Allow Deno firewall access to JSR registry

[Copilot]

Deno workflows failed to download packages from JSR because jsr.io domains were absent from the network allowlist shared by the deno/node ecosystem.

• Allowlist update: Added jsr.io and *.jsr.io to the node ecosystem domain data used by the deno runtime mapping.
• Regression guard: Extended node ecosystem test to assert JSR domains are included.

Example:

"node": [
  "deno.land",
  "jsr.io",
  "*.jsr.io"
]

Original prompt

---

This section details on the original issue you should resolve

<issue_title>Add jsr.io to deno network profile allowed domains</issue_title>
<issue_description>## Problem

The deno runtime profile in the network firewall allowlist is missing jsr.io domains. JSR (JavaScript Registry) is Deno's modern package registry and is required for most contemporary Deno projects.

Current Behavior

When running agentic workflows with deno runtime and firewall enabled, Deno cannot download dependencies from JSR:

error: JSR package manifest for '@std/assert' failed to load. 
Import 'https://jsr.io/@std/assert/meta.json' failed.

The firewall returns HTTP 403 because jsr.io is not in the allowed domains.

Root Cause

In pkg/workflow/domains.go, the deno runtime maps to the "node" ecosystem:

var runtimeToEcosystem = map[string]string{
    // ...
    "deno": "node",   // deno.land is in the node ecosystem
}

The node ecosystem in pkg/workflow/data/ecosystem_domains.json includes deno.land but not jsr.io:

"node": [
  "npmjs.org",
  // ...
  "deno.land",
  // jsr.io is missing
]

Proposed Solution

Add JSR domains to the node ecosystem (since deno shares it) or create a separate deno ecosystem:

"jsr.io",
"*.jsr.io"

Testing

Tested with these Deno projects:

• denoland/std - Deno standard library (uses @std/* from JSR)
• oakserver/oak - Oak web framework (uses @oak/* and @std/* from JSR)

Both failed to run tests because JSR dependencies couldn't be resolved.

Related

• JSR documentation: https://jsr.io/docs
• JSR is the recommended registry for Deno packages as of Deno 1.x+</issue_description>

Comments on the Issue (you are @copilot in this section)

• Fixes Add jsr.io to deno network profile allowed domains #12395

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.

[github-actions]

🔍 PR Triage Results

Category: chore | Risk: low | Priority: 45/100

Scores Breakdown

• Impact: 20/50 - Infrastructure/tooling update
• Urgency: 15/30 - 0 days old, 0 comments
• Quality: 10/20 - Description: good, CI: unknown

📋 Recommended Action: batch_review

Medium-priority PR suitable for batch processing

Batch: This PR is part of the firewall-config batch along with #12400. Consider reviewing both PRs together for efficient processing.

---

Triaged by PR Triage Agent on 2026-01-29

AI generated by PR Triage Agent