CI(harden-runner): Allow Yarn egress endpoints - #137
Merged
tykeal merged 1 commit intoJul 28, 2026
Merged
Conversation
Copilot started reviewing on behalf of
ModeSevenIndustrialSolutions
July 28, 2026 17:48
View session
There was a problem hiding this comment.
Pull request overview
Updates the harden-runner egress allow-list to support Yarn classic installs in CI by permitting outbound TLS traffic to Yarn’s default registry host.
Changes:
- Added
registry.yarnpkg.com:443to.github/harden-runner/lfreleng-actions/allow_list.txt. - Documented the rationale inline, consistent with surrounding allow-list annotations.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Align the harden-runner egress allow-list with Yarn's documented corporate-firewall requirements, which name three hosts: registry.yarnpkg.com, registry.npmjs.org and dl.yarnpkg.com. Under block mode only registry.npmjs.org was allowed, so 'yarn install' for Yarn-based projects failed with ECONNREFUSED against registry.yarnpkg.com (Yarn classic's default registry, an npm-operated CDN alias). Add registry.yarnpkg.com, plus dl.yarnpkg.com for cases where Yarn itself is fetched or upgraded, to cover the full documented set and avoid corner-case failures. Co-authored-by: Claude <noreply@anthropic.com> Signed-off-by: Matthew Watkins <mwatkins@linuxfoundation.org>
ModeSevenIndustrialSolutions
force-pushed
the
ci/allow-yarn-registry-egress
branch
from
July 28, 2026 17:58
2d55361 to
19b1491
Compare
ModeSevenIndustrialSolutions
changed the title
Copilot started reviewing on behalf of
ModeSevenIndustrialSolutions
July 28, 2026 17:58
View session
tykeal
approved these changes
Jul 28, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
CI(harden-runner): Allow Yarn egress endpoints
Aligns the harden-runner egress allow-list
(
.github/harden-runner/lfreleng-actions/allow_list.txt) with Yarn'sdocumented corporate-firewall requirements, which name three hosts:
registry.npmjs.orgregistry.yarnpkg.comresolvedURLs inyarn.lock)dl.yarnpkg.comWhy
Yarn classic resolves packages from
registry.yarnpkg.com, notregistry.npmjs.org. Under harden-runner block mode the listcovered only the npm registry, so
yarn installfailed withECONNREFUSED.Observed live: the
node-workflowsverify caller for the ONAPsdc/sdc-workflow-designerUI frontend (a Yarn project) failed at[2/4] Fetching packageswithconnect ECONNREFUSED. The definitivehost list was cross-checked three ways — the project's committed
yarn.lock(1853resolvedURLs onregistry.yarnpkg.com, 2 onregistry.npmjs.org), theregistry.yarnpkg.com→yarn.npmjs.orgCNAME, and Yarn's own documented firewall allow-list.
dl.yarnpkg.comis included from that documented set to avoid corner-case failures
when Yarn itself is fetched/upgraded (
yarn set version, Corepack,distro packages), even though it was not exercised in the failing run.
Notes
LC_ALL=Calphabetical order, withprovenance comments per the file's convention.
across LF Node.js projects.
Follow-up
Once released, the
node-workflowsharden_runner_allowlistpin willbe bumped to the new tag (coordinated with
lfreleng-actions/node-workflows#24).