Allow ecosystem and custom domains in strict mode network configuration

[Copilot]

Strict mode now allows both ecosystem domains and custom domains in network.allowed, with warnings for ecosystem domains suggesting the use of ecosystem identifiers for better maintainability.

Changes

Validation logic (pkg/workflow/strict_mode_validation.go)

• Modified validateStrictFirewall to allow all domains (ecosystem and custom) in strict mode
• Emit warnings (instead of errors) for ecosystem domains, suggesting ecosystem identifiers
• Warning format: 'pypi.org' → 'python' for better readability
• Increment warning count to track suggestions
• Allow truly custom domains without warnings (e.g., api.example.com, cdn.myservice.io)

Tests (pkg/workflow/strict_mode_llm_gateway_test.go)

• Updated 9 tests to expect warnings instead of errors for ecosystem domains
• Tests verify warning count increases for ecosystem domains
• Tests verify no warnings for ecosystem identifiers and custom domains
• Added TestValidateStrictFirewall_CustomDomainBehavior covering custom domain scenarios

Documentation (docs/src/content/docs/reference/network.md)

• Changed from "Ecosystem Identifier Requirement" to "Ecosystem Identifier Recommendation"
• Updated examples to show warnings (⚠) instead of errors (❌)
• Clarified that workflows compile successfully with warnings

Example

# ✅ Allowed in strict mode (no warnings)
strict: true
network:
  allowed:
    - python                  # Ecosystem identifier
    - "api.example.com"       # Custom domain

# ⚠ Allowed in strict mode with warning
strict: true
network:
  allowed:
    - "pypi.org"              # Warning: suggest using 'python' ecosystem identifier

Warning message:

⚠ strict mode: recommend using ecosystem identifiers instead of individual domain names for better maintainability: 'pypi.org' → 'python'
✓ Compiled 1 workflow(s): 0 error(s), 1 warning(s)

Behavior Change

Before: Ecosystem domains were rejected with an error, preventing compilation.

After: Ecosystem domains are allowed and workflows compile successfully, but a warning is emitted suggesting the use of ecosystem identifiers for better maintainability.

> [!WARNING]
>
>

---

🔒 GitHub Advanced Security automatically protects Copilot coding agent pull requests. You can protect all pull requests by enabling Advanced Security for your repositories. Learn more about Advanced Security.

[pelikhan]

@copilot allow domain from know sets but suggest sets instead

[Copilot]

@copilot allow domain from know sets but suggest sets instead

Done! Changed strict mode to allow ecosystem domains (like pypi.org) while emitting a warning suggesting to use ecosystem identifiers instead (like python).

Example warning output:

⚠ strict mode: recommend using ecosystem identifiers instead of individual domain names for better maintainability: 'pypi.org' → 'python', 'npmjs.org' → 'node'

Workflows now compile successfully with warnings instead of failing with errors. Commit: c85d988

[Copilot]

Pull request overview

This PR changes strict mode network validation from rejecting ecosystem domains with errors to allowing them with warnings, while continuing to allow truly custom domains. The goal is to improve usability by making strict mode less restrictive while still encouraging best practices through warnings.

Changes:

• Modified validation logic to emit warnings instead of errors for ecosystem domains like pypi.org, suggesting ecosystem identifiers like python
• Updated 9 existing tests and added new comprehensive test suite covering custom domain behavior
• Updated reference documentation to reflect the new "recommendation" model rather than "requirement" model

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated no comments.

File	Description
pkg/workflow/strict_mode_validation.go	Changed validateStrictFirewall to allow all domains (ecosystem and custom) with warnings for ecosystem domains instead of errors
pkg/workflow/strict_mode_llm_gateway_test.go	Updated test expectations from errors to warnings, added comprehensive test coverage for custom domain scenarios
docs/src/content/docs/reference/network.md	Updated documentation from "requirement" to "recommendation" language, changed examples from errors (❌) to warnings (⚠)

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.