Use private registry proxy for API requests when available by mbg · Pull Request #4007 · github/codeql-action · GitHub

This PR allows the CodeQL Action to use the private registry authentication proxy when fetching remote configuration files. The authentication proxy is available in Default Setup workflows. Doing so allows configuration files to be retrieved from private repositories, provided that a suitable git_source registry is set up for the organisation.

#4000 has laid the groundwork for this, by always enabling git_source registries when they are available.

The change is behind a new FF.

Risk assessment

For internal use only. Please select the risk level of this change:

Low risk: Changes are fully under feature flags, or have been fully tested and validated in pre-production environments and are highly observable, or are documentation or test only.

Which use cases does this change impact?

Workflow types:

Managed - Impacts users with dynamic workflows (Default Setup, Code Quality, ...).

Products:

Code Scanning - The changes impact analyses when analysis-kinds: code-scanning.
Code Quality - The changes impact analyses when analysis-kinds: code-quality.
Other first-party - The changes impact other first-party analyses.

Environments:

Dotcom - Impacts CodeQL workflows on github.com and/or GitHub Enterprise Cloud with Data Residency.
GHES - Impacts CodeQL workflows on GitHub Enterprise Server.

How did/will you validate this change?

Test repository - This change will be tested on a test repository before merging.
Unit tests - I am depending on unit test coverage (i.e. tests in .test.ts files).
End-to-end tests - I am depending on PR checks (i.e. tests in pr-checks).

If something goes wrong after this change is released, what are the mitigation and rollback strategies?

Feature flags - All new or changed code paths can be fully disabled with corresponding feature flags.

How will you know if something goes wrong after this change is released?

Telemetry - I rely on existing telemetry or have made changes to the telemetry.
- Dashboards - I will watch relevant dashboards for issues after the release. Consider whether this requires this change to be released at a particular time rather than as part of a regular release.
- Alerts - New or existing monitors will trip if something goes wrong with this change.

Are there any special considerations for merging or releasing this change?

No special considerations - This change can be merged at any time.

Merge / deployment checklist

Confirm this change is backwards compatible with existing workflows.
Consider adding a changelog entry for this change.
Confirm the readme and docs have been updated if necessary.

This will make it easier to gate the `getRegistryProxy` with a FF, without the significant refactoring that is needed to thread the FFs into `createApiClientWithDetails`

As an example of this in action, see https://github.com/github/codeql-action/actions/runs/29347975179/job/87138397597?pr=4007#step:8:312 for the expected log message and the proxy log artifact at https://github.com/github/codeql-action/actions/runs/29347975179/artifacts/8317105753

Warning

Copilot's review of this pull request may be incomplete because some of the changed files are excluded by your Copilot content exclusion settings. See Excluding content from Copilot for details.

Pull request overview

Adds feature-flagged registry-proxy support for retrieving remote CodeQL configuration files from private repositories.

Changes:

Adds proxy environment handling and Undici-based API routing.
Routes remote configuration requests through the proxy when enabled.
Adds unit and PR-check coverage.

Show a summary per file

File	Description
src/api-client.ts	Implements proxy-aware API clients.
src/api-client.test.ts	Tests proxy configuration.
src/config/file.ts	Proxies remote configuration requests.
src/config/file.test.ts	Tests feature-flagged proxy selection.
src/environment.ts	Defines proxy variables and environment cloning.
src/feature-flags.ts	Adds the proxy feature flag.
src/testing-utils.ts	Isolates environments between test-builder clones.
pr-checks/checks/start-proxy.yml	Exercises proxy-backed initialization.
package.json	Adds Undici.
package-lock.json	Locks the dependency update.
lib/entry-points.js	Generated artifact; excluded from review.
.github/workflows/__start-proxy.yml	Generated workflow; excluded from review.

Review details

Files excluded by content exclusion policy (2)

.github/workflows/__start-proxy.yml
lib/entry-points.js

Files reviewed: 9/12 changed files
Comments generated: 1
Review effort level: Medium

…y-for-repo-auth

I think that these should be three individual unit tests—per best-practice. But, that's quite a lot of boilerplate setup code to duplicate. You could put it into a helper setup method, but not crazy about that either. I'll leave that up to you whether to keep as-is, or split/refactor.

I have no strong feelings here. I can break this up into three separate tests, but these can also be viewed as three separate assertions. Not duplicating the boilerplate isn't hard.

This makes that function testable.

mbg self-assigned this Jul 13, 2026

github-actions Bot added the size/S Should be easy to review label Jul 13, 2026

mbg added 7 commits July 13, 2026 16:15

Make undici an explicit dependency

dab0ab7

Add RegistryProxyVars enum

8763bac

Allow getTestEnv to be parameterised over initial env

5172487

Add minimal proxy init code

a29dee4

Move init step at the end of start-proxy test workflow

e387ec1

Set language inputs in start-proxy check workflow

b0eaa56

Set CODEQL_PROXY_* vars for init step in test workflow

b6d92e3

mbg force-pushed the mbg/use-registry-proxy-for-repo-auth branch from fcdd601 to b6d92e3 Compare July 13, 2026 15:17

mbg added 7 commits July 13, 2026 16:24

Specify custom config-file in start-proxy check

50b3687

Allow proxy to be threaded into createApiClientWithDetails

80599cc

This will make it easier to gate the `getRegistryProxy` with a FF, without the significant refactoring that is needed to thread the FFs into `createApiClientWithDetails`

Gate proxy usage behind FF

6d70593

Use ActionState for getRegistryProxy

205b37b

Add and use clone method for ReadOnlyEnv

b946565

Log whether the proxy is picked up on

47e9c29

Test proxy usage for getRemoteConfig

a1c676d

github-actions Bot added size/M Should be of average difficulty to review and removed size/S Should be easy to review labels Jul 14, 2026

mbg marked this pull request as ready for review July 14, 2026 16:16

mbg requested a review from a team as a code owner July 14, 2026 16:16

Copilot AI review requested due to automatic review settings July 14, 2026 16:16

Copilot started reviewing on behalf of mbg July 14, 2026 16:16 View session

Copilot AI reviewed Jul 14, 2026

View reviewed changes

Comment thread src/config/file.test.ts Outdated

mbg added 4 commits July 14, 2026 19:27

Merge remote-tracking branch 'origin/main' into mbg/use-registry-prox…

d705aa3

…y-for-repo-auth

Validate proxy argument in tests

1a0eca3

Merge remote-tracking branch 'origin/main' into mbg/use-registry-prox…

7b19180

…y-for-repo-auth

Remove unneeded type assertion now that ApiClient exists

4292bd7

mario-campos reviewed Jul 16, 2026

View reviewed changes

Remove unused getApiFetch

8125f87

mario-campos self-requested a review July 17, 2026 12:44

mario-campos previously approved these changes Jul 17, 2026

View reviewed changes

Refactor looking up proxy env vars into getRegistryProxyConfig.

7db34ae

This makes that function testable.

mbg dismissed mario-campos’s stale review via 7db34ae July 17, 2026 12:49

mbg requested a review from mario-campos July 17, 2026 12:50

mario-campos approved these changes Jul 17, 2026

View reviewed changes

mbg added this pull request to the merge queue Jul 17, 2026

Merged via the queue into main with commit cf46341 Jul 17, 2026
225 checks passed

mbg deleted the mbg/use-registry-proxy-for-repo-auth branch July 17, 2026 14:18

This was referenced Jul 21, 2026

Merge main into releases/v4 #4027

Merged

Merge releases/v4 into releases/v3 #4029

Merged

mbg mentioned this pull request Jul 22, 2026

Use default request options instead of undefined #4030

Merged

+                // Should use it when the FF is enabled and the environment variables are set.
+                await target
+                  .withFeatures([Feature.ProxyApiRequests, Feature.NewRemoteFileAddresses])
+                  .withEnv((env) => {
+                    env.set(RegistryProxyVars.PROXY_HOST, "localhost");
+                    env.set(RegistryProxyVars.PROXY_PORT, "1234");
+                  })
+                  .logs(t, "Using private registry proxy at 'http://localhost:1234'")
+                  .passes(t.truthy);
+                // But not when the FF is not enabled.
+                await target
+                  .withFeatures([Feature.NewRemoteFileAddresses])
+                  .withEnv((env) => {
+                    env.set(RegistryProxyVars.PROXY_HOST, "localhost");
+                    env.set(RegistryProxyVars.PROXY_PORT, "1234");
+                  })
+                  .notLogs(t, "Using private registry proxy at 'http://localhost:1234'")
+                  .throws(t, { message: errorMessage });
+                // And not when the environment variables aren't set.
+                await target
+                  .withFeatures([Feature.ProxyApiRequests, Feature.NewRemoteFileAddresses])
+                  .notLogs(t, "Using private registry proxy at 'http://localhost:1234'")
+                  .throws(t, { message: errorMessage });
+              });

Use private registry proxy for API requests when available by mbg · Pull Request #4007 · github/codeql-action · GitHub

Uh oh!

Use private registry proxy for API requests when available - #4007

Use private registry proxy for API requests when available#4007
mbg merged 20 commits into
mainfrom
mbg/use-registry-proxy-for-repo-auth

mbg commented Jul 13, 2026 •
edited
Loading

Uh oh!

Uh oh!

mbg commented Jul 14, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

mario-campos Jul 16, 2026 •
edited
Loading

Uh oh!

Uh oh!

mbg Jul 16, 2026

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Use private registry proxy for API requests when available by mbg · Pull Request #4007 · github/codeql-action · GitHub

Uh oh!

Use private registry proxy for API requests when available - #4007

Use private registry proxy for API requests when available#4007mbg merged 20 commits intomaingithub/codeql-action:mainfrom mbg/use-registry-proxy-for-repo-authgithub/codeql-action:mbg/use-registry-proxy-for-repo-authCopy head branch name to clipboard

Conversation

mbg commented Jul 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Risk assessment

Which use cases does this change impact?

How did/will you validate this change?

If something goes wrong after this change is released, what are the mitigation and rollback strategies?

How will you know if something goes wrong after this change is released?

Are there any special considerations for merging or releasing this change?

Merge / deployment checklist

Uh oh!

mbg commented Jul 14, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Review details

Uh oh!

Uh oh!

Uh oh!

Uh oh!

mario-campos Jul 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

mbg Jul 16, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Use private registry proxy for API requests when available#4007
mbg merged 20 commits into
mainfrom
mbg/use-registry-proxy-for-repo-auth

mbg commented Jul 13, 2026 •
edited
Loading

mario-campos Jul 16, 2026 •
edited
Loading