Why doesn't addOns.common.universalActions not need the URL to be in the urlFetchWhitelist list for it to work in a Google Workspace Add-on manifest

Question

Google's documentation says that all URLs must be explicitly listed in urlFetchWhitelist.

However, I have a URL in universalActions and it works, even though I don't have the URL in urlFetchWhitelist. What am I misunderstanding?

{
    "timeZone": "America/New_York",
    "exceptionLogging": "STACKDRIVER",
    "runtimeVersion": "V8",
    "oauthScopes": [],
    "addOns": {
        "common": {
            "universalActions": [
                {
                    "label": "About",
                    "openLink": "https://github.com/imthenachoman/Gmail-Auto-Vacation-Responder"
                }
            ]
        },
        "gmail": {},
        "calendar": {}
    }
}

Answer 1

As stated in the documentation:

Universal actions are menu item elements that allow a user to open a new web page, display new UI cards, or run a specific Apps Script function when selected. In operation they are very similar to card actions, except that universal actions are always placed on every card in your add-on, regardless of the current add-on context.

The scope of the Unversal Actions is already defined inside the appscript.json, so it would not make sense to include it again inside the urlFetchWhiteList. As you can read in the documentation:

Universal actions are configured in your add-on's project manifest. Once you've configured a universal action, it is always available to users of your add-on.

In short, Universal Actions are intended for actions that do not depend on the current execution context, and that are available from anywhere in the add-on. For any other type of request, for example, interacting with an external API, the urls of that API should be included in the urlFetchWhiteList.