Egress allowlist blocks NuGet sources defined in nuget.config

[LouisMT]

My repository defines an extra NuGet feed in nuget.config:

<?xml version="1.0" encoding="utf-8"?>
<configuration>

  <packageSources>
    <add key="nuget.org" value="https://api.nuget.org/v3/index.json" />
    <add key="some-package-source" value="https://some-package-source/nuget/v3/index.json" />
  </packageSources>

  <packageSourceMapping>
    <packageSource key="nuget.org">
      <package pattern="*" />
    </packageSource>

    <packageSource key="some-package-source">
      <package pattern="SomePackage.*" />
    </packageSource>
  </packageSourceMapping>

</configuration>

Recently, Dependabot jobs fail on this feed:

proxy | GET https://some-package-source:443/nuget/v3/index.json
proxy | * egress not allowlisted some-package-source
proxy | 403 https://some-package-source:443/nuget/v3/index.json
proxy | Remote response: Forbidden
updater | ERROR Error type: private_source_authentication_failure

From the source, the allowlist only includes hosts taken from job credentials (dynamicHosts(cfg.Credentials)). Declaring the feed again under registries: in dependabot.yml should get it allowlisted, but that duplicates what nuget.config already defines. It also isn't obvious: nothing in the docs says a registries: entry is needed just to allow a host, since NuGet already reads the source from nuget.config.

It would be nice if Dependabot could either:

• Include package sources from the repository's nuget.config in the allowlist, or
• Document that feeds must be declared under registries: to get past the egress allowlist

[matsest]

Same behavior here with a private npm registry (no auth) defined in .npmrc - now apparently blocked with same error message after the latest update.

Seems the latest changes have led to an a breaking change that should have been more carefully introduced.

[v-abhishekbhaskar]

@matsest any private registry url should be explicitly configured in the credentials registries section in dependabot.yml in order to directly allowlist it. If it is a public registry or any other static host which needs to be added to the allowlist, you can open a PR against this repo by adding the domain under the correct package manager. You can also open an issue for it and I will work on adding it to the list.

[v-abhishekbhaskar]

Closing with #280