fix: spec-author harden-runner allowed-endpoints（v1.5.1，W0-C4 #133，ADR-0050）

[randypanding]

同 fix-harden-runner-endpoints（allowed-urls 被 v2.21.0 静默忽略）。合并后发 v1.5.1 并更新 conductor 钉点。

[coderabbitai]

Warning

Review limit reached

@randypanding, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 1 minute

Limit details: You’ve used all 10 included reviews currently available.

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

Wait for the limit to reset, then comment @coderabbitai review or push new commits to the PR.

An organization admin can change what happens after included review limits in Billing.

How do review limits work?

CodeRabbit enforces per-developer PR review limits within each organization.

For paid Pro and Pro+ reviews, CodeRabbit uses a developer's included PR review attempts over the past 7 days to set the current hourly allowance. At typical activity levels, the full plan allowance applies. Higher sustained activity can lower the allowance until earlier attempts leave the 7-day window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: ce96afc9-d0ee-4fe1-acb2-a727ab590123

📥 Commits

Reviewing files that changed from the base of the PR and between 8cc9f76 and 80237fd.

📒 Files selected for processing (1)

• .github/workflows/spec-author.yml

---

_{Comment @coderabbitai help to get the list of available commands.}

[qodo-code-review]

PR Summary by Qodo

Fix spec-author harden-runner egress allowlist by using allowed-endpoints

🐞 Bug fix ⚙️ Configuration changes 🕐 Less than 10 minutes

AI Description

• Switch harden-runner allowlist to allowed-endpoints to match v2.21.0 behavior.
• Explicitly pin allowed outbound hosts with :443 to keep egress-policy=block effective.

Diagram

graph TD
  wf["spec-author.yml workflow"] --> hr["step-security/harden-runner v2.21.0"] --> ep["allowed-endpoints allowlist"] --> gh["GitHub endpoints :443"] & bm["open.bigmodel.cn :443"]

Loading

High-Level Assessment

The following are alternative approaches to this PR:

1. Downgrade harden-runner to a version that supports allowed-urls

• ➕ Avoids changing configuration semantics (URL vs endpoint).
• ➕ May be consistent with existing org-wide workflows if they still use allowed-urls.
• ➖ Keeps CI on an older security tool version.
• ➖ Requires validating the older version’s behavior and security posture.

2. Relax egress policy (audit/allow) instead of block

• ➕ Less likely to break workflows if endpoints change.
• ➕ Can gather telemetry before enforcing strict blocking.
• ➖ Reduces protection against unexpected outbound network access.
• ➖ Does not address the current issue of allowlist being silently ignored under block.

Recommendation: Keep the PR’s approach: on harden-runner v2.21.0, using allowed-endpoints with explicit :443 entries is the most direct way to ensure egress-policy=block is actually enforced, avoiding the silent ignore of allowed-urls.

Files changed (1) +5 / -5

Other (1) +5 / -5

spec-author.ymlReplace harden-runner allowed-urls with allowed-endpoints (:443) +5/-5

Replace harden-runner allowed-urls with allowed-endpoints (:443)

• Updates the step-security/harden-runner configuration to use allowed-endpoints instead of allowed-urls. Adds explicit host:port entries so outbound access remains restricted when egress-policy is set to block.

.github/workflows/spec-author.yml

[qodo-code-review]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0)

Great, no issues found!

Qodo reviewed your code and found no material issues that require review

Tip of the day

💡 Did you know, you can tweak Display preferences with a live preview to see your comment before it ships

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗