy rule data unavailable. None of the 261 analyzed run summaries included policy_analysis (rule-level hit counts, SSL Bump/DLP status). If policy-level attribution is desired going forward, the firewall log capture pipeline should be updated to emit per-rule hit data into run_summary.json.

---

Report generated from 261 cached firewall-enabled workflow run summaries out of 611 total runs collected in the last 24 hours (350 runs had no firewall_analysis and were excluded; 0 summaries were skipped due to malformed/missing data).

Generated by 🔒 Daily Firewall Logs Collector and Reporter · copilot · auto · 46.7 AIC · ⌖ 6.78 AIC · ⊞ 10.5K · ◷

• expires on Sep 19, 2026, 6:45 PM UTC-08:00