Repository navigation
Allowlist go.dev for bazel update jobs - #343
Merged
v-abhishekbhaskar merged 1 commit intoNov 3, 2026
Merged
v-abhishekbhaskar merged 1 commit into
v-abhishekbhaskar merged 1 commit into
Conversation
v-abhishekbhaskar
approved these changes
Nov 3, 2026
When MODULE.bazel pins the Go toolchain with go_sdk.download(version = "..."), rules_go's go_sdk extension reads https://go.dev/dl/?mode=json&include=all during `bazel mod tidy` to resolve SDK filenames and checksums. Under proxy-egress-enforce the proxy refuses it ("egress not allowlisted go.dev"). The impact depends on the rules_go version the update resolves. Before rules_go 0.59.0 the go_sdk extension fails, so the update ends in dependency_file_not_resolvable. From 0.59.0 the fetch may fail without breaking the extension, but it is still attempted, and retried, on every lockfile update. go.dev is the Go project's own site (certificate CN=go.dev, issued by Google Trust Services) and serves the index as JSON directly, with no redirect, so it is added as an exact host with a child probe. pkg.go.dev is already listed separately. go.dev also serves the playground's /_/share endpoint, which stores POSTed snippets publicly. The entry's comment records this as an accepted residual risk, as is done for storage.googleapis.com. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
v-abhishekbhaskar
force-pushed
the
tomas-edwardsson/allowlist-go-dev
branch
from
November 3, 2026 19:49
f304c0c to
53e17f3
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What are you trying to accomplish?
I'm trying to enable dependabot updates of my bazel built go repo and want to add go.dev to the allow list.
rules_go's
go_sdkextension fetches the Go release index fromhttps://go.dev/dl/?mode=json&include=allduringbazel mod tidy, and the proxy blocks it:Before rules_go 0.59.0 this makes the update fail with
dependency_file_not_resolvable. Newer versions tolerate the failure but still retry the request on every lockfile update.Anything you want to highlight for special attention from reviewers?
go.dev also hosts the Go playground, whose share button lets anyone publish content there. I've added a RISK note on the entry for this, like the existing one for
storage.googleapis.com.go.dev is added as an exact host.
golang.google.cnis left out because rules_go only falls back to it when go.dev fails.How will you know you've accomplished your goal?
TestEgressAllowlist_ProdBlockedHostsNowAllowed. It got a 403 before the change and is allowed after. Anevil.go.devchild probe was added too.AlexTereshenkov/dg-querywith egress enforcement on. The released proxy blocked go.dev with a 403; this branch let it through with a 200.Checklist
🤖 Generated with Claude Code