GeezerVison

The World Wide Web, restored to 800 pixels of glory.

GeezerVison is showing github.com — Use private registry proxy for API requests when available by mbg · Pull Request #4007 · github/codeql-action

Conversation

mbg commented Jul 13, 2026 •

edited

Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link

Copy Markdown

Member

This PR allows the CodeQL Action to use the private registry authentication proxy when fetching remote configuration files. The authentication proxy is available in Default Setup workflows. Doing so allows configuration files to be retrieved from private repositories, provided that a suitable git_source registry is set up for the organisation.

#4000 has laid the groundwork for this, by always enabling git_source registries when they are available.

The change is behind a new FF.

Risk assessment

For internal use only. Please select the risk level of this change:

Low risk: Changes are fully under feature flags, or have been fully tested and validated in pre-production environments and are highly observable, or are documentation or test only.

Which use cases does this change impact?

Workflow types:

Managed - Impacts users with dynamic workflows (Default Setup, Code Quality, ...).

Products:

Code Scanning - The changes impact analyses when analysis-kinds: code-scanning.
Code Quality - The changes impact analyses when analysis-kinds: code-quality.
Other first-party - The changes impact other first-party analyses.

Environments:

Dotcom - Impacts CodeQL workflows on github.com and/or GitHub Enterprise Cloud with Data Residency.
GHES - Impacts CodeQL workflows on GitHub Enterprise Server.

How did/will you validate this change?

Test repository - This change will be tested on a test repository before merging.
Unit tests - I am depending on unit test coverage (i.e. tests in .test.ts files).
End-to-end tests - I am depending on PR checks (i.e. tests in pr-checks).

If something goes wrong after this change is released, what are the mitigation and rollback strategies?

Feature flags - All new or changed code paths can be fully disabled with corresponding feature flags.

How will you know if something goes wrong after this change is released?

Telemetry - I rely on existing telemetry or have made changes to the telemetry.
- Dashboards - I will watch relevant dashboards for issues after the release. Consider whether this requires this change to be released at a particular time rather than as part of a regular release.
- Alerts - New or existing monitors will trip if something goes wrong with this change.

Are there any special considerations for merging or releasing this change?

No special considerations - This change can be merged at any time.

Merge / deployment checklist

Confirm this change is backwards compatible with existing workflows.
Consider adding a changelog entry for this change.
Confirm the readme and docs have been updated if necessary.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions

mbg self-assigned this

Jul 13, 2026

github-actions Bot added the size/S Should be easy to review label

Jul 13, 2026

mbg added 7 commits

July 13, 2026 16:15


          Make undici an explicit dependency

dab0ab7


          Add RegistryProxyVars enum

8763bac


          Allow getTestEnv to be parameterised over initial env


          Add minimal proxy init code

a29dee4


          Move init step at the end of start-proxy test workflow

e387ec1


          Set language inputs in start-proxy check workflow

b0eaa56


          Set CODEQL_PROXY_* vars for init step in test workflow

b6d92e3

mbg force-pushed the mbg/use-registry-proxy-for-repo-auth branch from fcdd601 to b6d92e3 Compare

July 13, 2026 15:17

mbg added 7 commits

July 13, 2026 16:24


          Specify custom config-file in start-proxy check

50b3687


          Allow proxy to be threaded into createApiClientWithDetails

80599cc

This will make it easier to gate the `getRegistryProxy` with a FF,
without the significant refactoring that is needed to thread the FFs
into `createApiClientWithDetails`


          Gate proxy usage behind FF

6d70593


          Use ActionState for getRegistryProxy

205b37b


          Add and use clone method for ReadOnlyEnv

b946565


          Log whether the proxy is picked up on

47e9c29


          Test proxy usage for getRemoteConfig

a1c676d

github-actions Bot added size/M Should be of average difficulty to review and removed size/S Should be easy to review labels

Jul 14, 2026

mbg marked this pull request as ready for review

July 14, 2026 16:16

mbg requested a review from a team as a code owner

July 14, 2026 16:16

Copilot AI review requested due to automatic review settings

July 14, 2026 16:16

Copilot started reviewing on behalf of mbg

July 14, 2026 16:16

View session

mbg commented Jul 14, 2026

Copy link

Copy Markdown

Member Author

As an example of this in action, see https://github.com/github/codeql-action/actions/runs/29347975179/job/87138397597?pr=4007#step:8:312 for the expected log message and the proxy log artifact at https://github.com/github/codeql-action/actions/runs/29347975179/artifacts/8317105753

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

Copilot AI reviewed

Jul 14, 2026

View reviewed changes

Copilot AI left a comment

Copy link

Copy Markdown

Contributor

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Warning

Copilot's review of this pull request may be incomplete because some of the changed files are excluded by your Copilot content exclusion settings. See Excluding content from Copilot for details.

Pull request overview

Adds feature-flagged registry-proxy support for retrieving remote CodeQL configuration files from private repositories.

Changes:

Adds proxy environment handling and Undici-based API routing.
Routes remote configuration requests through the proxy when enabled.
Adds unit and PR-check coverage.

Show a summary per file

File	Description
`src/api-client.ts`	Implements proxy-aware API clients.
`src/api-client.test.ts`	Tests proxy configuration.
`src/config/file.ts`	Proxies remote configuration requests.
`src/config/file.test.ts`	Tests feature-flagged proxy selection.
`src/environment.ts`	Defines proxy variables and environment cloning.
`src/feature-flags.ts`	Adds the proxy feature flag.
`src/testing-utils.ts`	Isolates environments between test-builder clones.
`pr-checks/checks/start-proxy.yml`	Exercises proxy-backed initialization.
`package.json`	Adds Undici.
`package-lock.json`	Locks the dependency update.
`lib/entry-points.js`	Generated artifact; excluded from review.
`.github/workflows/__start-proxy.yml`	Generated workflow; excluded from review.

Review details

Files excluded by content exclusion policy (2)

.github/workflows/__start-proxy.yml
lib/entry-points.js

Files reviewed: 9/12 changed files
Comments generated: 1
Review effort level: Medium

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions

Comment thread

src/config/file.test.ts Resolved

Uh oh!

There was an error while loading. Please reload this page.

mbg added 4 commits

July 14, 2026 19:27


          Merge remote-tracking branch 'origin/main' into mbg/use-registry-prox…

d705aa3

…y-for-repo-auth


          Validate proxy argument in tests

1a0eca3


          Merge remote-tracking branch 'origin/main' into mbg/use-registry-prox…

7b19180

…y-for-repo-auth


          Remove unneeded type assertion now that ApiClient exists

4292bd7

mario-campos reviewed

Jul 16, 2026

View reviewed changes

Comment thread

src/api-client.test.ts Resolved

Uh oh!

There was an error while loading. Please reload this page.

Comment thread

pr-checks/checks/start-proxy.yml Resolved

Uh oh!

There was an error while loading. Please reload this page.

Comment thread

src/config/file.test.ts

Comment on lines +109 to +134

		// Should use it when the FF is enabled and the environment variables are set.
		await target
		.withFeatures([Feature.ProxyApiRequests, Feature.NewRemoteFileAddresses])
		.withEnv((env) => {
		env.set(RegistryProxyVars.PROXY_HOST, "localhost");
		env.set(RegistryProxyVars.PROXY_PORT, "1234");
		})
		.logs(t, "Using private registry proxy at 'http://localhost:1234'")
		.passes(t.truthy);

		// But not when the FF is not enabled.
		await target
		.withFeatures([Feature.NewRemoteFileAddresses])
		.withEnv((env) => {
		env.set(RegistryProxyVars.PROXY_HOST, "localhost");
		env.set(RegistryProxyVars.PROXY_PORT, "1234");
		})
		.notLogs(t, "Using private registry proxy at 'http://localhost:1234'")
		.throws(t, { message: errorMessage });

		// And not when the environment variables aren't set.
		await target
		.withFeatures([Feature.ProxyApiRequests, Feature.NewRemoteFileAddresses])
		.notLogs(t, "Using private registry proxy at 'http://localhost:1234'")
		.throws(t, { message: errorMessage });
		});

mario-campos Jul 16, 2026 •

edited

Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link

Copy Markdown

Contributor

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think that these should be three individual unit tests—per best-practice. But, that's quite a lot of boilerplate setup code to duplicate. You could put it into a helper setup method, but not crazy about that either. I'll leave that up to you whether to keep as-is, or split/refactor.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions

mbg Jul 16, 2026

Copy link

Copy Markdown

Member Author

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I have no strong feelings here. I can break this up into three separate tests, but these can also be viewed as three separate assertions. Not duplicating the boilerplate isn't hard.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions

Comment thread

src/api-client.ts Resolved

Uh oh!

There was an error while loading. Please reload this page.


          Remove unused getApiFetch

8125f87

mario-campos self-requested a review

July 17, 2026 12:44

mario-campos previously approved these changes

Jul 17, 2026

View reviewed changes


          Refactor looking up proxy env vars into getRegistryProxyConfig.

7db34ae

This makes that function testable.

mbg dismissed mario-campos’s stale review via

7db34ae

July 17, 2026 12:49

mbg requested a review from mario-campos

July 17, 2026 12:50

mario-campos approved these changes

Jul 17, 2026

View reviewed changes

mbg added this pull request to the merge queue

Jul 17, 2026

Merged via the queue into main with commit cf46341

Jul 17, 2026

225 checks passed

Uh oh!

There was an error while loading. Please reload this page.

mbg deleted the mbg/use-registry-proxy-for-repo-auth branch

July 17, 2026 14:18

This was referenced Jul 21, 2026

Merge main into releases/v4 #4027

Merged

Merge releases/v4 into releases/v3 #4029

Merged

mbg mentioned this pull request

Jul 22, 2026

Use default request options instead of undefined #4030

Merged

Reviewers

Copilot code review Copilot

Copilot review effort

Applies to this pull request for everyone.Learn more about Copilot code review.

Copilot left review comments

mario-campos

mario-campos approved these changes

Uh oh!

There was an error while loading. Please reload this page.

Assignees

mbg

Labels

size/M

Should be of average difficulty to review

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Uh oh!

There was an error while loading. Please reload this page.

3 participants

Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.

You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.

GeezerVison

Conversation

mbg commented Jul 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Risk assessment

Which use cases does this change impact?

How did/will you validate this change?

If something goes wrong after this change is released, what are the mitigation and rollback strategies?

How will you know if something goes wrong after this change is released?

Are there any special considerations for merging or releasing this change?

Merge / deployment checklist

Uh oh!

mbg commented Jul 14, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Review details

Uh oh!

Uh oh!

Uh oh!

Uh oh!

mario-campos Jul 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

mbg Jul 16, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

mbg commented Jul 13, 2026 •

edited

Loading

Uh oh!

There was an error while loading. Please reload this page.

mario-campos Jul 16, 2026 •

edited

Loading

Uh oh!

There was an error while loading. Please reload this page.