Prevent falling back to default token for onprem

[thyeggman]

...

[Copilot]

Pull Request Overview

This PR prevents GitHub Actions runners from falling back to default tokens when downloading actions from GitHub.com in on-premises environments, specifically for GitHub Enterprise Cloud with data residency scenarios.

• Adds logic to detect GitHub Enterprise Cloud environments with data residency
• Implements conditional token fallback that prevents using default tokens for external action downloads
• Introduces URL pattern validation to identify action downloads from GitHub.com

Reviewed Changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 3 comments.

File	Description
src/Runner.Worker/ActionManager.cs	Adds GitHub URL detection and conditional logic to prevent default token fallback for on-premises scenarios
src/Runner.Sdk/Util/UrlUtil.cs	Implements new utility method to detect GHEC data residency fallback scenarios with regex pattern matching

[Copilot]

The method IsGHECDRFallbackToDotcom is called with a potentially null gitHubUrl parameter. This will cause a null reference exception if both serverUrl and runnerSettings.GitHubUrl are null or empty.

Suggested change

	if (string.IsNullOrEmpty(actionDownloadInfo.Authentication?.Token) && !UrlUtil.IsGHECDRFallbackToDotcom(gitHubUrl, actionDownloadInfo))
	if (string.IsNullOrEmpty(actionDownloadInfo.Authentication?.Token) && (gitHubUrl == null || !UrlUtil.IsGHECDRFallbackToDotcom(gitHubUrl, actionDownloadInfo)))