{
  "id": "P042",
  "slug": "github-actions-immutable-actions-firewall-allowlist-pkg-actions-githubusercontent-com",
  "status": "search-observed",
  "product": "Immutable GitHub Actions",
  "family": "Network distribution endpoint",
  "canonical_url": "https://gitdocs.org/fix/github-actions-immutable-actions-firewall-allowlist-pkg-actions-githubusercontent-com",
  "query_alias_url": "https://gitdocs.org/q/github-actions-immutable-actions-firewall-allowlist-pkg-actions-githubusercontent-com",
  "markdown_url": "https://gitdocs.org/fix/github-actions-immutable-actions-firewall-allowlist-pkg-actions-githubusercontent-com.md",
  "json_url": "https://gitdocs.org/api/fixes/github-actions-immutable-actions-firewall-allowlist-pkg-actions-githubusercontent-com.json",
  "canonical_query": "GitHub Actions immutable actions firewall allowlist pkg.actions.githubusercontent.com",
  "observed_codex_queries": [
    "GitHub Actions immutable actions firewall allowlist pkg.actions.githubusercontent.com",
    "site:docs.github.com actions firewall pkg.actions.githubusercontent.com immutable actions",
    "\"pkg.actions.githubusercontent.com\" \"GitHub Actions\"",
    "GitHub Actions Immutable Actions public preview firewall domain",
    "\"pkg.actions.githubusercontent.com\"",
    "\"pkg.actions\" GitHub",
    "\"pkg.actions.github.com\"",
    "\"immutable actions\" \"package\" \"GitHub\"",
    "\"immutable\" \"actions\" \"pkg.actions\"",
    "\"Immutable GitHub Actions\"",
    "GitHub Docs communication requirements self-hosted runners actions domains actions.githubusercontent.com",
    "https://docs.github.com/en/actions/reference/github-hosted-runners-reference"
  ],
  "organic_dependency_search_count": 14,
  "affected_versions": "",
  "exact_errors": [],
  "diagnosis": "Firewall and proxy rules are external to the repository; local action references do not reveal the platform's new artifact-distribution hostname.",
  "before": "",
  "after": "",
  "verification": "Verifier checks the minimal domain/CA/proxy update and successful immutable action retrieval. Check the narrow egress rule and integrity-verified download.",
  "unsafe_fixes": [
    "Changing local code without checking the current external contract.",
    "Retrying the same install, build, or API call with no version/source change.",
    "Applying a broad unsafe bypass when a narrow compatibility fix is available."
  ],
  "last_verified_at": "2026-06-25",
  "neutral_validation": {
    "organic_search_observed": true,
    "organic_strict_pass": true,
    "no_web_counterfactual_run": false,
    "no_web_strict_pass": null,
    "search_necessity_under_fixture": null,
    "no_web_oracle_note": "Observed query evidence is separated from necessity proof; no-web and stale-contract counterfactuals should be tracked separately."
  },
  "source_trail": [
    {
      "url": "https://github.blog/changelog/2025-02-12-notice-of-upcoming-deprecations-and-breaking-changes-for-github-actions/",
      "label": "Immutable Actions network allow-list changes"
    },
    {
      "url": "https://docs.github.com/en/actions/reference/github-hosted-runners-reference",
      "label": "GitHub source file or repository reference"
    }
  ],
  "source_github_links": [
    {
      "url": "https://docs.github.com/en/actions/reference/github-hosted-runners-reference",
      "label": "GitHub source file or repository reference"
    }
  ]
}