ci: allow requests to Cloudflare R2 storage services for Docker (#320)

Author: Djaytan

.github/workflows/ci.yml

@@ -36,7 +36,7 @@ jobs:
       # -> "*.github.com": Standard interactions with GitHub
       # -> "objects.githubusercontent.com": Uploading of security reports
       # -> "raw.githubusercontent.com": Retrieve license file when building OCI image
-      # -> "*.docker.io" & "*.docker.com": Standard interactions with Docker
+      # -> "*.docker.io", "*.docker.com" & "docker-images-prod.*.r2.cloudflarestorage.com": Standard interactions with Docker
       # -> "*.alpinelinux.org": Standard interactions with Alpine Linux package repositories
       # -> "cdn.fwupd.org": Firmware updates (Alpine)
       # -> "api.papermc.io": Dynamic retrieval of the PaperMC server
@@ -54,6 +54,7 @@ jobs:
             raw.githubusercontent.com:443
             *.docker.io:443
             *.docker.com:443
+            docker-images-prod.*.r2.cloudflarestorage.com
             dl-cdn.alpinelinux.org:443
             cdn.fwupd.org:443
             api.papermc.io:443

.github/workflows/docs-deploy.yml

@@ -24,7 +24,7 @@ jobs:
       # Firewall rules:
       # -> "*.github.com": Standard interactions with GitHub
       # -> "*.pypi.org" & "files.pythonhosted.org": Downloading Python packages
-      # -> "*.docker.io" & "*.docker.com": Standard interactions with Docker
+      # -> "*.docker.io", "*.docker.com" & "docker-images-prod.*.r2.cloudflarestorage.com": Standard interactions with Docker
       # -> "*.alpinelinux.org": Standard interactions with Alpine Linux package repositories
       # -> "cdn.fwupd.org": Firmware updates (Alpine)
       - name: Harden runner
@@ -39,6 +39,7 @@ jobs:
             files.pythonhosted.org:443
             *.docker.io:443
             *.docker.com:443
+            docker-images-prod.*.r2.cloudflarestorage.com
             dl-cdn.alpinelinux.org:443
             cdn.fwupd.org:443
 

.github/workflows/docs-validate.yml

@@ -24,7 +24,7 @@ jobs:
       # Firewall rules:
       # -> "*.github.com": Standard interactions with GitHub
       # -> "*.pypi.org" & "files.pythonhosted.org": Downloading Python packages
-      # -> "*.docker.io" & "*.docker.com": Standard interactions with Docker
+      # -> "*.docker.io", "*.docker.com" & "docker-images-prod.*.r2.cloudflarestorage.com": Standard interactions with Docker
       # -> "*.alpinelinux.org": Standard interactions with Alpine Linux package repositories
       # -> "cdn.fwupd.org": Firmware updates (Alpine)
       - name: Harden runner
@@ -39,6 +39,7 @@ jobs:
             files.pythonhosted.org:443
             *.docker.io:443
             *.docker.com:443
+            docker-images-prod.*.r2.cloudflarestorage.com
             dl-cdn.alpinelinux.org:443
             cdn.fwupd.org:443
 

.github/workflows/release-maintenance.yml

@@ -61,7 +61,7 @@ jobs:
       # Firewall rules:
       # -> "*.github.com": Standard interactions with GitHub
       # -> "raw.githubusercontent.com": Retrieve license file when building OCI image
-      # -> "*.docker.io" & "*.docker.com": Standard interactions with Docker
+      # -> "*.docker.io", "*.docker.com" & "docker-images-prod.*.r2.cloudflarestorage.com": Standard interactions with Docker
       # -> "*.alpinelinux.org": Standard interactions with Alpine Linux package repositories
       # -> "cdn.fwupd.org": Firmware updates (Alpine)
       # -> "api.papermc.io": Dynamic retrieval of the PaperMC server
@@ -78,6 +78,7 @@ jobs:
             uploads.github.com:443
             *.docker.io:443
             production.cloudflare.docker.com:443
+            docker-images-prod.*.r2.cloudflarestorage.com
             dl-cdn.alpinelinux.org:443
             cdn.fwupd.org:443
             api.papermc.io:443

.github/workflows/release-on-change.yml

@@ -42,7 +42,7 @@ jobs:
       # Firewall rules:
       # -> "*.github.com": Standard interactions with GitHub
       # -> "raw.githubusercontent.com": Retrieve license file when building OCI image
-      # -> "*.docker.io" & "*.docker.com": Standard interactions with Docker
+      # -> "*.docker.io", "*.docker.com" & "docker-images-prod.*.r2.cloudflarestorage.com": Standard interactions with Docker
       # -> "*.alpinelinux.org": Standard interactions with Alpine Linux package repositories
       # -> "cdn.fwupd.org": Firmware updates (Alpine)
       # -> "api.papermc.io": Dynamic retrieval of the PaperMC server
@@ -59,6 +59,7 @@ jobs:
             uploads.github.com:443
             *.docker.io:443
             production.cloudflare.docker.com:443
+            docker-images-prod.*.r2.cloudflarestorage.com
             dl-cdn.alpinelinux.org:443
             cdn.fwupd.org:443
             api.papermc.io:443