[jfallain-appdirect]

What are you trying to accomplish?

Allow the CAST AI public Helm chart repository host, castai.github.io, for Helm update jobs.

Helm update jobs for charts from https://castai.github.io/helm-charts fail to read the chart index:

proxy | GET https://castai.github.io:443/helm-charts/index.yaml
proxy | * egress not allowlisted castai.github.io
proxy | 403 https://castai.github.io:443/helm-charts/index.yaml
updater | INFO Latest version is

Dependabot then finds no update and closes the existing PRs as "no longer updatable" (same symptom as #327). Chart tarballs for this repo are hosted on github.com (already allowed), so only castai.github.io is needed.

Anything you want to highlight for special attention from reviewers?

• Exact entry only, no *.github.io wildcard, matching the existing GitHub Pages chart hosts (fluent.github.io, wiz-sec.github.io, ...).
• Public, provider-controlled: CAST AI's GitHub Pages site. It resolves to GitHub Pages IPs, serves a *.github.io certificate, and /helm-charts/index.yaml returns 200 with no redirect.
• Added under the helm: section only.

How will you know you've accomplished your goal?

• Added a positive probe (https://castai.github.io/helm-charts/index.yaml) and a negative child probe (https://evil.castai.github.io/payload).
• go build ./..., go test ./internal/handlers -run TestEgress -count=1 and gofmt -l pass. Mutating the entry to .castai.github.io makes the child probe fail, as intended.

Checklist

• I have run the complete test suite to ensure all tests and linters pass. (script/test needs Docker and was not run; only the targeted egress tests were.)
• I have thoroughly tested my code changes to ensure they work as expected, including adding additional tests for new functionality.
• I have written clear and descriptive commit messages.
• I have provided a detailed description of the changes in the pull request, including the problem it addresses, how it fixes the problem, and any relevant details about the implementation.
• I have ensured that the code is well-documented and easy to understand.

Made with Cursor