mirror of
https://github.com/anthropics/claude-code-action.git
synced 2026-01-23 15:04:13 +08:00
refactor: make network restrictions opt-in and move to examples
- Removed network restrictions from .github/workflows/claude.yml - Added network restrictions to examples/claude.yml as opt-in feature - Changed from DISABLE_NETWORK_RESTRICTIONS to ENABLE_NETWORK_RESTRICTIONS - Added support for CUSTOM_ALLOWED_DOMAINS repository variable - Organized whitelist by provider (Anthropic, Bedrock, Vertex AI) - Removed package registries from whitelist (already in NO_PROXY) Users can now enable network restrictions by setting ENABLE_NETWORK_RESTRICTIONS=true and configure additional domains via CUSTOM_ALLOWED_DOMAINS. 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude <noreply@anthropic.com>
This commit is contained in:
km-anthropic
54
.github/workflows/claude.yml
vendored
54
.github/workflows/claude.yml
vendored
@@ -29,60 +29,6 @@ jobs:
|
|||||||
with:
|
with:
|
||||||
fetch-depth: 1
|
fetch-depth: 1
|
||||||
|
|
||||||
- name: Setup Network Restrictions
|
|
||||||
if: ${{ vars.DISABLE_NETWORK_RESTRICTIONS != 'true' }}
|
|
||||||
run: |
|
|
||||||
# Install and configure Squid proxy
|
|
||||||
sudo apt-get update && sudo apt-get install -y squid
|
|
||||||
|
|
||||||
# Create whitelist for allowed domains
|
|
||||||
cat > /tmp/whitelist.txt << 'EOF'
|
|
||||||
# Claude API
|
|
||||||
.anthropic.com
|
|
||||||
|
|
||||||
# GitHub (covers github.com, api.github.com, gist.github.com, etc.)
|
|
||||||
.github.com
|
|
||||||
|
|
||||||
# GitHub raw content and user uploads
|
|
||||||
.githubusercontent.com
|
|
||||||
|
|
||||||
# GitHub Container Registry
|
|
||||||
ghcr.io
|
|
||||||
|
|
||||||
# Package registries
|
|
||||||
registry.npmjs.org
|
|
||||||
bun.sh
|
|
||||||
|
|
||||||
# Azure storage for GitHub Actions cache
|
|
||||||
.blob.core.windows.net
|
|
||||||
EOF
|
|
||||||
|
|
||||||
# Configure Squid
|
|
||||||
sudo tee /etc/squid/squid.conf << 'EOF'
|
|
||||||
http_port 127.0.0.1:3128
|
|
||||||
acl whitelist dstdomain "/tmp/whitelist.txt"
|
|
||||||
acl localhost src 127.0.0.1/32
|
|
||||||
http_access allow localhost whitelist
|
|
||||||
http_access deny all
|
|
||||||
cache deny all
|
|
||||||
EOF
|
|
||||||
|
|
||||||
# Stop any existing squid instance and start with our config
|
|
||||||
sudo squid -k shutdown || true
|
|
||||||
sleep 2
|
|
||||||
sudo rm -f /run/squid.pid
|
|
||||||
sudo squid -N -d 1 &
|
|
||||||
sleep 5
|
|
||||||
|
|
||||||
# Set proxy environment variables
|
|
||||||
echo "http_proxy=http://127.0.0.1:3128" >> $GITHUB_ENV
|
|
||||||
echo "https_proxy=http://127.0.0.1:3128" >> $GITHUB_ENV
|
|
||||||
echo "HTTP_PROXY=http://127.0.0.1:3128" >> $GITHUB_ENV
|
|
||||||
echo "HTTPS_PROXY=http://127.0.0.1:3128" >> $GITHUB_ENV
|
|
||||||
# Bypass proxy for package registries to avoid integrity check issues
|
|
||||||
echo "NO_PROXY=localhost,127.0.0.1,registry.npmjs.org,registry.yarnpkg.com" >> $GITHUB_ENV
|
|
||||||
echo "no_proxy=localhost,127.0.0.1,registry.npmjs.org,registry.yarnpkg.com" >> $GITHUB_ENV
|
|
||||||
|
|
||||||
- name: Run Claude Code
|
- name: Run Claude Code
|
||||||
id: claude
|
id: claude
|
||||||
uses: anthropics/claude-code-action@beta
|
uses: anthropics/claude-code-action@beta
|
||||||
|
|||||||
@@ -29,6 +29,65 @@ jobs:
|
|||||||
with:
|
with:
|
||||||
fetch-depth: 1
|
fetch-depth: 1
|
||||||
|
|
||||||
|
- name: Setup Network Restrictions
|
||||||
|
if: ${{ vars.ENABLE_NETWORK_RESTRICTIONS == 'true' }}
|
||||||
|
run: |
|
||||||
|
# Install and configure Squid proxy
|
||||||
|
sudo apt-get update && sudo apt-get install -y squid
|
||||||
|
|
||||||
|
# Create whitelist for allowed domains
|
||||||
|
cat > /tmp/whitelist.txt << 'EOF'
|
||||||
|
# Provider APIs - Choose one:
|
||||||
|
# Anthropic (1P)
|
||||||
|
.anthropic.com
|
||||||
|
|
||||||
|
# AWS Bedrock:
|
||||||
|
# bedrock.*.amazonaws.com
|
||||||
|
# bedrock-runtime.*.amazonaws.com
|
||||||
|
|
||||||
|
# Google Vertex AI:
|
||||||
|
# *.googleapis.com
|
||||||
|
# vertexai.googleapis.com
|
||||||
|
|
||||||
|
# GitHub (required for all setups)
|
||||||
|
.github.com
|
||||||
|
.githubusercontent.com
|
||||||
|
ghcr.io
|
||||||
|
|
||||||
|
# Azure storage for GitHub Actions cache
|
||||||
|
.blob.core.windows.net
|
||||||
|
|
||||||
|
# Additional custom domains (newline-separated)
|
||||||
|
# Set via CUSTOM_ALLOWED_DOMAINS repository variable
|
||||||
|
${{ vars.CUSTOM_ALLOWED_DOMAINS || '' }}
|
||||||
|
EOF
|
||||||
|
|
||||||
|
# Configure Squid
|
||||||
|
sudo tee /etc/squid/squid.conf << 'EOF'
|
||||||
|
http_port 127.0.0.1:3128
|
||||||
|
acl whitelist dstdomain "/tmp/whitelist.txt"
|
||||||
|
acl localhost src 127.0.0.1/32
|
||||||
|
http_access allow localhost whitelist
|
||||||
|
http_access deny all
|
||||||
|
cache deny all
|
||||||
|
EOF
|
||||||
|
|
||||||
|
# Stop any existing squid instance and start with our config
|
||||||
|
sudo squid -k shutdown || true
|
||||||
|
sleep 2
|
||||||
|
sudo rm -f /run/squid.pid
|
||||||
|
sudo squid -N -d 1 &
|
||||||
|
sleep 5
|
||||||
|
|
||||||
|
# Set proxy environment variables
|
||||||
|
echo "http_proxy=http://127.0.0.1:3128" >> $GITHUB_ENV
|
||||||
|
echo "https_proxy=http://127.0.0.1:3128" >> $GITHUB_ENV
|
||||||
|
echo "HTTP_PROXY=http://127.0.0.1:3128" >> $GITHUB_ENV
|
||||||
|
echo "HTTPS_PROXY=http://127.0.0.1:3128" >> $GITHUB_ENV
|
||||||
|
# Bypass proxy for package registries to avoid integrity check issues
|
||||||
|
echo "NO_PROXY=localhost,127.0.0.1,registry.npmjs.org,registry.yarnpkg.com" >> $GITHUB_ENV
|
||||||
|
echo "no_proxy=localhost,127.0.0.1,registry.npmjs.org,registry.yarnpkg.com" >> $GITHUB_ENV
|
||||||
|
|
||||||
- name: Run Claude PR Action
|
- name: Run Claude PR Action
|
||||||
uses: anthropics/claude-code-action@beta
|
uses: anthropics/claude-code-action@beta
|
||||||
with:
|
with:
|
||||||
|
|||||||
Reference in New Issue
Block a user