Duo Workflow Executor binary should be downloaded from internal URL in CI
Everyone can contribute. Help move this issue forward while earning points, leveling up and collecting rewards.
Problem
Right now we download the duo-workflow-executor binary in CI jobs from our public gitlab.com URL at https://gitlab.com/gitlab-org/gitlab/-/blob/af7b21a4b560baaaadecdea5cb4a29d9b418615a/ee/app/services/ai/duo_workflows/start_workflow_service.rb#L86 . This is wasteful as it does a full round trip out of our network via cloudflare and back to runners. This slows things down but also creates egress costs for us.
Solution
Use an internal load balancer to get this binary more directly from our releases API. Note that we may want to look into how the CI runner clones the git repos as they also need to rewrite the clone URL to a local URL for the same reasons.