fix(sandbox-control): allow github.com by default so public repos clone without a GitHub App install (#34)

cloud/apps/sandbox-control/src/network-policy.ts

@@ -33,6 +33,9 @@ export const DEFAULT_EGRESS_ALLOWLIST: readonly string[] = [
   'nodejs.org',
   'archive.ubuntu.com',
   'security.ubuntu.com',
+  // Public clones/fetches work without a GitHub App install; a minted repo token adds the credential
+  // route on top (placeholder in, real token out, everything else on that host 403s).
+  'github.com',
   'codeload.github.com',
   'objects.githubusercontent.com',
   'raw.githubusercontent.com',

cloud/apps/sandbox-control/test/network-policy.test.ts

@@ -50,6 +50,10 @@ describe('compileNetworkPolicy', () => {
     })
   })
 
+  it('allows github.com by default so public repos clone without a GitHub App install', () => {
+    expect(compileNetworkPolicy({ mode: 'allowlist' }).allow['github.com']).toEqual([])
+  })
+
   it('adds the wildcard only when a workspace opts into open egress', () => {
     expect(compileNetworkPolicy({ mode: 'open', allowlist: [] })).toEqual({ allow: { '*': [] } })
   })