Block unlisted egress in the catalogue's credential-holding publish and release jobs #628

🤖 Generated by the Agentic Engineer (interactive Claude Code session)

Evidence

step-security/harden-runner is the first step of nearly every job across the catalogue, as the repository's own rule requires. All 143 egress-policy settings in .github/ and actions/ are audit (counted 2026-10-17), which records outbound connections and blocks none. That includes the jobs that hold signing identities, registry write tokens and App tokens: publishing, release and the signed-fix writer. The pinned version (v2.22.1) is current and postdates this year's published bypass advisories.

Class of failure this would contain

A compromised dependency or tool inside a credential-holding job could send that credential to an arbitrary host. Under audit, that is recorded and allowed. Under block with a reviewed allow-list, it is refused.

DevEx side

Block mode fails a job when a legitimate endpoint is missing from its allow-list. That is friction unless the allow-list is derived from observed traffic, and unless a failure names the refused host and the exact file to edit. Consumers must not have to write allow-lists for the shared workflows. The catalogue owns them.

Direction

1. Start with the jobs that hold write or signing credentials in publish-app, publish-manifests and create-release. Read-only validation jobs stay in audit.
2. Derive each job's allow-list from recorded audit traffic over a representative window. Keep it beside the workflow and review it like code.
3. Ship it behind a default-off input, try it on the catalogue's own release first, then on one consumer, and flip the default only after a clean window. This is the repository's feature-flag-first rule.
4. Make a refused connection fail with the host name and the allow-list file to change.

Acceptance criteria

• Each credential-holding job in the three workflows can run in block mode behind an opt-in input, and both states are tested.
• A test proves an unlisted host is refused and the failure names it.
• One full release of this repository and one consumer release succeed in block mode before the default flips.
• Read-only jobs and the everyday consumer configuration are unchanged.

Priority rationale: the jobs with the most to lose currently have the least containment, and the control is already installed and only needs switching on. Effort: medium; most of the work is deriving allow-lists. Prerequisites: none. It is lower priority than the security bump and the instruction-file work in this repository.

Rough size: M.