Add Copilot skill for adding user requested domain to egress allowlist

[v-abhishekbhaskar]

What are you trying to accomplish?

Adds a Copilot CLI skill at .github/skills/add-egress-allowlist-domain/SKILL.md that walks a contributor through handling a host blocked by the egress allowlist.

The allowlist is enforced progressively, so reports of blocked domains arrive steadily. Most of them should not result in a YAML change: private and org-specific registries belong in registries: in dependabot.yml, and shared multi-tenant hosts must be refused outright because the handler authorizes the hostname only and never constrains path or method. The skill encodes triage related to static and private registries and handles correct placement of user's domain in the allowlist.

Anything you want to highlight for special attention from reviewers?

How its used-
In a Copilot CLI session with this repo as the working directory, the user just states the problem:
rsc.io is blocked in my go_modules job, can you add it?
or simply pastes the log line:
* egress not allowlisted rubygemsregistryv2prod.blob.core.windows.net

Copilot matches that against the description and loads the skill before acting. Because it's also user-invocable: true , they can ask for it by name. /skills lists it, /env confirms it loaded.

What it then does: triages whether the host belongs in the static defaults at all (routing private/org registries to  registries:  in  dependabot.yml  and refusing multi-tenant hosts) →  curl -verifies the host → picks exact vs leading-dot vs glob → places it respecting the YAML anchors → adds a positive probe and an  evil.  child probe → runs build/test/gofmt → opens the PR with the template.

How will you know you've accomplished your goal?

The skill runs correctly and opens a PR when called with the user's domain. It is discoverable via /skills and /env once merged.

Checklist

• I have run the complete test suite to ensure all tests and linters pass.
• I have thoroughly tested my code changes to ensure they work as expected, including adding additional tests for new functionality.
• I have written clear and descriptive commit messages.
• I have provided a detailed description of the changes in the pull request, including the problem it addresses, how it fixes the problem, and any relevant details about the implementation.
• I have ensured that the code is well-documented and easy to understand.

[Copilot]

Copilot review overview

🟡 Changes recommended

The host verification permits shell injection and internal redirects, while the PR command bypasses the required template.

Review effort: Balanced
Findings: 1 · 1

Open (2)

• Prevent command injection and SSRF in hostname verification · New
• Use the required pull request template before submitting · New

What changed in this PR

Adds a Copilot skill for safely triaging and implementing egress allowlist requests.

Changes:

• Documents domain safety classification and matching rules.
• Defines regression testing, validation, and PR workflow.

File	Description
.github/​skills/​add-egress-allowlist-domain/​SKILL.md	Adds the allowlist workflow and guardrails.

---

💡 Configure MCP servers for context-aware, tailored reviews. Learn more in the docs.