Use `setup-codeql` logic for finding release assets in `start-proxy` by mbg · Pull Request #4198 · github/codeql-action · GitHub

The start-proxy Action currently uses its own getReleaseByVersion function to get hold of the release that we expect to find the proxy assets at. That function has hard-coded owner and repo values for the default github/codeql-action repository. This repository may not be available in all environments. In such environments, getReleaseByVersion fails and we fall-back to the hard-coded release obtained from getFallbackUrl instead.

Broadly, this PR does the following:

getCodeQLActionRepository and getCodeQLBundleDownloadURL are refactored out of setup-codeql into a new setup/repository module.
We then use getCodeQLAssetDownloadURL (renamed from getCodeQLBundleDownloadURL) in the start-proxy action to apply the same logic for finding a suitable release as used by setup-codeql.
The hard-coded fallback has been removed. The default URL returned by getCodeQLBundleDownloadURL is essentially equivalent, except that it uses the linked version rather than a hard-coded one. We have been shipping proxy artifacts successfully with releases for a good while now, so the fallback shouldn't be needed anymore.

There are some drive-by improvements to logging and assertions for sinon stubs.

Risk assessment

For internal use only. Please select the risk level of this change:

Low risk: Changes are fully under feature flags, or have been fully tested and validated in pre-production environments and are highly observable, or are documentation or test only.

Which use cases does this change impact?

Workflow types:

Managed - Impacts users with dynamic workflows (Default Setup, Code Quality, ...).

Products:

Code Scanning - The changes impact analyses when analysis-kinds: code-scanning.
Code Quality - The changes impact analyses when analysis-kinds: code-quality.
Other first-party - The changes impact other first-party analyses.

Environments:

Dotcom - Impacts CodeQL workflows on github.com and/or GitHub Enterprise Cloud with Data Residency.
GHES - Impacts CodeQL workflows on GitHub Enterprise Server.

How did/will you validate this change?

Unit tests - I am depending on unit test coverage (i.e. tests in .test.ts files).
End-to-end tests - I am depending on PR checks (i.e. tests in pr-checks).

If something goes wrong after this change is released, what are the mitigation and rollback strategies?

Rollback - Change can only be disabled by rolling back the release or releasing a new version with a fix.

How will you know if something goes wrong after this change is released?

Telemetry - I rely on existing telemetry or have made changes to the telemetry.
- Dashboards - I will watch relevant dashboards for issues after the release. Consider whether this requires this change to be released at a particular time rather than as part of a regular release.
- Alerts - New or existing monitors will trip if something goes wrong with this change.

Are there any special considerations for merging or releasing this change?

No special considerations - This change can be merged at any time.

Merge / deployment checklist

Confirm this change is backwards compatible with existing workflows.
Consider adding a changelog entry for this change.
Confirm the readme and docs have been updated if necessary.

This is just a URL, not an API URL, i.e. it doesn't start with api.

The name was just copied from setup-codeql.ts, but I have renamed this to instanceURL to address the feedback. While doing that I also noticed that apiURL /instanceURL isn't actually used at all beyond the short-circuit check and in log messages. That seems like it may have been an oversight in your PR when you added this, because without this we just end up checking for the repos on whatever instance getApiClient decides to use instead of the intended apiURL /instanceURL?

without this we just end up checking for the repos on whatever instance getApiClient decides to use instead of the intended apiURL /instanceURL?

Sorry, could you explain what you mean by this? The intent is to check the called Action repo on the same GH instance, the canonical github/codeql-action on the same GH instance, followed by github/codeql-action on Dotcom.

Suppose that we are on GHE with GITHUB_SERVER_URL being something like https://my-org.ghe.com and that GITHUB_ACTION_REPOSITORY is test-org/my-codeql-action-fork, then we have the following (expected/intended) value for potentialDownloadSources:

[
  ["https://my-org.ghe.com", "test-org/my-codeql-action-fork"],
  ["https://my-org.ghe.com", "github/codeql-action"],
  ["https://github.com", "github/codeql-action"]
]

The for (const [instanceURL, repository] of uniqueDownloadSources) loop, however, never explicitly uses instanceURL for getReleaseByTag. The getApiClient call makes its own call to getApiDetails(env) which will always get it the GitHubApiDetails based on GITHUB_SERVER_URL and GITHUB_API_URL.

This happens to work as expected, because the only entry in potentialDownloadSources that would want different GitHubApiDetails is the last element of the array and we short-circuit the getReleaseByTag call there to exit the loop and return the result of getDefaultDotcomDownloadURL.

However, there are two problems with this:

It is not immediately obvious that this happens to work out for any potentialDownloadSources that is currently possible.
If we ever make a change that allows an additional entry in potentialDownloadSources where the instance URL doesn't match GITHUB_SERVER_URL, or the repository name is not GITHUB_ACTION_REPOSITORY if the instance URL is GITHUB_DOTCOM_URL, then this leads to a hard-to-troubleshoot issue where the short-circuit check doesn't apply and we instead call getReleaseByTag with the wrong GitHubApiDetails.

I'd suggest we either change this so that we configure the api client correctly in the loop for the instance given by instanceURL, to avoid shooting ourselves in the foot in the future. Alternatively, we should document this very explicitly and perhaps add a test to make sure we never end up with this scenario. I'll have a look.

Ah I see, thanks for the explanation! I agree the code indeed currently does the right thing, but that hardening makes sense.

Couple of additional comments

Couple of small things, and there are some conflicts to address, but otherwise this looks good to me!

…cate-fallback

This reverts commit 909fda1.

Warning

Copilot's review of this pull request may be incomplete because some of the changed files are excluded by your Copilot content exclusion settings. See Excluding content from Copilot for details.

🟡 Changes recommended

Repository NWO validation accepts malformed values that can fail later outside the intended validation handling.

1 open finding

Require exactly two non-empty repository name segments · New

1 resolved since last review

Ensure onceWith rejects multiple calls

Files excluded by content exclusion policy (1)

lib/entry-points.js

🧠 Review effort: Balanced

github-actions Bot added the size/L May be hard to review label Oct 6, 2026

mbg force-pushed the mbg/start-proxy/deprecate-fallback branch from 362e7d4 to cd87ccd Compare October 6, 2026 15:56

mbg added 8 commits October 6, 2026 17:07

Allow logging functions to accept string[] directly

909fda1

Refactor getCodeQLActionRepository out of setup-codeql

cb7acf5

Use ActionState for getCodeQLActionRepository

3f57a00

Refactor getCodeQLBundleDownloadURL out of setup-codeql

da07d40

Add utility for assertions on sinon stubs with better output by default

35f12de

Type the assetKind parameter

a4f9f6f

Add getDefaultDotComDownloadURL

de99f0e

Use getCodeQLAssetDownloadURL for start-proxy

133ffeb

mbg force-pushed the mbg/start-proxy/deprecate-fallback branch from cd87ccd to 133ffeb Compare October 6, 2026 16:10

mbg marked this pull request as ready for review October 6, 2026 16:12

mbg requested a review from a team as a code owner October 6, 2026 16:12

mbg requested review from henrymercer and a balanced review from Copilot October 6, 2026 16:12

Copilot started reviewing on behalf of mbg October 6, 2026 16:13

View session

This comment was marked as outdated.

Sign in to view

Fix onceWith not asserting the once part

f9a9962

github-actions Bot added size/XL May be very hard to review and removed size/L May be hard to review labels Oct 6, 2026

henrymercer reviewed Oct 7, 2026

View reviewed changes

mbg mentioned this pull request Oct 7, 2026

Do not use core.exportVariable in unit tests (2nd attempt) #4212

Merged

debanjanbasu mentioned this pull request Oct 10, 2026

start-proxy selects an AMD64 binary on Linux ARM64 #4173

Closed

mbg added 6 commits October 12, 2026 14:52

Merge branch 'main' into mbg/start-proxy/deprecate-fallback

265d882

Allow initializeEnvironment to accept Env

c1b620c

Add and use RepositoryNwoStr type

ad8ebce

Use GITHUB_DOTCOM_URL in getDefaultDotComDownloadURL

1a92e13

Use "asset" in comment

e93db40

Use DownloadSource for potentialDownloadSources

fdc069b

mbg added 8 commits October 12, 2026 15:31

DotCom => Dotcom

06bd6e2

Log more in getProxyBinaryPath

3d7016f

Await toolcache.downloadTool

dd3898a

Remove duplicated assertions

ac44fd0

Fix mockGetReleaseByTag usage

a1794a0

Rename apiURL to instanceURL

8fed29e

Add InstanceURL and use in DownloadSource

5aa103d

Use parseRepositoryNwo in getCodeQLAssetDownloadURL

b67b5ab

This was referenced Oct 13, 2026

Make auth in GitHubApiDetails optional #4230

Merged

Use correct GitHubApiDetails instance for getApiClient in getCodeQLAssetDownloadURL #4231

Open

henrymercer reviewed Oct 14, 2026

View reviewed changes

Comment thread src/logging.ts Outdated

Comment thread src/start-proxy.ts Outdated

Comment thread src/start-proxy.ts Outdated

mbg added 3 commits October 14, 2026 13:56

Merge remote-tracking branch 'origin/main' into mbg/start-proxy/depre…

9da9625

…cate-fallback

Fix typo in log message

71ad3a7

Rename proxyBin to proxyDir

962aaad

mbg mentioned this pull request Oct 14, 2026

Remove getRunnerLogger #4235

Merged

Revert "Allow logging functions to accept string[] directly"

28d5dd9

This reverts commit 909fda1.

mbg requested review from henrymercer and a balanced review from Copilot October 14, 2026 14:08

Copilot started reviewing on behalf of mbg October 14, 2026 14:09

View session

Copilot AI reviewed Oct 14, 2026

View reviewed changes

Comment thread src/repository.ts

henrymercer approved these changes Oct 14, 2026

View reviewed changes

mbg added this pull request to the merge queue Oct 14, 2026

Merged via the queue into main with commit f5b8e09 Oct 14, 2026
235 checks passed

mbg deleted the mbg/start-proxy/deprecate-fallback branch October 14, 2026 14:54

github-merge-queue Bot pushed a commit that referenced this pull request Oct 14, 2026

Add change note for #4198

c8bd019

This was referenced Oct 15, 2026

Merge main into releases/v4 #4239

Merged

Merge releases/v4 into releases/v3 #4241

Merged

mbg mentioned this pull request Oct 16, 2026

Remove TRAP cache cleanup #4243

Merged

+                  },
+                );
+                for (const [apiURL, repository] of uniqueDownloadSources) {

Use `setup-codeql` logic for finding release assets in `start-proxy` by mbg · Pull Request #4198 · github/codeql-action · GitHub

Repository navigation

Use setup-codeql logic for finding release assets in start-proxy - #4198

Use setup-codeql logic for finding release assets in start-proxy#4198mbg merged 27 commits intomaingithub/codeql-action:mainfrom mbg/start-proxy/deprecate-fallbackgithub/codeql-action:mbg/start-proxy/deprecate-fallbackCopy head branch name to clipboard

Conversation

mbg commented Oct 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Risk assessment

Which use cases does this change impact?

How did/will you validate this change?

If something goes wrong after this change is released, what are the mitigation and rollback strategies?

How will you know if something goes wrong after this change is released?

Are there any special considerations for merging or releasing this change?

Merge / deployment checklist

Uh oh!

This comment was marked as outdated.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

henrymercer Oct 7, 2026

Choose a reason for hiding this comment

Uh oh!

mbg Oct 12, 2026

Choose a reason for hiding this comment

Uh oh!

henrymercer Oct 12, 2026

Choose a reason for hiding this comment

Uh oh!

mbg Oct 13, 2026

Choose a reason for hiding this comment

Uh oh!

henrymercer Oct 14, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

henrymercer left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

henrymercer left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟡 Changes recommended

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Use setup-codeql logic for finding release assets in start-proxy#4198
mbg merged 27 commits into
mainfrom
mbg/start-proxy/deprecate-fallback

mbg commented Oct 6, 2026 •
edited
Loading