fix: broaden Red Hat registry allowlist from registry.access.redhat.com to *.redhat.com

[BearTS]

Summary

Broadens the Red Hat registry allowlist in the release pipeline's egress rules to support additional Red Hat subdomains beyond just registry.access.redhat.com.

Changes

• Replaced registry.access.redhat.com:443 with *.redhat.com:443 in two jobs within the release pipeline workflow to allow traffic to any Red Hat subdomain, accommodating registry redirects or additional Red Hat endpoints that may be encountered during the build process.

Type of change

• Bug fix
• Feature
• Refactor
• Documentation
• Chore/CI

Affected areas

• Core (Go)
• Transports (HTTP)
• Providers/Integrations
• Plugins
• UI (React)
• Docs

How to test

Trigger the release pipeline and verify that Red Hat registry pulls succeed without egress policy violations.

Breaking changes

• Yes
• No

Related issues

Security considerations

The wildcard *.redhat.com egress rule is broader than the previous specific hostname. This is intentional to handle Red Hat infrastructure redirects, but it does expand the set of allowed outbound destinations to any Red Hat subdomain during the release pipeline run.

Checklist

• I read docs/contributing/README.md and followed the guidelines
• I added/updated tests where appropriate
• I updated documentation where needed
• I verified builds succeed (Go and UI)
• I verified the CI pipeline passes locally if applicable

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 4c5ca025-12bf-4ee7-b308-eef701614b45

📥 Commits

Reviewing files that changed from the base of the PR and between 99061eb and 2d59a6c.

📒 Files selected for processing (1)

• .github/workflows/release-pipeline.yml

🚧 Files skipped from review as they are similar to previous changes (1)

• .github/workflows/release-pipeline.yml

---

📝 Walkthrough

Summary by CodeRabbit

• Chores
  • Updated CI/CD pipeline for Docker image builds: adjusted egress allowlist to broaden permitted registry endpoints used during image build jobs, improving remote registry access for builds.

Walkthrough

The release pipeline workflow updates Hardened Runner egress allowlist entries for both amd64 and arm64 UBI9 Docker build jobs, replacing registry.access.redhat.com:443 with the wildcard *.redhat.com:443.

Changes

UBI9 Docker Build Egress Allowlist

Layer / File(s)	Summary
Broaden Red Hat registry allowlist for UBI9 builds .github/workflows/release-pipeline.yml	Both docker-build-ubi9-amd64 and docker-build-ubi9-arm64 jobs update their hardened runner allowed-endpoints from the specific registry endpoint to the wildcard *.redhat.com:443.

---

🎯 2 (Simple) | ⏱️ ~10 minutes

---

🐰 I hopped through YAML lines so bright,
I swapped a host for stars tonight,
UBI9 builds glide in wider light,
Wildcard skies make access right,
Pipelines hum, and runners bite.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title accurately summarizes the main change: broadening the Red Hat registry allowlist from a specific hostname to a wildcard domain in the release pipeline.
Description check	✅ Passed	The description comprehensively covers all required sections: summary, changes, type of change, affected areas, testing instructions, breaking changes, security considerations, and a filled checklist following the template structure.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch 05-13-chore_fix_redhat_cdn_whitelisting

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[BearTS]

• fix: broaden Red Hat registry allowlist from registry.access.redhat.com to *.redhat.com #3453 👈 (View in Graphite)
• dev

This stack of pull requests is managed by Graphite. Learn more about stacking.

[greptile-apps]

Confidence Score: 5/5

Safe to merge — a minimal, symmetrical change to CI egress rules with no impact on application code.

The change touches only two lines in the release workflow, applies identically to both build jobs, and follows the same wildcard convention already in use for *.quay.io. The expanded egress scope is limited to the CI build environment and remains gated by the harden-runner egress-policy: block setting.

No files require special attention.

Important Files Changed

Filename	Overview
.github/workflows/release-pipeline.yml	Widens egress allowlist from registry.access.redhat.com:443 to *.redhat.com:443 in both UBI9 Docker build jobs (amd64 and arm64); change is consistent, correctly applied in both locations, and matches the existing *.quay.io wildcard pattern already used.

_{Reviews (3): Last reviewed commit: "chore: fix redhat cdn whitelisting" | Re-trigger Greptile}

The merge-base changed after approval.

The merge-base changed after approval.

[akshaydeo]

Merge activity

• May 15, 1:10 PM UTC: A user started a stack merge that includes this pull request via Graphite.
• May 15, 1:11 PM UTC: @akshaydeo merged this pull request with Graphite.