Skip to content

[deep-report] Add npm ecosystem to network.allowed for Daily Rendering Scripts Verifier (firewall block storm, 30-min timeout) #54394

Description

@github-actions

Description: daily-rendering-scripts-verifier.md declares tools.bash entries npm*/npx *, but its network.allowed list (inherited from the shared/otlp.md import) only contains *.sentry.io and *.grafana.net — no npm registry access. Verified live in the frontmatter. The Agentic Workflow Audit (#54358) found this caused a firewall block storm: one run generated 2,436,385 blocked requests to registry.npmjs.org in 36.8 minutes (99.98% of all requests in that run) before hitting its 30-minute timeout and failing via driver_exit. This is the same shape of gap as the previously-filed npm-allowlist issue for PureLock/Dead Code Removal Agent/Daily AIC Consumption Report (#54290, prior cycle) — a different, newly-identified workflow missing the node ecosystem preset.

Expected Impact: Eliminates a 30-minute timeout failure and ~2.4M wasted blocked requests per occurrence; restores this workflow's daily verification coverage.

Suggested Agent: New Agent (frontmatter config fix)

Estimated Effort: Fast (< 30 min) — add network: { allowed: [node] } (or the equivalent ecosystem preset) to daily-rendering-scripts-verifier.md

Data Source: DeepReport analysis of Agentic Workflow Audit (#54358), 2026-08-20 cycle; verified live against .github/workflows/daily-rendering-scripts-verifier.md and its shared/otlp.md import

Generated by 🔬 Deep Report · agent · 165.2 AIC · ⌖ 20.3 AIC · ⊞ 11.9K · ◷

  • expires on Aug 22, 2026, 4:39 PM UTC-08:00

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Type

No type

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions