[pmkit19]

What are you trying to accomplish?

Dependabot helm jobs can't read the chart index of the Percona Helm chart repository: the proxy blocks percona.github.io (egress not allowlisted, 403). This adds it to ecosystem_default_domains.helm.

Host	What it serves	Evidence
percona.github.io	Percona chart repo index.yaml; tarballs are on github.com (already allowed)	Documented in charts/pg-operator/README.md (helm repo add percona https://percona.github.io/percona-helm-charts/); GitHub Pages of the percona org;index.yaml returns anonymous 200

Anything you want to highlight for special attention from reviewers?

Exact host only, no *.github.io widening, same form as fluent.github.io.

How will you know you've accomplished your goal?

• Positive probe https://percona.github.io/percona-helm-charts/index.yaml in TestEgressAllowlist_AddedMissingDomainsAllowed.
• Child probe https://evil.percona.github.io/payload in TestEgressAllowlist_NewEntriesDoNotWidenBeyondExactHosts. Checked that it bites: switching the entry to .percona.github.io makes the test fail (Expected value not to be nil). Reverted afterwards.
• TestEgressDefaults_NoRedundantEntries passes, so the host isn't already covered by another entry.
• script/test passes locally.

Checklist

• I have run the complete test suite to ensure all tests and linters pass.
• I have thoroughly tested my code changes to ensure they work as expected, including adding additional tests for new functionality.
• I have written clear and descriptive commit messages.
• I have provided a detailed description of the changes in the pull request, including the problem it addresses, how it fixes the problem, and any relevant details about the implementation.
• I have ensured that the code is well-documented and easy to understand.

[Copilot]

🟢 Approval recommended

The narrowly scoped addition includes regression coverage for intended access and exact-host restrictions, with no unresolved findings.

No open issues 🎉

What changed in this PR

Adds Percona’s public Helm chart repository to the proxy’s egress defaults so Dependabot can fetch its chart index.

Changes:

• Allows only the exact host percona.github.io, without widening access to other GitHub Pages hosts.
• Adds regression probes for the chart index and for blocking child subdomains.

File	Description
internal/​handlers/​egress_allowlist_test.go	Adds positive access and negative child-subdomain probes.
internal/​handlers/​egress_allowlist_defaults.yaml	Adds Percona’s exact hostname to the Helm defaults.

_{Review effort: Balanced}