Context
From the Daily Firewall Report - 2026-04-03, the firewall blocked 28 requests across 15 workflow runs. Several are legitimate allowlist gaps that need fixing.
Tasks
🔴 High Priority: Dependabot Dependency Checker
Add Go ecosystem domains to proxy.golang.org (5 blocks) and pkg.go.dev (1 block) are causing silent failures in Go dependency resolution.
File: The Dependabot Dependency Checker workflow markdown file (search for dependabot under .github/workflows/ or top-level *.md workflow files).
Update the network.allowed section:
network:
allowed:
- defaults
- proxy.golang.org
- sum.golang.org
- pkg.go.dev🟡 Medium Priority: Glossary Maintainer
nodejs.org (1 block) — the workflow fetches Node.js release metadata or downloads tooling. Add nodejs.org to its network allowlist if it is a legitimate dependency.
🟡 Medium Priority: GPL Dependency Cleaner
storage.googleapis.com (1 block) — used for downloading tools/packages. Add storage.googleapis.com to its allowlist if confirmed as a legitimate dependency.
🟡 Medium Priority: Investigate github.com vs .github.com policy gap
The Changeset Generator and AI Moderator workflows use a restricted custom allowlist that excludes github.com (bare) and api.github.com. The default policy allows *.github.com (subdomain wildcard) but not the bare github.com hostname.
- Check whether these workflows legitimately need direct
github.com / api.github.com access.
- If yes, add explicit entries to their custom allowlists or switch to GitHub MCP toolsets.
- If not, document that these blocks are expected.
🧹 Low Priority: Cleanup unused regex rule
The allow-both-regex rule (matches *.jsr.io) had 0 hits today. If jsr.io is not actively used by any workflow, remove the regex rule to simplify the firewall policy.
Acceptance Criteria
References
Generated by Plan Command for issue #discussion #24286 · ● 140.4K · ◷
Context
From the Daily Firewall Report - 2026-04-03, the firewall blocked 28 requests across 15 workflow runs. Several are legitimate allowlist gaps that need fixing.
Tasks
🔴 High Priority: Dependabot Dependency Checker
Add Go ecosystem domains to
proxy.golang.org(5 blocks) andpkg.go.dev(1 block) are causing silent failures in Go dependency resolution.File: The Dependabot Dependency Checker workflow markdown file (search for
dependabotunder.github/workflows/or top-level*.mdworkflow files).Update the
network.allowedsection:🟡 Medium Priority: Glossary Maintainer
nodejs.org(1 block) — the workflow fetches Node.js release metadata or downloads tooling. Addnodejs.orgto its network allowlist if it is a legitimate dependency.🟡 Medium Priority: GPL Dependency Cleaner
storage.googleapis.com(1 block) — used for downloading tools/packages. Addstorage.googleapis.comto its allowlist if confirmed as a legitimate dependency.🟡 Medium Priority: Investigate github.com vs .github.com policy gap
The Changeset Generator and AI Moderator workflows use a restricted custom allowlist that excludes
github.com(bare) andapi.github.com. The default policy allows*.github.com(subdomain wildcard) but not the baregithub.comhostname.github.com/api.github.comaccess.🧹 Low Priority: Cleanup unused regex rule
The
allow-both-regexrule (matches*.jsr.io) had 0 hits today. Ifjsr.iois not actively used by any workflow, remove the regex rule to simplify the firewall policy.Acceptance Criteria
proxy.golang.org,sum.golang.org,pkg.go.devnodejs.orgaccess is not needed)storage.googleapis.comis not needed)github.com/api.github.comgap investigated and resolved (either allowlist updated or behavior confirmed as expected)allow-both-regex/*.jsr.iorule removed if confirmed unusedReferences