ci: update egress policy (#137)

Signed-off-by: Sertac Ozercan <[email protected]>
sozercan · Feb 12, 2024 · fd5dd75 · fd5dd75
1 parent 3fe6e67
commit fd5dd75
Show file tree

Hide file tree

Showing 2 changed files with 19 additions and 2 deletions.
diff --git a/.github/workflows/patch-models.yaml b/.github/workflows/patch-models.yaml
@@ -43,7 +43,22 @@ jobs:
         - name: Harden Runner
           uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0
           with:
-            egress-policy: audit
+            egress-policy: block
+            allowed-endpoints: >
+              api.github.com:443
+              auth.docker.io:443
+              fulcio.sigstore.dev:443
+              ghcr.io:443
+              github.com:443
+              objects.githubusercontent.com:443
+              pkg-containers.githubusercontent.com:443
+              production.cloudflare.docker.com:443
+              proxy.golang.org:443
+              registry-1.docker.io:443
+              rekor.sigstore.dev:443
+              storage.googleapis.com:443
+              tuf-repo-cdn.sigstore.dev:443
+              deb.debian.org:80
 
         - name: Set up Docker Buildx
           uses: docker/setup-buildx-action@f95db51fddba0c2d1ec667646a06c2ce06100226 # v3.0.0

diff --git a/.github/workflows/update-models.yaml b/.github/workflows/update-models.yaml
@@ -55,13 +55,15 @@ jobs:
             gcr.io:443
             ghcr.io:443
             github.com:443
-            huggingface.co:443
+            *.huggingface.co:443
             *.githubusercontent.com:443
             production.cloudflare.docker.com:443
             registry-1.docker.io:443
             rekor.sigstore.dev:443
             storage.googleapis.com:443
             tuf-repo-cdn.sigstore.dev:443
+            sertaccdn.azureedge.net:443
+            developer.download.nvidia.com:443
 
       - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1