Prepare 0.14.2 and fix WinGet egress policy

[spoorcc]

Add static.crates.io:443 and objects.githubusercontent.com:443 to the
winget-publish egress allowlist. cargo-binstall fetches the komac source
tarball from static.crates.io to read binstall metadata (even for binary
installs), and the komac binary/dfetch MSI are served from
objects.githubusercontent.com. These two missing endpoints caused the
WinGet publish step to fail for 0.14.0 (index.crates.io) and 0.14.1
(static.crates.io) respectively.

Bump version to 0.14.2 and open the changelog for the new cycle.

Summary by CodeRabbit

• Bug Fixes
  • Fixed git authentication and redirect errors that were incorrectly classified as non-git errors
  • Restored WinGet publish workflow functionality by updating network access configuration

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

Run ID: d9305464-1072-4536-8d37-8aec6b211c2e

📥 Commits

Reviewing files that changed from the base of the PR and between b12d6ba and 40360af.

📒 Files selected for processing (2)

• .github/workflows/winget-publish.yml
• CHANGELOG.rst

---

Walkthrough

Two endpoints (objects.githubusercontent.com:443 and static.crates.io:443) are added to the allowed-endpoints allowlist in the WinGet publish workflow's runner hardening step. A new unreleased Release 0.14.2 section is added to CHANGELOG.rst documenting this fix and a git auth/redirect error classification fix.

Changes

WinGet Publish Egress Fix and Changelog

Layer / File(s)	Summary
Runner hardening egress allowlist and changelog .github/workflows/winget-publish.yml, CHANGELOG.rst	Adds objects.githubusercontent.com:443 and static.crates.io:443 to the harden-runner allowed-endpoints list, and documents the fix alongside a git auth/redirect error classification fix in a new unreleased Release 0.14.2 CHANGELOG entry.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~2 minutes

Possibly related PRs

• dfetch-org/dfetch#1175: Also modifies the step-security/harden-runner configuration with egress-policy: block and edits the allowed-endpoints allowlist for outbound hosts.
• dfetch-org/dfetch#1263: Directly modifies the same .github/workflows/winget-publish.yml runner-hardening egress allowlist, introducing the egress-blocking allowlist step this PR extends.
• dfetch-org/dfetch#1266: Also modifies the .github/workflows/winget-publish.yml runner hardening allowed-endpoints allowlist for crates.io-related egress to unblock the WinGet publish workflow.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title 'Prepare 0.14.2 and fix WinGet egress policy' accurately summarizes the main changes: version bumping and fixing the WinGet workflow egress configuration.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch claude/release-0.14.2-winget-egress-otmowz

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}