Add elastic domains to network firewall #209

Activity

1. github-actions commented on Feb 20, 2026

   

   github-actionsBot

   on Feb 20, 2026 – with GitHub Actions

   Contributor

   More actions

   TL;DR: We should add a shared Elastic domain allowlist in .github/workflows/gh-aw-fragments/elastic-tools.md and recompile, because current workflow firewall config includes no *.elastic.* domains.

   Recommendation

   Add common public Elastic domains in one shared place (.github/workflows/gh-aw-fragments/elastic-tools.md) so all gh-aw workflows inherit them, then run make compile to regenerate .lock.yml files and verify the compiled --allow-domains list includes them.

   Findings

   • All workflow shims import the same fragment: .github/workflows/gh-aw-*.md all include gh-aw-fragments/elastic-tools.md at line 4 (verified by repository-wide search).
   • Workflow-level network config is currently generic package/github access (example: .github/workflows/gh-aw-issue-triage.md:50-57):

   network:
     allowed:
       - defaults
       - github
       - go
       - node
       - python
       - ruby
   

   • The shared Elastic fragment currently only adds FastMCP hosts, not Elastic domains (.github/workflows/gh-aw-fragments/elastic-tools.md:12-15):

   network:
     allowed:
       - "agents-md-generator.fastmcp.app"
       - "public-code-search.fastmcp.app"
   

   • Compiled firewall invocation in .github/workflows/gh-aw-issue-triage.lock.yml:892 has a long --allow-domains list with no elastic.co/cloud.elastic.co entries.
   • I did not find prior issue/PR discussion specifically about adding Elastic domains to firewall rules (issue/PR searches for firewall/domain/allow-domains were effectively empty for this exact ask).

   Verification

   I ran local checks in the workspace:

   $ cd /home/runner/work/ai-github-actions/ai-github-actions
   $ echo 'network_blocks='$(grep -h '^network:' .github/workflows/gh-aw-*.md | wc -l)
   network_blocks=26
   
   $ echo 'elastic_domain_hits_in_md='$(grep -Eho 'elastic\.co|cloud\.elastic|artifacts\.elastic|www\.elastic' .github/workflows/gh-aw-*.md | wc -l)
   elastic_domain_hits_in_md=0
   
   $ grep -n -- '--allow-domains' .github/workflows/gh-aw-issue-triage.lock.yml | head -n 1
   892: ... --allow-domains '...hub.lumenfield.work,...public-code-search.fastmcp.app,...' ...

   Detailed Action Plan

   1. Edit .github/workflows/gh-aw-fragments/elastic-tools.md and append a curated Elastic allowlist under network.allowed (for example: elastic.co, www.elastic.co, cloud.elastic.co, artifacts.elastic.co, ela.st).
   2. Keep workflow shims unchanged unless a workflow needs a stricter/specialized list; all current shims already import this fragment at line 4.
   3. Run make compile to regenerate .github/workflows/gh-aw-*.lock.yml.
   4. Validate output by checking at least one regenerated lock file (.github/workflows/gh-aw-issue-triage.lock.yml) contains the new domains in the --allow-domains command near line ~892.
   5. Run make lint-workflows to ensure generated workflows remain valid.
   6. Open PR with fragment change + regenerated lock files together.

   Related Items

   Type	Link	Relevance
   Issue	#209	Current request
   File	.github/workflows/gh-aw-fragments/elastic-tools.md:12-15	Shared network fragment (best central edit point)
   File	.github/workflows/gh-aw-issue-triage.md:50-57	Typical workflow network allow aliases
   File	.github/workflows/gh-aw-issue-triage.lock.yml:892	Compiled firewall --allow-domains evidence
   PR	#14	Initial gh-aw workflow introduction; context for how network config is centralized via fragments

   ---

   What is this? | From workflow: Issue Triage Agent

   Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not. for issue #209
2. strawgate commented on Feb 20, 2026

   

   strawgate

   on Feb 20, 2026

   ContributorAuthor

   More actions

   /ai make a pr

   👀React with 👀1Reacted by github-actions
3. github-actions commented on Feb 20, 2026

   

   github-actionsBot

   on Feb 20, 2026 – with GitHub Actions

   Contributor

   More actions

   TL;DR: I opened a PR that adds common Elastic domains to the shared firewall fragment copy and validated with make lint-workflows.

   Implemented change:

   • Added github/workflows/gh-aw-fragments/elastic-tools.md
   • Extended network.allowed with elastic.co, www.elastic.co, cloud.elastic.co, artifacts.elastic.co, and ela.st

   Note: this environment disallows direct edits under .github/workflows/, so I placed the update in github/workflows/...; after merge, a maintainer should relocate it to .github/workflows/gh-aw-fragments/elastic-tools.md and run make compile to regenerate lock files.

   ---

   What is this? | From workflow: Issue Assistant

   Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not. for issue #209
4. strawgate

   closed this as completedin #214on Feb 20, 2026