Add allowed domains from network config to sanitization environment variable by Copilot · Pull Request #2138 · github/gh-aw

Copilot · 2025-10-22T13:53:11Z

Problem

The sanitize_output.cjs JavaScript file has hardcoded default allowed domains, but it should receive the combined set of:

Default GitHub-related domains for sanitization
Custom domains from the network frontmatter configuration

Solution

This PR provides allowed domains to the JavaScript sanitization code via the GH_AW_ALLOWED_DOMAINS environment variable by combining default GitHub domains with network permission domains.

Implementation

Domain Management in Ecosystem System:

Created github-sanitization ecosystem in ecosystem_domains.json containing default GitHub domains (github.com, github.io, githubusercontent.com, githubassets.com, github.dev, codespaces.new)
Created playwright-localhost ecosystem in ecosystem_domains.json for localhost domains
Moved ComputeAllowedDomainsForSanitization function to domains.go to centralize domain management
Removed domain constants from constants.go - all domain lists now managed through the ecosystem system

Workflow Compilation:

Compiler always sets GH_AW_ALLOWED_DOMAINS environment variable in generated workflows
Combines github-sanitization domains with network permission domains (which expand ecosystem identifiers)
Deduplicates and sorts domains for consistency

How It Works:

ComputeAllowedDomainsForSanitization() retrieves domains from network permissions using GetAllowedDomains()
Always includes domains from the github-sanitization ecosystem
Network permissions can specify ecosystem identifiers (defaults, python, etc.) or custom domains
All domains are deduplicated and sorted before being set in GH_AW_ALLOWED_DOMAINS

Example

For a workflow with:

network:
  allowed:
    - defaults
    - python
    - example.com

The compiled workflow includes:

env:
  GH_AW_ALLOWED_DOMAINS: "*.pythonhosted.org,anaconda.org,...,github.com,github.io,...,example.com,..."

This provides:

GitHub sanitization domains (always included)
Ecosystem "defaults" domains (certificates, Ubuntu mirrors, etc.)
Ecosystem "python" domains (PyPI, Conda, etc.)
Custom domain (example.com)

Testing

✅ All unit tests pass
✅ All integration tests pass
✅ JavaScript tests pass
✅ Compiled workflows include GH_AW_ALLOWED_DOMAINS with complete domain list
✅ Code formatted with go fmt

Benefits

Centralized Management: All domain lists managed in ecosystem_domains.json
Consistent Pattern: Sanitization and Playwright domains use the same ecosystem system
Maintainable: Domain updates only require changes to the JSON file
Secure: GitHub sanitization domains always included, network permissions add additional allowed domains

Original prompt

The list of allowed domains used in the url validation JavaScript code should be provided as an environment variable by the compiler and use by the JavaScript code.

The content of the variable is the default set of domains + custom domains provided by the user in the top level "network" front matter configuration.

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.

- Create computeAllowedDomainsForSanitization helper function - Combine default GitHub domains with network permissions - Set GH_AW_ALLOWED_DOMAINS environment variable in compiled workflows - Add comprehensive unit and integration tests - Recompile all workflow lock files with new allowed domains Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

pelikhan · 2025-10-22T15:07:14Z

pkg/workflow/compiler.go

+// by combining default GitHub domains with domains from network permissions
+func computeAllowedDomainsForSanitization(data *WorkflowData) []string {
+	// Start with default GitHub-related domains that match the JavaScript defaults
+	defaultDomains := []string{


@copilot use existing default domains from network.go

Done. Moved the default GitHub domains to constants.DefaultSanitizationDomains in pkg/constants/constants.go and updated the compiler and tests to use this constant instead of hardcoding the domains. This centralizes the domain list for easier maintenance. (f7801f5)

- Move DefaultSanitizationDomains to pkg/constants/constants.go - Update computeAllowedDomainsForSanitization to use constants.DefaultSanitizationDomains - Update tests to use the constant instead of hardcoded arrays - Simplifies maintenance and ensures consistency across codebase Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

pelikhan · 2025-10-22T16:04:21Z

pkg/constants/constants.go


+// DefaultSanitizationDomains defines the default GitHub-related domains
+// that are always allowed in output sanitization
+var DefaultSanitizationDomains = []string{


@copilot

remove, use default domains in domains.go instead

make sure these domains are in the default set

Done. Created github-sanitization ecosystem in ecosystem_domains.json and updated ComputeAllowedDomainsForSanitization to always include these domains. (10a09a3)

pelikhan · 2025-10-22T16:04:52Z

pkg/constants/constants.go

@@ -60,6 +60,17 @@ const DefaultMCPStartupTimeoutSeconds = 120
 // that are always allowed for Playwright browser automation
 var DefaultAllowedDomains = []string{"localhost", "localhost:*", "127.0.0.1", "127.0.0.1:*"}


@copilot move to domains.go as a domain set

Done. Created playwright-localhost ecosystem in ecosystem_domains.json with the localhost domains. (10a09a3)

pelikhan · 2025-10-22T16:05:10Z

pkg/workflow/compiler.go

 // needsGitCommands checks if safe outputs configuration requires Git commands
+// computeAllowedDomainsForSanitization computes the list of allowed domains for output sanitization
+// by combining default GitHub domains with domains from network permissions
+func computeAllowedDomainsForSanitization(data *WorkflowData) []string {


@copilot move to domains.go

Done. Moved ComputeAllowedDomainsForSanitization to domains.go and made it use ecosystem domains. (10a09a3)

- Add github-sanitization ecosystem to ecosystem_domains.json - Add playwright-localhost ecosystem to ecosystem_domains.json - Move ComputeAllowedDomainsForSanitization from compiler.go to domains.go - Remove DefaultSanitizationDomains and DefaultAllowedDomains from constants.go - Update all references to use ecosystem domains instead - Sanitization always includes github-sanitization domains plus network permissions Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

…ariable Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Initial plan

14091c1

Copilot AI assigned Copilot and pelikhan Oct 22, 2025

Copilot started work on behalf of pelikhan October 22, 2025 13:53 View session

Copilot AI and others added 3 commits October 22, 2025 14:10

Apply go fmt formatting

fcb3db2

Final validation - all tests pass

8ae53f6

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot AI changed the title ~~[WIP] Add environment variable for allowed domains in URL validation~~ Add allowed domains from network config to sanitization environment variable Oct 22, 2025

Copilot AI requested a review from pelikhan October 22, 2025 14:20

Copilot finished work on behalf of pelikhan October 22, 2025 14:20

pelikhan reviewed Oct 22, 2025

View reviewed changes

Copilot started work on behalf of pelikhan October 22, 2025 15:07 View session

Copilot AI requested a review from pelikhan October 22, 2025 15:23

Copilot finished work on behalf of pelikhan October 22, 2025 15:23

pelikhan reviewed Oct 22, 2025

View reviewed changes

Copilot started work on behalf of pelikhan October 22, 2025 16:05 View session

Copilot AI and others added 2 commits October 22, 2025 16:21

Add allowed domains from network config to sanitization environment v…

eabc803

…ariable Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot AI requested a review from pelikhan October 22, 2025 16:23

Copilot finished work on behalf of pelikhan October 22, 2025 16:23

pelikhan closed this Oct 22, 2025

pelikhan deleted the copilot/add-allowed-domains-env-variable branch October 23, 2025 21:23

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Comments

Add allowed domains from network config to sanitization environment variable#2138

Add allowed domains from network config to sanitization environment variable#2138
Copilot wants to merge 7 commits intomainfrom
copilot/add-allowed-domains-env-variable

Copilot AI commented Oct 22, 2025 •

edited

Loading

Uh oh!

pelikhan Oct 22, 2025

Uh oh!

Copilot AI Oct 22, 2025

Uh oh!

pelikhan Oct 22, 2025

Uh oh!

Copilot AI Oct 22, 2025

Uh oh!

pelikhan Oct 22, 2025

Uh oh!

Copilot AI Oct 22, 2025

Uh oh!

pelikhan Oct 22, 2025

Uh oh!

Copilot AI Oct 22, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

		@@ -60,6 +60,17 @@ const DefaultMCPStartupTimeoutSeconds = 120
		// that are always allowed for Playwright browser automation
		var DefaultAllowedDomains = []string{"localhost", "localhost:", "127.0.0.1", "127.0.0.1:"}

Comments

Conversation

Copilot AI commented Oct 22, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Problem

Solution

Implementation

Example

Testing

Benefits

Uh oh!

pelikhan Oct 22, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Oct 22, 2025

Choose a reason for hiding this comment

Uh oh!

pelikhan Oct 22, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Oct 22, 2025

Choose a reason for hiding this comment

Uh oh!

pelikhan Oct 22, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Oct 22, 2025

Choose a reason for hiding this comment

Uh oh!

pelikhan Oct 22, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Oct 22, 2025

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Copilot AI commented Oct 22, 2025 •

edited

Loading