Visitar URL original
Always enable `git_source` registries by mbg · Pull Request #4000 · github/codeql-action · GitHub
Skip to content

Always enable git_source registries #4000

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
mbg merged 4 commits into from
Jul 10, 2026
Merged

Always enable git_source registries #4000

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
ef79560
Always enable `git_source` registries
mbg Jul 8, 2026
2831d9a
Fix previously wrong comment
mbg Jul 9, 2026
c7d9083
Make `ALWAYS_ENABLED_REGISTRY_TYPE` read-only
mbg Jul 9, 2026
ff973a1
Merge branch 'main' into mbg/start-proxy/make-git-repos-always-available
mbg Jul 9, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 2 additions & 1 deletion lib/entry-points.js
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

54 changes: 48 additions & 6 deletions src/start-proxy.test.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -120,9 +120,14 @@ const mixedCredentials = [
{ type: "maven_repository", host: "maven.pkg.github.com", token: "def" },
{ type: "nuget_feed", host: "nuget.pkg.github.com", token: "ghi" },
{ type: "goproxy_server", host: "goproxy.example.com", token: "jkl" },
{ type: "git_source", host: "github.com/github", token: "mno" },
];

const gitSourceCredential = {
type: "git_source",
host: "github.com/github",
token: "mno",
};

test("getCredentials prefers registriesCredentials over registrySecrets", async (t) => {
const registryCredentials = Buffer.from(
JSON.stringify([
Expand Down Expand Up @@ -241,7 +246,7 @@ test("getCredentials returns all for a language when specified", async (t) => {
const credentials = startProxyExports.getCredentials(
getRunnerLogger(true),
undefined,
toEncodedJSON(mixedCredentials),
toEncodedJSON([...mixedCredentials, gitSourceCredential]),
BuiltInLanguage.go,
);
t.is(credentials.length, 2);
Expand Down Expand Up @@ -284,7 +289,7 @@ test("getCredentials returns all maven_repositories for Java when specified", as
host: "maven2.pkg.github.com",
token: "token2",
},
{ type: "git_source", host: "github.com/github", token: "mno" },
{ type: "goproxy_server", host: "github.com/github", token: "mno" },
];

const credentials = startProxyExports.getCredentials(
Expand Down Expand Up @@ -624,16 +629,53 @@ test("getCredentials validates 'replaces-base' correctly", async (t) => {
);
});

test("getCredentials returns no credentials for Actions", async (t) => {
const credentialsInput = toEncodedJSON(mixedCredentials);
test("getCredentials returns only ALWAYS_ENABLED_REGISTRY_TYPE credentials for Actions", async (t) => {
const credentialsInput = toEncodedJSON([
...mixedCredentials,
gitSourceCredential,
]);

const credentials = startProxyExports.getCredentials(
getRunnerLogger(true),
undefined,
credentialsInput,
BuiltInLanguage.actions,
);
t.deepEqual(credentials, []);

for (const credential of credentials) {
t.true(
startProxyExports.ALWAYS_ENABLED_REGISTRY_TYPE.some(
(ty) => ty === credential.type,
),
);
}
Comment thread
mbg marked this conversation as resolved.
Resolved
});

test("getCredentials always returns ALWAYS_ENABLED_REGISTRY_TYPE credentials for all languages", async (t) => {
const alwaysEnabledCredentials: startProxyExports.Credential[] = [];

for (const alwaysEnabled of startProxyExports.ALWAYS_ENABLED_REGISTRY_TYPE) {
alwaysEnabledCredentials.push({
type: alwaysEnabled,
host: `host-${alwaysEnabled}`,
token: `bar-${alwaysEnabled}`,
url: `url-${alwaysEnabled}`,
});
}

const credentialsInput = toEncodedJSON(alwaysEnabledCredentials);

// Test all languages.
for (const language of Object.values(BuiltInLanguage)) {
const credentials = startProxyExports.getCredentials(
getRunnerLogger(true),
undefined,
credentialsInput,
language,
);

t.deepEqual(credentials, alwaysEnabledCredentials);
}
});

function mockGetApiClient(endpoints: any) {
Expand Down
22 changes: 17 additions & 5 deletions src/start-proxy.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -187,9 +187,16 @@ function isPAT(value: string) {
]);
}

/**
* A list of always-enabled registry types. The registry types in this list are always
* enabled, because generic CodeQL workflow components may use them rather than just
* language-specific components.
*/
export const ALWAYS_ENABLED_REGISTRY_TYPE = ["git_source"] as const;

type RegistryMapping = Partial<Record<BuiltInLanguage, string[]>>;

const LANGUAGE_TO_REGISTRY_TYPE: Required<RegistryMapping> = {
export const LANGUAGE_TO_REGISTRY_TYPE: Required<RegistryMapping> = {
Comment thread
mbg marked this conversation as resolved.
Resolved
actions: [],
cpp: [],
java: ["maven_repository"],
Expand Down Expand Up @@ -233,9 +240,11 @@ function getRegistryAddress(
}
}

// getCredentials returns registry credentials from action inputs.
// It prefers `registries_credentials` over `registry_secrets`.
// If neither is set, it returns an empty array.
/**
* Returns registry credentials from action inputs.
* It prefers `registriesCredentials` over `registrySecrets`.
* If neither is set, it returns an empty array.
*/
export function getCredentials(
logger: Logger,
registrySecrets: string | undefined,
Expand Down Expand Up @@ -291,8 +300,11 @@ export function getCredentials(
const address = getRegistryAddress(e);

// Filter credentials based on language if specified. `type` is the registry type.
// E.g., "maven_feed" for Java/Kotlin, "nuget_repository" for C#.
// E.g., "maven_repository" for Java/Kotlin, "nuget_feed" for C#.
// We always allow types in `ALWAYS_ENABLED_REGISTRY_TYPE` since they can be used by
// other parts of the workflow.
if (
!ALWAYS_ENABLED_REGISTRY_TYPE.some((t) => t === e.type) &&
registryTypeForLanguage &&
!registryTypeForLanguage.some((t) => t === e.type)
) {
Expand Down
Loading