[refactoring] Skill extraction: shared/network-github-defaults.md for standard defaults+github network policy

[github-actions]

Skill: shared/network-github-defaults.md — standard defaults + github network policy

Problem: 72 workflows configure the identical minimal network-egress policy:

network:
  allowed:
    - defaults
    - github

Of these, 43 workflows use exactly this two-entry list with no additional domains (e.g. smoke-deepseek-harness.md, go-fan.md, daily-workflow-updater.md, ai-moderator.md, claude-code-user-docs-review.md, daily-reliability-review.md, auto-triage-issues.md, layout-spec-maintainer.md). The remaining ~29 add extra domains on top (e.g. node, go, python) but still start from this same defaults + github baseline.

Per current merge semantics, network.allowed domains from imports union with the main workflow's list (deduped, sorted), so factoring the common baseline into a shared import is safe even for workflows that need additional domains — they simply add their extra entries in the main file and the shared baseline is still applied.

Proposed shared component: .github/workflows/shared/network-github-defaults.md

---
network:
  allowed:
    - defaults
    - github
---

Impact:

• 43 workflows can drop their inline block entirely; another ~29 can trim to only their extra domains (e.g. - node), inheriting defaults/github from the import.
• ~72 workflows touched, ~3 lines saved on the 43 exact matches (~129 lines), plus reduced duplication risk for the remaining 29.
• Maintenance: a change to the baseline egress policy (e.g. adding a new required domain for GitHub API changes) becomes a single-file edit instead of 70+ manual edits.

Migration plan:

1. Create shared/network-github-defaults.md with the block above.
2. For the 43 exact-match workflows: replace inline network: block with - shared/network-github-defaults.md in imports:.
3. For the ~29 workflows with extra domains: add the import and trim the inline network.allowed list to only the extra domain(s), relying on union-merge for defaults/github.
4. Compile and diff .lock.yml before/after each batch to confirm the merged allowed list is unchanged.
5. Run make recompile after all edits.

Example usage:

imports:
  - shared/network-github-defaults.md
network:
  allowed:
    - node   # only the extra domain needed on top of defaults+github

Priority: Medium (70+ workflows show the pattern, but partial matches with extra domains add modest migration review overhead compared to recommendation #1).

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• o205451.ingest.us.sentry.io

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "o205451.ingest.us.sentry.io"

See Network Configuration for more information.

Generated by 🔍 Workflow Skill Extractor · copilot · auto · 83.1 AIC · ⌖ 9.31 AIC · ⊞ 7.3K · ◷

• expires on Sep 25, 2026, 7:55 PM UTC-08:00