Add azure blob redirect urls to egress allowlist

[v-abhishekbhaskar]

What are you trying to accomplish?

GitHub Packages serves registry metadata from *.pkg.github.com, but the actual package download is a 302 redirect to a per-ecosystem Azure Blob content host carrying a short-lived SAS token. The egress allowlist covered the registry front door but not the redirect target, so authenticated downloads failed after the redirect: the job reported an opaque unknown_error while the registry request itself had succeeded.

nugetregistryv2prod.blob.core.windows.net was already allowlisted; this adds the three missing siblings so Bundler, npm, and Maven behave consistently.

• npmregistryv2prod.blob.core.windows.net → npm_and_yarn (inherited by bun)
• rubygemsregistryv2prod.blob.core.windows.net → bundler
• mavenregistryv2prod.blob.core.windows.net → maven (inherited by gradle)

Anything you want to highlight for special attention from reviewers?

These are *.blob.core.windows.net hosts, which the file header explicitly warns against — so the matching form matters. They are added as exact entries only. The header's concern is patterns with attacker-choosable labels; an Azure storage account name is globally unique and these four are already registered to GitHub, so an exact entry leaves no label an attacker can claim. I deliberately did not reuse the adjacent *vsblobprod* glob, which the file documents as a known accepted risk rather than a pattern to copy.

Provenance is GitHub's own Meta API rather than the report alone: all four hosts are published under domains.packages in https://api.github.com/meta.

How will you know you've accomplished your goal?

TestEgressAllowlist_GitHubPackagesContentHostsAllowed covers all four content hosts plus the rubygems.pkg.github.com front door, and asserts the entries stay narrow: child hosts (evil.<host>), lookalike account names (...prodx, my...prod), and the shared attacker.blob.core.windows.net parent all remain blocked.

Checklist

• I have run the complete test suite to ensure all tests and linters pass.
• I have thoroughly tested my code changes to ensure they work as expected, including adding additional tests for new functionality.
• I have written clear and descriptive commit messages.
• I have provided a detailed description of the changes in the pull request, including the problem it addresses, how it fixes the problem, and any relevant details about the implementation.
• I have ensured that the code is well-documented and easy to understand.

[Copilot]

Copilot review overview

🟢 Approval recommended

The exact-host additions are appropriately scoped and covered by positive and negative tests.

Review effort: Balanced
Findings: None

What changed in this PR

Adds exact GitHub Packages Azure Blob download hosts to the egress allowlist.

Changes:

• Allow npm, RubyGems, and Maven GitHub Packages content hosts.
• Test allowed hosts and blocked subdomains/lookalikes.

File	Description
internal/​handlers/​egress_allowlist_defaults.yaml	Adds three exact Azure Blob hosts.
internal/​handlers/​egress_allowlist_test.go	Verifies narrow allowlist behavior.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.