Test connections to private registries in `start-proxy` by mbg · Pull Request #3466 · github/codeql-action · GitHub

Modifies the start-proxy action to perform a basic connectivity test for each configured private registry. The outcomes of these tests are logged. The implementation is designed to be tolerant to failures and is gated behind a new FF.

Note that this PR includes the approved changes from #3438 in the first commit.

Risk assessment

For internal use only. Please select the risk level of this change:

Low risk: Changes are fully under feature flags, or have been fully tested and validated in pre-production environments and are highly observable, or are documentation or test only.

Which use cases does this change impact?

Workflow types:

Managed - Impacts users with dynamic workflows (Default Setup, CCR, ...).

Products:

Code Scanning - The changes impact analyses when analysis-kinds: code-scanning.
Code Quality - The changes impact analyses when analysis-kinds: code-quality.

Environments:

Dotcom - Impacts CodeQL workflows on github.com and/or GitHub Enterprise Cloud with Data Residency.
GHES - Impacts CodeQL workflows on GitHub Enterprise Server.

How did/will you validate this change?

Unit tests - I am depending on unit test coverage (i.e. tests in .test.ts files).
End-to-end tests - I am depending on PR checks (i.e. tests in pr-checks).

If something goes wrong after this change is released, what are the mitigation and rollback strategies?

Feature flags - All new or changed code paths can be fully disabled with corresponding feature flags.

How will you know if something goes wrong after this change is released?

Telemetry - I rely on existing telemetry or have made changes to the telemetry.
- Dashboards - I will watch relevant dashboards for issues after the release. Consider whether this requires this change to be released at a particular time rather than as part of a regular release.
- Alerts - New or existing monitors will trip if something goes wrong with this change.

Are there any special considerations for merging or releasing this change?

No special considerations - This change can be merged at any time.

Merge / deployment checklist

Confirm this change is backwards compatible with existing workflows.
Consider adding a changelog entry for this change.
Confirm the readme and docs have been updated if necessary.

Pull request overview

Adds an (FF-gated) connectivity check in the start-proxy action to probe each configured private registry and log the outcome, along with the supporting types, tests, and dependency updates.

Changes:

Introduces checkConnections + ReachabilityBackend abstraction to test registry reachability via the local proxy.
Updates start-proxy-action to return proxy connection details and (optionally) run the reachability checks behind a new feature flag.
Adds https-proxy-agent dependency and the new start_proxy_connection_checks feature flag.

Reviewed changes

Copilot reviewed 18 out of 20 changed files in this pull request and generated 34 comments.

Show a summary per file

File	Description
src/start-proxy/types.ts	Adds shared types for registries/credentials and a ProxyInfo return type.
src/start-proxy/reachability.ts	Implements proxy-based reachability checks and related error type/backends.
src/start-proxy/reachability.test.ts	Adds unit tests for reachability-check logging and filtering behavior.
src/start-proxy.ts	Moves Credential definition to shared types and re-exports types.
src/start-proxy-action.ts	Initializes feature flags and (FF-gated) triggers reachability checks after starting proxy.
src/feature-flags.ts	Adds StartProxyConnectionChecks feature flag + env var wiring.
package.json	Adds https-proxy-agent dependency.
package-lock.json	Locks https-proxy-agent dependency version and metadata.
lib/upload-sarif-action.js	Generated JS update reflecting dependency/feature-flag additions.
lib/upload-sarif-action-post.js	Generated JS update reflecting dependency/feature-flag additions.
lib/upload-lib.js	Generated JS update reflecting dependency/feature-flag additions.
lib/start-proxy-action-post.js	Generated JS update reflecting dependency/feature-flag additions.
lib/setup-codeql-action.js	Generated JS update reflecting dependency/feature-flag additions.
lib/resolve-environment-action.js	Generated JS update reflecting dependency/feature-flag additions.
lib/init-action.js	Generated JS update reflecting dependency/feature-flag additions.
lib/init-action-post.js	Generated JS update reflecting dependency/feature-flag additions.
lib/autobuild-action.js	Generated JS update reflecting dependency/feature-flag additions.
lib/analyze-action.js	Generated JS update reflecting dependency/feature-flag additions.
lib/analyze-action-post.js	Generated JS update reflecting dependency/feature-flag additions.

Some minor comments, otherwise looks good!

As a general comment and potential followup, consider whether it would make sense to allowlist any of these errors to help us debug issues with telemetry.

Pull request overview

Copilot reviewed 19 out of 21 changed files in this pull request and generated 4 comments.

…t-entry Add changelog entry for #3466

mbg added 7 commits February 6, 2026 10:43

Make FFs available in start-proxy action

d2901f5

Merge branch 'main' into mbg/start-proxy/test-connections

310177a

Move Credential type

93302bc

Break up Credential type into two interfaces

70eae15

Add explicit dependency on https-proxy-agent

b030333

Add ProxyInfo type and return from startProxy

c4717c9

Add StartProxyConnectionChecks feature

c7eff3f

mbg self-assigned this Feb 10, 2026

Copilot AI review requested due to automatic review settings February 10, 2026 15:33

mbg requested a review from a team as a code owner February 10, 2026 15:33

github-actions Bot added the size/M Should be of average difficulty to review label Feb 10, 2026

Copilot started reviewing on behalf of mbg February 10, 2026 15:34 View session

Test connections to registries, if FF is enabled

01ee641

mbg force-pushed the mbg/start-proxy/test-connections branch from e89464b to 01ee641 Compare February 10, 2026 15:37

Copilot AI reviewed Feb 10, 2026

View reviewed changes

mbg added 5 commits February 10, 2026 16:13

Remove superflous log message

9f2f6d0

Add missing else

700fc11

Type that registries must have either an url or a host

4d44b57

Add a 5s timeout to requests

5135700

Remove superfluous error handling details

c4b0f60

github-actions Bot added size/L May be hard to review and removed size/M Should be of average difficulty to review labels Feb 10, 2026

henrymercer reviewed Feb 11, 2026

View reviewed changes

Comment thread src/start-proxy/reachability.test.ts Outdated

Comment thread src/start-proxy/types.ts Outdated

Comment thread src/start-proxy-action.ts Outdated

mbg added 5 commits February 11, 2026 16:47

Remove unnecessary test assertions

27b3b65

Fix outdated comment

0387f55

Rename types

4d0bec1

Require validated Credential for credentialToStr

bd36637

Add test for missing type

e114998

mbg requested review from Copilot and henrymercer February 11, 2026 17:26

Copilot started reviewing on behalf of mbg February 11, 2026 17:27 View session

Copilot AI reviewed Feb 11, 2026

View reviewed changes

Comment thread src/start-proxy/reachability.ts

Comment thread src/start-proxy/reachability.ts Outdated

Comment thread src/start-proxy/reachability.ts

Comment thread src/start-proxy-action.ts

mbg added 3 commits February 11, 2026 17:46

Remove unused logger in NetworkReachabilityBackend

555ee17

Add timeout event handler

2b5b614

Skip checks for non-URLs for now

efb92e2

henrymercer approved these changes Feb 11, 2026

View reviewed changes

mbg merged commit ff33514 into main Feb 11, 2026
250 checks passed

mbg deleted the mbg/start-proxy/test-connections branch February 11, 2026 19:19

mbg added a commit that referenced this pull request Feb 12, 2026

Add changelog entry for #3466

be75dd9

Copilot AI mentioned this pull request Feb 12, 2026

Add changelog entry for #3466 #3478

Merged

henrymercer added a commit that referenced this pull request Feb 13, 2026

Merge pull request #3478 from github/mbg/changelog/add-connection-tes…

4bf6fa4

…t-entry Add changelog entry for #3466

This was referenced Feb 13, 2026

Merge main into releases/v4 #3479

Merged

Merge releases/v4 into releases/v3 #3481

Merged

mbg mentioned this pull request Feb 24, 2026

Remove FF gate for connection checks #3503

Merged

Test connections to private registries in `start-proxy` by mbg · Pull Request #3466 · github/codeql-action · GitHub

Uh oh!

Test connections to private registries in start-proxy - #3466

Test connections to private registries in start-proxy#3466
mbg merged 21 commits into
mainfrom
mbg/start-proxy/test-connections

mbg commented Feb 10, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

henrymercer left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Test connections to private registries in `start-proxy` by mbg · Pull Request #3466 · github/codeql-action · GitHub

Uh oh!

Test connections to private registries in start-proxy - #3466

Test connections to private registries in start-proxy#3466mbg merged 21 commits intomaingithub/codeql-action:mainfrom mbg/start-proxy/test-connectionsgithub/codeql-action:mbg/start-proxy/test-connectionsCopy head branch name to clipboard

Conversation

mbg commented Feb 10, 2026

Risk assessment

Which use cases does this change impact?

How did/will you validate this change?

If something goes wrong after this change is released, what are the mitigation and rollback strategies?

How will you know if something goes wrong after this change is released?

Are there any special considerations for merging or releasing this change?

Merge / deployment checklist

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

henrymercer left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Test connections to private registries in start-proxy#3466
mbg merged 21 commits into
mainfrom
mbg/start-proxy/test-connections