[domains-audit] Move Copilot/Pi vendor API and telemetry domains out of engine defaults

[github-actions]

Summary

The Copilot and Pi default allow-lists still include vendor-specific service endpoints that are broader than the shared gateway/GitHub transport baseline. telemetry.enterprise.githubcopilot.com is explicitly telemetry, and the api.business.githubcopilot.com / api.enterprise.githubcopilot.com / api.individual.githubcopilot.com variants are vendor-specific API hosts rather than basic GitHub-core reachability. Because agents run behind the AWF/MCP gateway, these should not be unconditional engine defaults.

Affected sets

Set	Domain	Bucket	File:line
CopilotDefaultDomains	api.business.githubcopilot.com	vendor-model-api	pkg/workflow/domains.go:70
CopilotDefaultDomains	api.enterprise.githubcopilot.com	vendor-model-api	pkg/workflow/domains.go:71
CopilotDefaultDomains	api.individual.githubcopilot.com	vendor-model-api	pkg/workflow/domains.go:74
CopilotDefaultDomains	telemetry.enterprise.githubcopilot.com	vendor-telemetry	pkg/workflow/domains.go:78
PiDefaultDomains	api.githubcopilot.com	vendor-model-api	pkg/workflow/domains.go:182

Why this is suspicious

The default engine allow-list is intended to cover the minimum transport path needed for the CLI to operate through the gateway. The vendor-specific Copilot hosts above are not required for core GitHub reachability and are not justified by the surrounding comments. Keeping them in the unconditional default set silently grants broad vendor access to every workflow that selects the engine, even though the gateway can proxy the traffic.

Suggested change

1. Keep only the shared gateway/GitHub transport hosts in the common default baseline.
2. Move the extra Copilot/Pi vendor API and telemetry hosts into a dedicated opt-in set (for example copilot-vendor or vendor-copilot) that workflows can enable explicitly.

Verification

The current regression tests already enforce that engine defaults do not overlap with the package-registry ecosystems, but they do not cover these vendor-specific hosts. The relevant validation points are pkg/workflow/domains_package_registry_test.go and the engine-default coverage in pkg/workflow/domains_test.go.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• proxy.golang.org

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "proxy.golang.org"

See Network Configuration for more information.

Generated by 🌐 Weekly Network Domain Set Audit · codex · cop10 · 15.6 AIC · ⌖ 2.47 AIC · ⊞ 16.4K · ◷