[Thom Chiovoloni (thomcc-work)]

Fallout from #426 :(

[Copilot]

Warning

Copilot couldn't run its full agentic review because it didn't start before the timeout. Make sure your repository has a runner available, or add a copilot-code-review.yml file specifying one with the runs-on attribute. See the docs for more details.

Copilot review overview

2 open issues

• The test will raise IndexError if either sentinel substring is missing/renamed, which produces a… · New
• Path.read_text() without an explicit encoding can vary by environment/locale, and split(",")… · New

What changed in this PR

Aligns Docker image SSRF/HTTP allowlist configuration with the local runner and updates CI triggers after changes introduced in #426.

Changes:

• Expands pg_durable.http_allowed_domains in the Docker image to include additional Azure-related domains.
• Adds a regression test to ensure the Docker image allowlist matches the local runner’s allowlist.
• Updates the Docker GitHub Actions workflow path filters to rerun when allowlist/SSRF inputs change.

File	Description
tests/​test_docker_runner.py	Adds a test that compares Dockerfile vs local script allowlist values.
Dockerfile	Updates pg_durable.http_allowed_domains to include additional domains.
.github/​workflows/​docker.yml	Ensures Docker workflow reruns when allowlist sources change.

_{Review effort: Lite}

[Copilot]

🟢 Approval recommended

The scoped configuration fix, regression test, and CI triggers are consistent, with no unresolved issues identified.

No open issues 🎉

2 resolved since last review

• Path.read_text() without an explicit encoding can vary by environment/locale, and split(",")…
• The test will raise IndexError if either sentinel substring is missing/renamed, which produces a…

_{Review effort: Balanced}