[FreekVR]

What are you trying to accomplish?

Composer update jobs for Shopware 6 and Mage-OS/Magento projects fail since proxy-egress-enforce was enabled. The proxy blocks two public Composer repositories, and the updater reports it as private_source_authentication_failure:

proxy | GET https://shopware.github.io:443/conflicts/packages.json
proxy | * egress not allowlisted shopware.github.io
      | 403 https://shopware.github.io:443/conflicts/packages.json
updater | Handled error whilst updating symfony/http-foundation: private_source_authentication_failure {source: "shopware.github.io"}

The same happens for mirror.mage-os.org.

This adds both as exact hosts to ecosystem_default_domains.composer:

• shopware.github.io serves the shopware/conflicts metapackage, which shopware/core requires. Shopware's project templates (shopware/production, shopware/template, shopware-cli, web-installer) add https://shopware.github.io/conflicts/ to every new project's composer.json.
• mirror.mage-os.org is the Mage-OS public mirror of the Magento Open Source packages. It needs no sign-in.

Anything you want to highlight for special attention from reviewers?

Why not registries:. Both repositories serve packages anonymously, and dependabot.yml does not accept a composer-repository entry without a username and password.

Why the exact form is safe. github.io subdomains are user-creatable, so shopware.github.io follows the wp-languages.github.io precedent in the same section. mirror.mage-os.org is exact as well, so other mage-os.org hosts stay blocked.

Ownership evidence.

• shopware.github.io: the GitHub Pages site of the shopware/conflicts repository (GET /repos/shopware/conflicts/pages returns html_url: https://shopware.github.io/conflicts/). TLS subject=CN=*.github.io, issued by Let's Encrypt to GitHub.
• mirror.mage-os.org: TLS subject=CN=mage-os.org, SAN mage-os.org, *.mage-os.org, issuer Google Trust Services. The verified GitHub organization mage-os links to mage-os.org, and its mage-os/generate-mirror-repo-js repository builds the mirror.

Both resolve only to public addresses (GitHub Pages and Cloudflare) and answer 200 on a real artifact path with no redirect: /conflicts/packages.json and /p2/magento/framework.json.

How will you know you've accomplished your goal?

Composer update jobs that use these repositories resolve again without a registries: entry. When the same hosts are allowed for a job, it fetches both with 200 and finishes, so no other host in the chain is blocked.

Regression coverage in internal/handlers/egress_allowlist_test.go:

• Positive: /conflicts/packages.json and /p2/magento/framework.json in TestEgressAllowlist_ProdBlockedHostsNowAllowed.
• Negative child: evil.shopware.github.io and evil.mirror.mage-os.org in TestEgressAllowlist_NewEntriesDoNotWidenBeyondExactHosts. Both fail when the entries are changed to the leading-dot form.
• Negative sibling: attacker.mage-os.org. attacker.github.io was already there.

On my arm64 Mac, script/test stops at go: -race requires cgo in the tests image. I ran its test command in golang:1.27 with CGO_ENABLED=1 instead (go test -race -shuffle=on -count=2 ./...), plus the CI lint steps (yamllint, go mod tidy -diff, gofmt, go vet). All pass.

Checklist

• I have run the complete test suite to ensure all tests and linters pass.
• I have thoroughly tested my code changes to ensure they work as expected, including adding additional tests for new functionality.
• I have written clear and descriptive commit messages.
• I have provided a detailed description of the changes in the pull request, including the problem it addresses, how it fixes the problem, and any relevant details about the implementation.
• I have ensured that the code is well-documented and easy to understand.

Note

AI usage disclaimer
AI pair programming: Claude Code ran the triage from add-egress-allowlist-domain, wrote the entries and tests, and ran the tests. I chose the hosts and approach and reviewed every change.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota.