GitHub Community
-
Select Topic AreaQuestion BodyWith regards to https://github.blog/changelog/2023-01-31-github-actions-job-summary-updates/ We have our own caching mechanisms in place to keep our data off the blob.core.windows.net domain, and therefore have it blocked. Q: Is there a known set of productionresultssa*.blob.core.windows.net domains? We can only wildcard allow domains at a subdomain level (*.blob.core.windows.net) and not as a wildcard in the middle of the host name. |
Beta Was this translation helpful? Give feedback.
Replies: 4 comments 1 reply
-
|
there is no publicly available list of all productionresultssa*.blob.core.windows.net domains. If you need to allow these domains for GitHub Actions, you may need to work with GitHub Support to find an alternative solution. Choose other. |
Beta Was this translation helpful? Give feedback.
-
|
Thanks, I will put in a ticket with support to see what the options are (or if there are any). |
Beta Was this translation helpful? Give feedback.
-
|
Beta Was this translation helpful? Give feedback.
-
|
It's 2026 now and I think this missing capability deserves more attention. GitHub now has the thing called Agentic Workflow which shares a similar firewall configuration. Our experiments using Agentic Workflow with the built-in actions_get MCP tool indicates the tool can discover the productionresultssa*.blob.core.windows.net download url to get Action run artifacts and attempt to do so. Such attempts all get blocked by the default firewall rules. We don't want to allow access to arbitrary storage accounts. This can lead to prompt injection attacks. Even if we have the ability to grant access to all productionresultssa*.blob.core.windows.net storage accounts, we also cannot trust all storage accounts with that name pattern. I just created a storage account named "productionresultssa9991", indicating not all such storage accounts are reserved by GitHub. We need a secure way to allow Agentic Workflow Actions to access GitHub Actions run artifacts. |
Beta Was this translation helpful? Give feedback.
-
Hello, this information can be fetched from the GitHub API. The comment here explains how. Specifically, the API https://api.github.com/meta can be used. Fetch this API, and get the import requests
data = requests.get('https://api.github.com/meta').json()
actions_domains = data['domains']['actions']
print("domains")
for domain in actions_domains:
print(domain)At the moment, this has the following output: Apparently they are using productionresultssaX with X between 0 and 19. Official docs here: https://docs.github.com/en/rest/meta/meta?apiVersion=2026-03-10#get-github-meta-information cc: @JasonYeMSFT |
Beta Was this translation helpful? Give feedback.
there is no publicly available list of all productionresultssa*.blob.core.windows.net domains. If you need to allow these domains for GitHub Actions, you may need to work with GitHub Support to find an alternative solution. Choose other.