release pipeline changes

[akshaydeo]

Summary

Adds missing allowed endpoints to the release pipeline's network egress policy to unblock CI steps that require access to Google's download servers and Ubuntu's MOTD service.

Changes

• Added _https._tcp.dl.google.com:443 to the allowed egress endpoints to permit downloads from Google (e.g., toolchain or dependency fetches)
• Added motd.ubuntu.com:443 (non-prefixed form) alongside the existing _https._tcp.motd.ubuntu.com:443 entry to ensure the Ubuntu MOTD endpoint is reachable regardless of how it is resolved

Type of change

• Bug fix
• Feature
• Refactor
• Documentation
• Chore/CI

Affected areas

• Core (Go)
• Transports (HTTP)
• Providers/Integrations
• Plugins
• UI (React)
• Docs

How to test

Trigger the release pipeline and verify that no network egress policy violations occur for dl.google.com or motd.ubuntu.com.

Breaking changes

• Yes
• No

Related issues

N/A

Security considerations

The egress allowlist is being expanded minimally and only to well-known, trusted endpoints (dl.google.com and motd.ubuntu.com). No secrets or PII are involved.

Checklist

• I read docs/contributing/README.md and followed the guidelines
• I added/updated tests where appropriate
• I updated documentation where needed
• I verified builds succeed (Go and UI)
• I verified the CI pipeline passes locally if applicable

[coderabbitai]

Warning

Review limit reached

@akshaydeo, we couldn't start this review because you've reached your PR review rate limit.

More reviews will be available in 31 minutes and 34 seconds. Learn how PR review limits work.

Your organization has run out of usage credits. Purchase more in the billing tab.

⌛ How to resolve this issue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans include higher PR review limits than trial, open-source, and free plans. In all cases, reviews become available again over time. During sustained high-volume PR review activity, CodeRabbit may temporarily slow when the next review becomes available.

Please see our Fair Usage Limits Policy for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 68fcaed3-0c00-452d-a2dd-86a426a4a516

📥 Commits

Reviewing files that changed from the base of the PR and between c4aee27 and 36f795d.

📒 Files selected for processing (1)

• .github/workflows/release-pipeline.yml

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch 05-27-release_pipeline_changes

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[akshaydeo]

• release pipeline changes #3785 👈 (View in Graphite)
• dev

This stack of pull requests is managed by Graphite. Learn more about stacking.

[akshaydeo]

Merge activity

• May 26, 11:21 PM UTC: A user started a stack merge that includes this pull request via Graphite.
• May 26, 11:21 PM UTC: @akshaydeo merged this pull request with Graphite.

[greptile-apps]

Confidence Score: 5/5

The change is purely additive to a CI egress allowlist and does not touch any application logic or secrets handling.

Both new entries follow the established dual-entry pattern (SRV + plain hostname) already used for other domains in the same allowlist, and both domains (dl.google.com, motd.ubuntu.com) are well-known Ubuntu/Google infrastructure endpoints commonly contacted during apt operations.

No files require special attention.

Important Files Changed

Filename	Overview
.github/workflows/release-pipeline.yml	Adds missing SRV-style entry for dl.google.com and plain-hostname entry for motd.ubuntu.com to the harden-runner egress allowlist in the notify job, making both consistent with the existing double-entry pattern used for other domains.

_{Reviews (1): Last reviewed commit: "release pipeline changes" | Re-trigger Greptile}