[imnasnainaec]

Summary

harden-runner v2.22.2 (bumped in #4407) only accepts wildcards of the form *.domain. It treats *-docker.pkg.dev as a literal hostname, so it blocks the redirect from registry.k8s.io to <region>-docker.pkg.dev.

 allowed-endpoints: >
-  *-docker.pkg.dev:443
   *.cloudfront.net:443
+  *.pkg.dev:443

This applies to both installer.yml and installer_release.yml.

Evidence

• Before: make_installer on #4407 fails on docker pull registry.k8s.io/ingress-nginx/controller:v1.15.1@sha256:...:

  lookup us-west2-docker.pkg.dev on 127.0.0.53:53: ... write: operation not permitted
  

  The agent log shows *-docker.pkg.dev. under exactDomains. Only *.-prefixed entries (such as *.cloudfront.net.) show up under wildcardDomains.
  After: make_installer passes on Bump the gha-deps group across 1 directory with 20 updates #4407 once it is rebased onto this PR.

Merge Danger

Door: two-way

Blast Radius: CI-only

The installer jobs can now reach any *.pkg.dev host (all Artifact Registry formats), not just Docker registries. The narrower option is to list every regional <region>-docker.pkg.dev host, but registry.k8s.io chooses the region on its side, so that list could go stale.

🤖 Generated with Claude Code

---

This change is 

Summary by CodeRabbit

• Bug Fixes
  • Updated installer network access to support a broader range of package registry endpoints. CloudFront access remains unchanged.

[coderabbitai]

📝 Walkthrough

Both installer workflows replace the Docker-specific registry endpoint pattern in their allowlists with the broader *.pkg.dev:443 pattern. Both continue to allow *.cloudfront.net:443.

Changes: Installer endpoint allowlists

Layer / File(s)	Summary
Broaden installer endpoint patterns .github/workflows/installer.yml, .github/workflows/installer_release.yml	Both workflow allowlists replace *-docker.pkg.dev:443 with *.pkg.dev:443. Both retain *.cloudfront.net:443.

Priority: ➖ Normal

Estimated code review effort: 1 (Trivial) | ~3 minutes

Change: Bug fix

Suggested reviewers: copilot

Merge Risk: 🔵 Low · up to 5bdd5

The workflows currently grant broader Artifact Registry network access than the installer requires; narrow the allowlist before merging.

Pre-merge checks: 5

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly identifies the GitHub Actions change and the expansion of the installer harden-runner allowlist to permit *.pkg.dev endpoints.
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (2 skipped: 2 unsupported.)

✨ Finishing Touches: 💡 1

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

🛠️ Fix failing CI checks: 💡

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 76.26%. Comparing base (d49d2e4) to head (5bdd5a6).

Additional details and impacted files

@@           Coverage Diff           @@
##           master    #4408   +/-   ##
=======================================
  Coverage   76.26%   76.26%           
=======================================
  Files         305      305           
  Lines       11452    11452           
  Branches     1409     1409           
=======================================
  Hits         8734     8734           
  Misses       2324     2324           
  Partials      394      394           

Flag	Coverage Δ
backend	87.55% <ø> (ø)
frontend	67.09% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.