Skill: network.allowed: [defaults] standard network policy
Description: 112 workflows use the exact 3-line frontmatter block:
network:
allowed:
- defaultssometimes with one or two extra entries appended (e.g. node, go, python). This is the baseline "allow default egress domains" network policy applied almost everywhere network restrictions are declared inline, rather than through a shared import.
Current usage: Exact match count via repo-wide scan of .github/workflows/*.md: 112 files, including smoke-copilot.md, unbloat-docs.md, agentic-token-audit.md, daily-elixir-credo-snippet-audit.md, copilot-opt.md, copilot-agent-analysis.md, weekly-issue-summary.md, docs-noob-tester.md, prompt-clustering-analysis.md, smoke-copilot-aoai-apikey.md, and many more. This is separate from (and in addition to) the shared/otlp.md import (232 workflows) which injects its own network.allowed entries for Sentry/Grafana — the two currently can't be composed without duplicating the defaults line in every consumer.
Proposed shared component: .github/workflows/shared/network-defaults.md
---
network:
allowed:
- defaults
---Workflows needing extra domains (e.g. node, go, python) would import this plus declare additional network.allowed entries, relying on gh-aw's frontmatter merge semantics for arrays (verify merge behavior before rollout — see Migration step 2).
Estimated impact: 112+ workflows; 3 lines saved per workflow (~336 lines repo-wide); establishes single source of truth for the "defaults" network baseline, letting future changes to what "defaults" includes propagate via gh aw update instead of manual repo-wide edits.
Migration plan:
- Confirm gh-aw's array-merge behavior for
network.allowed across multiple imports (does it union, or does the last one win?) — check pkg/workflow merge logic docs/tests before extracting.
- Create
shared/network-defaults.md with the 3-line block.
- Migrate the ~90 workflows with exactly
network.allowed: [defaults] (no extra domains) first, since they are pure duplicates.
- For workflows appending extra domains, decide whether to keep them inline supplementing the import, or skip migration if merge semantics don't support additive lists cleanly.
- Run
make recompile and diff generated .lock.yml files to confirm no behavior change.
Example usage:
---
name: My Workflow
imports:
- shared/network-defaults.md
- shared/otlp.md
---
Generated by 🔍 Workflow Skill Extractor · auto · 90.2 AIC · ⌖ 2.7 AIC · ⊞ 7K · ◷
Skill:
network.allowed: [defaults]standard network policyDescription: 112 workflows use the exact 3-line frontmatter block:
sometimes with one or two extra entries appended (e.g.
node,go,python). This is the baseline "allow default egress domains" network policy applied almost everywhere network restrictions are declared inline, rather than through a shared import.Current usage: Exact match count via repo-wide scan of
.github/workflows/*.md: 112 files, includingsmoke-copilot.md,unbloat-docs.md,agentic-token-audit.md,daily-elixir-credo-snippet-audit.md,copilot-opt.md,copilot-agent-analysis.md,weekly-issue-summary.md,docs-noob-tester.md,prompt-clustering-analysis.md,smoke-copilot-aoai-apikey.md, and many more. This is separate from (and in addition to) theshared/otlp.mdimport (232 workflows) which injects its ownnetwork.allowedentries for Sentry/Grafana — the two currently can't be composed without duplicating thedefaultsline in every consumer.Proposed shared component:
.github/workflows/shared/network-defaults.mdWorkflows needing extra domains (e.g.
node,go,python) would import this plus declare additionalnetwork.allowedentries, relying on gh-aw's frontmatter merge semantics for arrays (verify merge behavior before rollout — see Migration step 2).Estimated impact: 112+ workflows; 3 lines saved per workflow (~336 lines repo-wide); establishes single source of truth for the "defaults" network baseline, letting future changes to what "defaults" includes propagate via
gh aw updateinstead of manual repo-wide edits.Migration plan:
network.allowedacross multiple imports (does it union, or does the last one win?) — checkpkg/workflowmerge logic docs/tests before extracting.shared/network-defaults.mdwith the 3-line block.network.allowed: [defaults](no extra domains) first, since they are pure duplicates.make recompileand diff generated.lock.ymlfiles to confirm no behavior change.Example usage: