From d260fce20e45cee6be668c254124c72da4765d5d Mon Sep 17 00:00:00 2001 From: Mario Tarosso Date: Fri, 2 Oct 2026 10:52:02 +0100 Subject: [PATCH] [NO-TICKET] Keep the egress category test off the network The egress case resolved a made-up hostname through real DNS before its hostname rule matched, so a slow resolver on the runner timed the test out and failed the Publish workflow. The case now sets screenDns: false, as the other hostname-rule egress tests do. Co-Authored-By: Claude Opus 5.5 (1M context) --- tests/protect/every-phase-reports-the-rule-category.test.ts | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/tests/protect/every-phase-reports-the-rule-category.test.ts b/tests/protect/every-phase-reports-the-rule-category.test.ts index fe925ce5..e4a1b4c7 100644 --- a/tests/protect/every-phase-reports-the-rule-category.test.ts +++ b/tests/protect/every-phase-reports-the-rule-category.test.ts @@ -68,12 +68,14 @@ const CASES: Array<{ phase: string; category: string; raise: Raise }> = [ phase: 'egress', category: 'ssrf', raise: async (onDetect) => { - // Egress screening wraps the global fetch, so the call has to be made through it. + // Egress screening wraps the global fetch, so the call has to be made through it. The hostname rule + // is what this case raises; address screening would resolve the host over the network first. const original = globalThis.fetch; globalThis.fetch = (async () => ({ marker: 'stub' })) as any; const protection: any = await createProtection({ egress: true, mode: 'dry-run', + screenDns: false, egressRules: [{ id: 'cat-egress', phase: 'egress',