Allowlist maven.configdirector.com for maven and gradle jobs

[abeiderman]

What are you trying to accomplish?

We run ConfigDirector, a feature flag and remote configuration service, and maven.configdirector.com is where we publish our Android SDK, Java server SDK and OpenFeature providers (group com.configdirector). Since October 2026 new versions are published only there, not to Maven Central.

Right now a Gradle or Maven update job can't reach the host unless the repository's dependabot.yml declares it under registries:, even though it needs no credentials. A repository that uses our SDKs without that declaration gets no update pull requests for them. The host is needed by every repository that uses the SDKs, not by our own builds, which is the case Resolve a blocked host describes for the defaults. Until this is merged, our docs tell consumers to add the registries: entry.

Anything you want to highlight for special attention from reviewers?

Public vendor repository, not a private registry. The host name carries our own name, which your allowlist skill lists as a private-registry signal. It is a vendor distribution host like maven.fullstory.com: anyone downloads from it anonymously, and only ConfigDirector publishes to it. It is a single bucket behind our own domain, not a tenant of a multi-tenant registry service. Evidence that we operate it and that it is public:

• docs.configdirector.com/sdks/maven-repository documents it: "Anyone can download from it, without an account or credentials." The host's root 302-redirects to that page.
• The READMEs of ConfigDirector/android-sdk and ConfigDirector/java-sdks name it as where the artifacts are published. The ConfigDirector GitHub organization is verified for configdirector.com.
• Its TLS certificate (a Cloudflare edge certificate issued by Google Trust Services) lists maven.configdirector.com as an exact subject alternative name, not a wildcard.

Exact host only. Other configdirector.com hosts serve our website, docs and product, not packages, so neither a leading dot nor a glob fits. The tests pin both a child (evil.maven.configdirector.com) and the parent (configdirector.com) closed.

How will you know you've accomplished your goal?

Probes of the host (2026-10-06), one hop each with no redirects followed. It resolves to public Cloudflare addresses only:

GET /com/configdirector/server-sdk/maven-metadata.xml           200 application/xml
GET /com/configdirector/android-sdk/maven-metadata.xml          200 application/xml
GET /com/configdirector/server-sdk/1.8.1/server-sdk-1.8.1.pom   200 (.asc, .sha1, .sha256, .sha512, .md5 also 200)
GET /com/configdirector/does-not-exist/maven-metadata.xml       404 (not 401)

Checklist

• I have run the complete test suite to ensure all tests and linters pass.
• I have thoroughly tested my code changes to ensure they work as expected, including adding additional tests for new functionality.
• I have written clear and descriptive commit messages.
• I have provided a detailed description of the changes in the pull request, including the problem it addresses, how it fixes the problem, and any relevant details about the implementation.
• I have ensured that the code is well-documented and easy to understand.