[denis-egaluev]

What are you trying to accomplish?

Hosted Dependabot swift version updates fail for any repository depending on the edna ChatCenterUI SDK (edna-ru/chatcenterui-ios) since proxy-egress-enforce was enabled. The SDK declares its ChatCenterUI binaryTarget on https://maven-pub.edna.ru/... (Package.swift @ 5.13.0), and the allowlist 403s that host:

GET https://maven-pub.edna.ru:443/repository/maven-releases/edna/chatcenter/ui/ios/5.12.0.zip
* egress not allowlisted maven-pub.edna.ru
403 https://maven-pub.edna.ru:443/repository/maven-releases/edna/chatcenter/ui/ios/5.12.0.zip
error: failed downloading 'https://maven-pub.edna.ru/repository/maven-releases/edna/chatcenter/ui/ios/5.12.0.zip' which is required by binary target 'ChatCenterUI': badResponseStatusCode(403)

SwiftPM resolves the whole package graph during manifest parsing, so the job dies in Dependabot::Swift::FileParser and no Swift PRs are opened at all; ignoring the dependency in dependabot.yml doesn't help.

maven-pub.edna.ru is the vendor's public Sonatype Nexus (edna, edna.ru), referenced from the vendor's own public Package.swift, and serves the artifact anonymously, so there is no credential to declare under registries:. The host is needed by every repository that consumes the SDK, which is the case Resolve a blocked host describes for the defaults.

This adds maven-pub.edna.ru as an exact host to ecosystem_default_domains.swift.

Anything you want to highlight for special attention from reviewers?

• Public vendor host, not a private registry. The artifact path answers 200 anonymously (Server: nginx, Content-Length: 15569329), no Location, no redirect to another host.
• Exact entry only. *.edna.ru is a single wildcard certificate (GlobalSign DV) that also fronts the vendor's product, docs and API hosts, so the parent domain and siblings must stay blocked; the negative tests pin that.
• Same shape as the previous Swift binaryTarget additions (Add Karte SDK Swfit url to egress allowlist #298, Allowlist prelude-public.s3.amazonaws.com for Swift binary targets #305, Allowlist sf16-fe-tos-sg.i18n-pglstatp.com for Swift binary targets #316, Allowlist applesdk.vindral.com for Swift binaryTargets #325).

How will you know you've accomplished your goal?

• TestEgressAllowlist_PublicVendorRegistriesAllowed now allows the 5.13.0.zip artifact URL and keeps evil.maven-pub.edna.ru, attacker.edna.ru and edna.ru blocked.
• After release, the proxy log of a swift job that depends on the SDK shows 200 for maven-pub.edna.ru instead of egress not allowlisted.

Checklist

• I have run the complete test suite to ensure all tests and linters pass.
• I have thoroughly tested my code changes to ensure they work as expected, including adding additional tests for new functionality.
• I have written clear and descriptive commit messages.
• I have provided a detailed description of the changes in the pull request, including the problem it addresses, how it fixes the problem, and any relevant details about the implementation.
• I have ensured that the code is well-documented and easy to understand.