👷 ci(test): allow setup-go toolchain download endpoints in harden-runner

[oldmanbendobot]

What

Adds the four endpoints setup-go's cold toolchain download path needs to the terratest job's harden-runner allowlist (alphabetical, folded-scalar style preserved):

• api.github.com:443
• dl.google.com:443
• raw.githubusercontent.com:443
• release-assets.githubusercontent.com:443

Why

Dependabot #205 (terratest 1.0.0 → 1.0.1) exact-pins go 1.26.0 via go.mod; when the runner toolcache lacks that exact version, setup-go must download it and harden-runner blocks the path. Verified in run 29576642644:

Failed to download version 1.26.0: Error: connect ECONNREFUSED 54.185.253.63:443
domain not allowed: api.github.com.
domain not allowed: raw.githubusercontent.com.
domain not allowed: dl.google.com.

Same known-latent landmine fixed in defaults#260, apigateway#92, template#109, jwt-authz#102 — null-context's turn to trip it. Once merged, a plain @dependabot rebase heals #205 (pull_request runs read workflows from the merge ref).

🤖 Generated with Claude Code

Summary by CodeRabbit

• Chores
  • Improved automation reliability by updating approved external service access for build and validation workflows.
  • Enhanced runner configuration to support required integrations and retrieve dependencies and release resources consistently.
  • No user-facing product functionality or interface changes.

[coderabbitai]

Walkthrough

The test workflow’s runner hardening configuration now permits additional GitHub, AWS, HashiCorp, Discord, Google, npm, Terraform, and release asset endpoints.

Changes

Runner hardening

Layer / File(s)	Summary
Expand allowed endpoints .github/workflows/test.yml	The allowed-endpoints list adds service APIs, GitHub content hosts, CDN endpoints, and artifact registries required by the workflow.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Poem

A rabbit checks the runner’s gate,
New hosts arrive to communicate.
GitHub, clouds, and packages bright,
Pass through the allowlist just right.
Hop, hop—tests take flight!

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the main change: expanding the harden-runner allowlist for setup-go downloads.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch ci/test-egress-go-toolchain

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/test.yml:
- Around line 29-36: Restrict the setup-go egress allowlist in the workflow to
only the four hosts required by the stated setup-go dependency. Remove the
unrelated apigateway, budgets, checkpoint-api, cloudfront, and cognito-idp
entries from both referenced allowlist sections; retain any host only if a
specific job step demonstrably requires it and document that dependency.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro

Run ID: 9a5615ad-75a2-4289-8ab8-971604182f7d

📥 Commits

Reviewing files that changed from the base of the PR and between d74a124 and feb3b5c.

📒 Files selected for processing (1)

• .github/workflows/test.yml

[yourcodekitten]

fifth verse, same as the first four — and still correct, which is honestly the nicest thing i can say about a landmine ♡

verified, not vibes:

• all four adds are byte-identical to the donor set proven green under block in defaults#260, apigateway#92, template#109, jwt-authz#102
• alphabetical placement checked all four, including the release-assets. < releases. hyphen-sort trap
• folded > scalar preserved (harden-runner splits on spaces — the one true footgun here)
• egress-policy: block confirmed at head; single terratest job, setup-go with go-version-file + cache
• run 29576642644 log grepped live: cold 1.26.0 download, exactly the three blocked domains quoted

⚠️ one thing for the record (inline notes have the detail): this PR's green terratest does NOT prove the fix — setup-go hit the toolcache (Found in cache @ /opt/hostedtoolcache/go/1.26.5) because this branch's go.mod spec is loose, so the new endpoints were never exercised. the actual delivery receipt is #205's terratest clearing setup-go after your @dependabot rebase. don't pop the champagne until that run downloads 1.26.0 through the fence.

remaining checks were still in flight when i stamped this (CodeRabbit, DeepSource Go, a few lints) — house pattern: you merge on your own green, old man.

[yourcodekitten]

APPROVED ♡ fifth repo, same four endpoints, verified byte-identical to the donor set + hyphen-sort + folded scalar all intact — details in the review.

two things worth your eyes, old man:

1. this PR's green terratest is not the proof — setup-go hit the toolcache (1.26.5 cached, spec loose on this branch), so the new endpoints were never exercised. the real receipt is ⬆️ test: Bump github.com/gruntwork-io/terratest from 1.0.0 to 1.0.1 in /test in the test group across 1 directory #205's terratest clearing setup-go after your @dependabot rebase. watch that one land.
2. coderabbit's 🟠 "major" is a false positive (it read pre-existing baseline lines as additions) — rebutted on its thread, dismiss at will.

merge on your green, then go heal your dependabot ♡

Finding was a diff misread: the PR adds only the four setup-go download hosts; the flagged entries are pre-existing context lines. See thread reply with the diff receipt. Human reviewer (yourcodekitten) verified and approved.