Accept OIDC configurations in `start-proxy` by mbg · Pull Request #3563 · github/codeql-action · GitHub

The Dependabot team have been working on support for OIDC-based authentication in the Dependabot authentication proxy, which we also use to support private package registries in Default Setup.

This PR modifies the start-proxy action to accept such configurations and propagate them to the proxy. This will ensure that we are ready to support OIDC-based authentication when such configurations are available to us. This is not yet the case at the time of writing.

However, that should not block this PR from being merged, since we just perform validation that will allow such configurations to be propagated to the proxy in the future.

Notes for reviewers

Best reviewed commit-by-commit. See the internal issue for more context and references.

Risk assessment

For internal use only. Please select the risk level of this change:

Low risk: Changes are fully under feature flags, or have been fully tested and validated in pre-production environments and are highly observable, or are documentation or test only.

Which use cases does this change impact?

Workflow types:

Managed - Impacts users with dynamic workflows (Default Setup, Code Quality, ...).

Products:

Code Scanning - The changes impact analyses when analysis-kinds: code-scanning.
Code Quality - The changes impact analyses when analysis-kinds: code-quality.
Other first-party - The changes impact other first-party analyses.

Environments:

Dotcom - Impacts CodeQL workflows on github.com and/or GitHub Enterprise Cloud with Data Residency.
GHES - Impacts CodeQL workflows on GitHub Enterprise Server.

How did/will you validate this change?

Test repository - This change will be tested on a test repository before merging.
Unit tests - I am depending on unit test coverage (i.e. tests in .test.ts files).
End-to-end tests - I am depending on PR checks (i.e. tests in pr-checks).

If something goes wrong after this change is released, what are the mitigation and rollback strategies?

Rollback - Change can only be disabled by rolling back the release or releasing a new version with a fix.

How will you know if something goes wrong after this change is released?

Telemetry - I rely on existing telemetry or have made changes to the telemetry.
- Dashboards - I will watch relevant dashboards for issues after the release. Consider whether this requires this change to be released at a particular time rather than as part of a regular release.
- Alerts - New or existing monitors will trip if something goes wrong with this change.

Are there any special considerations for merging or releasing this change?

No special considerations - This change can be merged at any time.

Merge / deployment checklist

Confirm this change is backwards compatible with existing workflows.
Consider adding a changelog entry for this change.
Confirm the readme and docs have been updated if necessary.

Pull request overview

This PR updates the start-proxy action’s credential parsing/types so it can accept and forward future OIDC-based private registry authentication configurations (Azure/AWS/JFrog) to the Dependabot authentication proxy.

Changes:

Extend registry credential typing/validation to include OIDC configuration shapes (Azure/AWS/JFrog) and add a redacting credentialToStr in src/start-proxy/types.ts.
Add/adjust unit tests to cover OIDC acceptance, printable-character validation for OIDC fields, and new credentialToStr formatting/redaction.
Add a changelog entry describing upcoming OIDC-registry compatibility.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
src/start-proxy/types.ts	Adds OIDC auth config types/guards and a new credentialToStr implementation for safe logging.
src/start-proxy/types.test.ts	New unit tests for credentialToStr across password/token/OIDC credential shapes.
src/start-proxy.ts	Adds getAuthConfig and updates credential validation/handling to propagate OIDC configs.
src/start-proxy.test.ts	Updates and expands tests for OIDC credential acceptance and validation behaviors.
lib/start-proxy-action.js	Generated build output (not reviewed).
CHANGELOG.md	Documents OIDC-registry config acceptance.

Comments suppressed due to low confidence (2)

src/start-proxy/types.ts:93

isAWSConfig treats any defined values as valid (including numbers/objects). Since these fields are declared as strings, the guard should also enforce typeof config[property] === "string" for required properties (and audience if present) so invalid types don't slip through validation and reach the proxy.

/** Decides whether `config` is an AWS OIDC configuration. */
export function isAWSConfig(config: Partial<AuthConfig>): config is AWSConfig {
  // All of these properties are required.
  const requiredProperties = [
    "aws_region",
    "account_id",
    "role_name",
    "domain",
    "domain_owner",
  ];

  for (const property of requiredProperties) {
    if (!(property in config) || !isDefined(config[property])) {
      return false;
    }
  }
  return true;
}

src/start-proxy/types.ts:109

isJFrogConfig only checks that jfrog_oidc_provider_name is defined, but not that it's a string. Consider requiring typeof jfrog_oidc_provider_name === "string" (and validating optional fields if present) to avoid propagating malformed configs.

/** Decides whether `config` is a JFrog OIDC configuration. */
export function isJFrogConfig(
  config: Partial<AuthConfig>,
): config is JFrogConfig {
  return (
    "jfrog_oidc_provider_name" in config &&
    isDefined(config.jfrog_oidc_provider_name)
  );

A minor thing, otherwise lgtm!

Pull request overview

Copilot reviewed 7 out of 7 changed files in this pull request and generated 4 comments.

…oidc

mbg added 10 commits March 9, 2026 19:06

Extend isPrintable check to all keys with string values

65f7f36

Move out auth config from Credential type

01b5262

Add OIDC config types

9e26f9e

Add predicates for Auth types

37eb89b

Extract AuthConfig from Credential

7263be2

Move credentialToStr and update it

e168f8e

Run more start-proxy tests in parallel

3d57420

Fix old test

4649e15

Add OIDC tests for getCredentials

88bd340

Add preliminary change note

e90d128

mbg self-assigned this Mar 10, 2026

mbg requested a review from a team as a code owner March 10, 2026 02:16

Copilot AI review requested due to automatic review settings March 10, 2026 02:16

Copilot started reviewing on behalf of mbg March 10, 2026 02:16 View session

github-actions Bot added the size/XL May be very hard to review label Mar 10, 2026

Copilot AI reviewed Mar 10, 2026

View reviewed changes

Comment thread src/start-proxy/types.ts

Comment thread src/start-proxy/types.ts Outdated

Comment thread src/start-proxy.ts

Comment thread CHANGELOG.md Outdated

github-advanced-security Bot found potential problems Mar 10, 2026

View reviewed changes

Comment thread src/start-proxy.ts Fixed

sam-robson requested changes Mar 10, 2026

View reviewed changes

Comment thread CHANGELOG.md Outdated

mbg added 2 commits March 10, 2026 13:23

Fix changelog entry

131392e

Use isDefined for password and token in credentialToStr

823869d

sam-robson previously approved these changes Mar 10, 2026

View reviewed changes

mbg added 2 commits March 10, 2026 15:31

Add JSON helper types and functions

c6e75ac

Type result of parsing JSON as unknown until narrowed

c92efdb

mbg dismissed sam-robson’s stale review via c92efdb March 10, 2026 15:32

mbg requested a review from Copilot March 10, 2026 15:32

Copilot started reviewing on behalf of mbg March 10, 2026 15:33 View session

github-advanced-security Bot found potential problems Mar 10, 2026

View reviewed changes

Comment thread src/start-proxy.ts Dismissed

Copilot AI reviewed Mar 10, 2026

View reviewed changes

Comment thread src/json/index.ts Outdated

Comment thread src/start-proxy.ts

Comment thread src/start-proxy.ts Outdated

Comment thread src/start-proxy/types.ts Outdated

Address review comments

048d0ea

mbg requested a review from sam-robson March 10, 2026 16:47

Merge remote-tracking branch 'origin/main' into mbg/private-registry/…

6c99ca5

…oidc

sam-robson approved these changes Mar 13, 2026

View reviewed changes

mbg added this pull request to the merge queue Mar 13, 2026

Merged via the queue into main with commit e3200e3 Mar 13, 2026
246 checks passed

mbg deleted the mbg/private-registry/oidc branch March 13, 2026 12:18

This was referenced Mar 16, 2026

Merge main into releases/v4 #3574

Merged

Merge releases/v4 into releases/v3 #3577

Merged

mbg mentioned this pull request Mar 16, 2026

Fix warning for PAT-like token with username #3579

Merged

mbg mentioned this pull request Apr 9, 2026

Fix OIDC credential property names #3807

Merged

Accept OIDC configurations in `start-proxy` by mbg · Pull Request #3563 · github/codeql-action · GitHub

Uh oh!

Accept OIDC configurations in start-proxy - #3563

Accept OIDC configurations in start-proxy#3563
mbg merged 16 commits into
mainfrom
mbg/private-registry/oidc

mbg commented Mar 10, 2026 •
edited
Loading

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

sam-robson left a comment

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Accept OIDC configurations in `start-proxy` by mbg · Pull Request #3563 · github/codeql-action · GitHub

Uh oh!

Accept OIDC configurations in start-proxy - #3563

Accept OIDC configurations in start-proxy#3563mbg merged 16 commits intomaingithub/codeql-action:mainfrom mbg/private-registry/oidcgithub/codeql-action:mbg/private-registry/oidcCopy head branch name to clipboard

Conversation

mbg commented Mar 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Risk assessment

Which use cases does this change impact?

How did/will you validate this change?

If something goes wrong after this change is released, what are the mitigation and rollback strategies?

How will you know if something goes wrong after this change is released?

Are there any special considerations for merging or releasing this change?

Merge / deployment checklist

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

sam-robson left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Accept OIDC configurations in start-proxy#3563
mbg merged 16 commits into
mainfrom
mbg/private-registry/oidc

mbg commented Mar 10, 2026 •
edited
Loading