[wcy41gtc]

What are you trying to accomplish?

Dependabot swift version updates fail on every run for a private repository whose SwiftPM package depends on microsoft/onnxruntime-swift-package-manager, Microsoft's official ONNX Runtime package.

Its Package.swift declares two binaryTargets on download.onnxruntime.ai:

Target.binaryTarget(name: "onnxruntime",
                    url: "https://download.onnxruntime.ai/pod-archive-onnxruntime-c-1.24.2.zip", ...)
Target.binaryTarget(name: "onnxruntime_extensions",
                    url: "https://download.onnxruntime.ai/pod-archive-onnxruntime-extensions-c-0.13.0.zip", ...)

The enforced egress allowlist blocks that host. SwiftPM then fails while Dependabot's Swift file parser resolves the package graph, so the job ends before any dependency is checked and no Swift update PRs are created at all. This is the same failure mode as #290, #304 and #315.

Proxy and updater log from the latest run (2026-10-17 UTC):

* egress not allowlisted download.onnxruntime.ai
403 https://download.onnxruntime.ai:443/pod-archive-onnxruntime-c-1.24.2.zip
* egress not allowlisted download.onnxruntime.ai
403 https://download.onnxruntime.ai:443/pod-archive-onnxruntime-extensions-c-0.13.0.zip
error: failed downloading 'https://download.onnxruntime.ai/pod-archive-onnxruntime-c-1.24.2.zip' which is required by binary target 'onnxruntime': badResponseStatusCode(403)
error: failed downloading 'https://download.onnxruntime.ai/pod-archive-onnxruntime-extensions-c-0.13.0.zip' which is required by binary target 'onnxruntime_extensions': badResponseStatusCode(403)
ERROR ... dependabot/swift/file_parser/dependency_parser.rb:53:in 'Dependabot::Swift::FileParser::DependencyParser#formatted_deps'

This PR adds the exact host to the swift defaults, with tests for both release URLs and blocked probes for a child, a sibling and the parent domain.

Anything you want to highlight for special attention from reviewers?

• Exact host only. The TLS certificate for download.onnxruntime.ai (GeoTrust TLS RSA CA G1) names only that host. Both downloads are anonymous and return 200 with no redirect.
• Declaring the host under registries: in dependabot.yml is not a workaround for an anonymous host. Dependabot's config validation requires username and password for a git registry, and an invalid file stops every update job in the repository.

How will you know you've accomplished your goal?

The weekly swift update job will resolve the package graph again and open update PRs. The new cases in TestEgressAllowlist_PublicVendorRegistriesAllowed cover both release URLs and the blocked probes.

Checklist

Note

I could not run the test suite locally: this machine has no Go toolchain or Docker. I'm relying on the repository's CI. The change follows #325.

• I have run the complete test suite to ensure all tests and linters pass.
• I have thoroughly tested my code changes to ensure they work as expected, including adding additional tests for new functionality.
• I have written clear and descriptive commit messages.
• I have provided a detailed description of the changes in the pull request, including the problem it addresses, how it fixes the problem, and any relevant details about the implementation.
• I have ensured that the code is well-documented and easy to understand.