Error: Refusing to load module...because it does not match any entry in the module allowlist

[StefMa]

Given I paste the following into the playground:

amends "package://pkg.pkl-lang.org/github.com/stefma/pkl-gha/com.github.action@0.0.3#/GitHubAction.pkl"
import "https://someUrlSomewhere.com/Steps.pkl"

name = "AWorkflow"

on {
    pull_request {}
}


jobs {
    ["build"] {
        `runs-on` = "ubuntu-latest"
        steps {
            Steps.checkout
        }
    }
}

While the Steps.pkl has the following content:

import "package://pkg.pkl-lang.org/github.com/stefma/pkl-gha/com.github.action@0.0.3#/GitHubAction.pkl"

checkout: GitHubAction.Step = new {
  name = "Checkout"
  uses = "actions/checkout@v4"
}

I get the following error:

Refusing to load module `https://someUrlSomehwere.com/Steps.pkl` because it does not match any entry in the module allowlist (`--allowed-modules`).

Locally, with pkl 0.26.3 everything works as expected

pkl eval test.pkl

Yields to

# Do not modify!
# This file was generated from a template using https://github.com/StefMa/pkl-gha

name: AWorkflow
'on':
  pull_request: {}
jobs:
  build:
    runs-on: ubuntu-latest
    steps:
    - name: Checkout
      uses: actions/checkout@v4

Maybe this is an problem on an old pkl version? 🤔
This is why I also raised this issue.

[jasongwartz]

@StefMa I think this probably isn't about Pkl version, it's the security feature that restricts imports unless trusted. See --allowed-modules on: https://pkl-lang.org/main/current/pkl-cli/index.html#common-options

You can see I've configured the allowed modules here: https://github.com/jasongwartz/pkl-playground/blob/main/src/app/api/pkl/evaluate/route.ts#L36

I'm not sure about loading arbitrary HTTPS modules - that seems a bit risky. (Though I suppose allowing package: does allow anything under package://pkg.pkl-lang.org/github.com, which is anything uploaded to GitHub)

[jasongwartz]

Are you able to host your "https://someUrlSomewhere.com/Steps.pkl" package on GitHub as a package, and use the pkg.pkl-lang.org proxy?

[jasongwartz]

Locally, with pkl 0.26.3 everything works as expected

The reason it works locally is because, as per the CLI docs, the CLI defaults to allowing both package: and https:.