Add playwright, terraform, linux-distros, etc to network firewall #373

Activity

1. github-actions commented on Feb 22, 2026

   

   github-actionsBot

   on Feb 22, 2026 – with GitHub Actions

   Contributor

   More actions

   1 related issue

   • Add elastic domains to network firewall #209 — it addresses the same network firewall allowlist surface, and its discussion/implementation context is useful for this issue’s broader allowlist expansion.

   ---

   What is this? | From workflow: Duplicate Issue Detector

   Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.
2. github-actions commented on Feb 22, 2026

   

   github-actionsBot

   on Feb 22, 2026 – with GitHub Actions

   Contributor

   More actions

   TL;DR: I recommend adding the full GH-AW recommended ecosystem identifiers to workflow network.allowed defaults (including playwright, terraform, and linux-distros) because this repo currently only allows go/node/python/ruby and has zero occurrences of the requested identifiers.

   Recommendation

   Update the standard workflow firewall allowlist to include the complete ecosystem-identifier recommendation from GH-AW docs (containers, linux-distros, dotnet, dart, go, haskell, java, node, perl, php, python, ruby, rust, swift, terraform, playwright, plus existing defaults/github).

   Findings

   1. Current workflow defaults are narrower than GH-AW recommendations.

   # .github/workflows/gh-aw-issue-triage.md:65-73
   network:
     allowed:
       - defaults
       - github
       - go
       - node
       - python
       - ruby

   # .github/workflows/gh-aw-pr-review.md:77-85
   network:
     allowed:
       - defaults
       - github
       - go
       - node
       - python
       - ruby

   2. GH-AW reference includes additional identifiers requested in this issue (linux-distros, terraform, playwright, etc.).

   # github/gh-aw/docs/src/content/docs/reference/network.md (section: Ecosystem Identifiers)
   | `containers` | ... |
   | `linux-distros` | ... |
   | `dotnet`, `dart`, `go`, `haskell`, `java`, `node`, `perl`, `php`, `python`, `ruby`, `rust`, `swift` | ... |
   | `terraform` | ... |
   | `playwright` | ... |

   3. Prior related work exists for Elastic domains only (not ecosystem expansion): issue #209 and merged PR #214 added Elastic domains via fragment.

   # .github/workflows/gh-aw-fragments/elastic-tools.md:12-20
   network:
     allowed:
       - "agents-md-generator.fastmcp.app"
       - "public-code-search.fastmcp.app"
       - "elastic.co"
       - "www.elastic.co"
       - "cloud.elastic.co"
       - "artifacts.elastic.co"
       - "ela.st"

   Verification

   I ran repository checks to verify current coverage:

   $ python - <<'PY'
   from pathlib import Path
   import re
   from collections import Counter
   recommended=['defaults','github','containers','linux-distros','dotnet','dart','go','haskell','java','node','perl','php','python','ruby','rust','swift','terraform','playwright']
   vals=[]
   files=sorted(Path('.github/workflows').glob('gh-aw-*.md'))
   for p in files:
       t=p.read_text()
       m=re.search(r'network:\n\s+allowed:\n((?:\s+- .+\n)+)',t)
       if not m: continue
       items=[re.sub(r'^\s+-\s*','',ln).strip().strip('"\'') for ln in m.group(1).splitlines()]
       vals.extend(items)
   cnt=Counter(vals)
   print('workflow_files_with_network',len([p for p in files if 'network:\n  allowed:' in p.read_text()]))
   print('recommended_presence')
   for k in recommended:
       print(f'{k}:{cnt.get(k,0)}')
   PY
   workflow_files_with_network 38
   recommended_presence
   defaults:38
   github:38
   containers:0
   linux-distros:0
   dotnet:0
   dart:0
   go:33
   haskell:0
   java:0
   node:33
   perl:0
   php:0
   python:33
   ruby:33
   rust:0
   swift:0
   terraform:0
   playwright:0

   And a direct search confirms requested identifiers are absent in workflow sources:

   $ rg -n "playwright|terraform|linux-distros" .github/workflows
   No matches found.
   

   Detailed Action Plan

   1. Decide scope for default allowlist

      • Apply to the baseline set used by most workflows (currently defaults/github/go/node/python/ruby).
      • Keep specialized domain entries (e.g., docs/buildkite domains) unchanged.

   2. Update workflow source files

      • Edit .github/workflows/gh-aw-*.md files that currently have the baseline block like:
        • .github/workflows/gh-aw-issue-triage.md:65-73
        • .github/workflows/gh-aw-pr-review.md:77-85
      • Add missing recommended identifiers under network.allowed.

   3. Regenerate compiled workflows

      • Run make compile to refresh .github/workflows/gh-aw-*.lock.yml.

   4. Validate

      • Run make lint (or at minimum make lint-workflows if that is the repo’s targeted workflow validation).
      • Spot-check one lock file (e.g., .github/workflows/gh-aw-issue-triage.lock.yml) to confirm the AWF --allow-domains expansion includes the newly enabled ecosystems.

   5. Optional hardening follow-up

      • If maintainers want tighter least-privilege, follow with per-workflow pruning once real usage data is collected (instead of broad defaults everywhere).

   Related Items

   Type	Link	Relevance
   Issue	#373	Current request
   Issue	#209	Prior firewall expansion (Elastic domains only)
   PR	#214	Implemented #209; confirms firewall config path and workflow pattern
   File	.github/workflows/gh-aw-issue-triage.md:65-73	Current baseline network.allowed block
   File	.github/workflows/gh-aw-pr-review.md:77-85	Same baseline in another major workflow
   File	.github/workflows/gh-aw-fragments/elastic-tools.md:12-20	Existing shared domain additions from prior work
   Upstream Doc	github/gh-aw/docs/src/content/docs/reference/network.md	Source of ecosystem identifier recommendation

   ---

   What is this? | From workflow: Issue Triage

   Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.
3. strawgate

   assigned

   Copilot

   and

   strawgate

   on Feb 22, 2026
4. strawgate

   closed this as completedin #374on Feb 22, 2026