Chore: Bump harden-runner allow-list to v0.16.0 - #33
Merged
ModeSevenIndustrialSolutions merged 1 commit intoAug 26, 2026
Conversation
ModeSevenIndustrialSolutions
requested review from
a team
and
a balanced review from Copilot
August 26, 2026 08:44
Copilot started reviewing on behalf of
ModeSevenIndustrialSolutions
August 26, 2026 08:44
View session
There was a problem hiding this comment.
Pull request overview
Updates the shared harden-runner egress allow-list to v0.16.0 for Java build workflows.
Changes:
- Pins Maven and Gradle workflow defaults to commit
f0f76ac(v0.16.0). - Expands permitted package-repository endpoints in block mode.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
.github/workflows/maven-build-test.yaml |
Updates the Maven allow-list pin. |
.github/workflows/gradle-build-test.yaml |
Updates the Gradle allow-list pin. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Refresh the shared egress allow-list pin from lfreleng-actions/.github v0.14.0 to v0.16.0, taking the list from 176 entries to 191. v0.16.0 adds wildcard coverage for Linux distribution package repositories -- Alma, Alpine, Arch, CentOS, Debian, Fedora, openSUSE, Red Hat, Rocky, SUSE and Ubuntu -- plus Amazon Linux, CentOS Stream, Red Hat subscription management, index.docker.io and Anchore's toolbox data host. Workflows running in block mode could not reach distro mirrors before this. Five narrower entries disappear as literals -- deb.debian.org:80, dl-cdn.alpinelinux.org:443, esm.ubuntu.com:443, keyserver.ubuntu.com:443 and motd.ubuntu.com:443 -- but each falls inside one of the new wildcards (*.debian.org:80, *.alpinelinux.org:443, *.ubuntu.com:443), so no endpoint loses coverage. The pin appears in two forms and both move together: the full coordinate on workflow input defaults, and the ref-only shorthand release-drafter hands straight to harden-runner-block-action. Co-authored-by: Claude <noreply@anthropic.com> Signed-off-by: Matthew Watkins <mwatkins@linuxfoundation.org>
ModeSevenIndustrialSolutions
force-pushed
the
chore/bump-allow-list-v0.16.0
branch
from
August 26, 2026 08:58
a9cabbb to
2424c0a
Compare
Copilot started reviewing on behalf of
ModeSevenIndustrialSolutions
August 26, 2026 08:58
View session
Copilot started reviewing on behalf of
ModeSevenIndustrialSolutions
August 26, 2026 09:00
View session
askb
approved these changes
Aug 26, 2026
ModeSevenIndustrialSolutions
merged commit Aug 26, 2026
22e0f5d
into
lfreleng-actions:main
11 checks passed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Refreshes the shared harden-runner egress allow-list pin from
lfreleng-actions/.githubv0.14.0 (4e69521) to v0.16.0 (f0f76ac), across 3 references:release-drafter.yaml:33Only pinned SHAs and their version comments change.
What v0.16.0 brings
The list grows from 176 entries to 191. The substantive addition is wildcard coverage for Linux distribution package repositories — Alma, Alpine, Arch, CentOS, Debian, Fedora, openSUSE, Red Hat, Rocky, SUSE and Ubuntu — plus Amazon Linux, CentOS Stream, Red Hat subscription management,
index.docker.ioand Anchore's toolbox data host. Workflows running inblockmode could not reach distro mirrors before this.No endpoint loses coverage
Five narrower entries disappear as literals, but each falls inside one of the new wildcards:
deb.debian.org:80*.debian.org:80dl-cdn.alpinelinux.org:443*.alpinelinux.org:443esm.ubuntu.com:443*.ubuntu.com:443keyserver.ubuntu.com:443*.ubuntu.com:443motd.ubuntu.com:443*.ubuntu.com:443Validation
prek(all hooks, via commit),actionlintandzizmor --persona=auditor— zero findings.