Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 5 additions & 0 deletions lib/analyze-action-post.js

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

5 changes: 5 additions & 0 deletions lib/analyze-action.js

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

5 changes: 5 additions & 0 deletions lib/autobuild-action.js

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

5 changes: 5 additions & 0 deletions lib/init-action-post.js

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

5 changes: 5 additions & 0 deletions lib/init-action.js

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

5 changes: 5 additions & 0 deletions lib/resolve-environment-action.js

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

5 changes: 5 additions & 0 deletions lib/setup-codeql-action.js

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

5 changes: 5 additions & 0 deletions lib/start-proxy-action-post.js

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

26 changes: 23 additions & 3 deletions lib/start-proxy-action.js

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

5 changes: 5 additions & 0 deletions lib/upload-lib.js

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

5 changes: 5 additions & 0 deletions lib/upload-sarif-action-post.js

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

5 changes: 5 additions & 0 deletions lib/upload-sarif-action.js

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

6 changes: 6 additions & 0 deletions src/feature-flags.ts
Original file line number Diff line number Diff line change
Expand Up @@ -77,6 +77,7 @@ export enum Feature {
QaTelemetryEnabled = "qa_telemetry_enabled",
/** Note that this currently only disables baseline file coverage information. */
SkipFileCoverageOnPrs = "skip_file_coverage_on_prs",
StartProxyRemoveUnusedRegistries = "start_proxy_remove_unused_registries",
StartProxyUseFeaturesRelease = "start_proxy_use_features_release",
UploadOverlayDbToApi = "upload_overlay_db_to_api",
UseRepositoryProperties = "use_repository_properties_v2",
Expand Down Expand Up @@ -328,6 +329,11 @@ export const featureConfig = {
// cannot be found when interpreting results.
minimumVersion: undefined,
},
[Feature.StartProxyRemoveUnusedRegistries]: {
defaultValue: false,
envVar: "CODEQL_ACTION_START_PROXY_REMOVE_UNUSED_REGISTRIES",
minimumVersion: undefined,
},
[Feature.StartProxyUseFeaturesRelease]: {
defaultValue: false,
envVar: "CODEQL_ACTION_START_PROXY_USE_FEATURES_RELEASE",
Expand Down
8 changes: 7 additions & 1 deletion src/start-proxy-action.ts
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,7 @@ import * as core from "@actions/core";

import * as actionsUtil from "./actions-util";
import { getGitHubVersion } from "./api-client";
import { FeatureEnablement, initFeatures } from "./feature-flags";
import { Feature, FeatureEnablement, initFeatures } from "./feature-flags";
import { KnownLanguage } from "./languages";
import { getActionsLogger, Logger } from "./logging";
import { getRepositoryNwo } from "./repository";
Expand Down Expand Up @@ -58,12 +58,18 @@ async function run(startedAt: Date) {
const languageInput = actionsUtil.getOptionalInput("language");
language = languageInput ? parseLanguage(languageInput) : undefined;

// Query the FF for whether we should use the reduced registry mapping.
const skipUnusedRegistries = await features.getValue(
Feature.StartProxyRemoveUnusedRegistries,
);

// Get the registry configurations from one of the inputs.
const credentials = getCredentials(
logger,
actionsUtil.getOptionalInput("registry_secrets"),
actionsUtil.getOptionalInput("registries_credentials"),
language,
skipUnusedRegistries,
);

if (credentials.length === 0) {
Expand Down
26 changes: 26 additions & 0 deletions src/start-proxy.test.ts
Original file line number Diff line number Diff line change
Expand Up @@ -328,6 +328,32 @@
]);
});

test("getCredentials returns all credentials for Actions when using LANGUAGE_TO_REGISTRY_TYPE", async (t) => {
const credentialsInput = toEncodedJSON(mixedCredentials);

const credentials = startProxyExports.getCredentials(
getRunnerLogger(true),
undefined,
credentialsInput,
KnownLanguage.actions,
false,
);
t.is(credentials.length, mixedCredentials.length);
});

test("getCredentials returns no credentials for Actions when using NEW_LANGUAGE_TO_REGISTRY_TYPE", async (t) => {
const credentialsInput = toEncodedJSON(mixedCredentials);

const credentials = startProxyExports.getCredentials(
getRunnerLogger(true),
undefined,
credentialsInput,
KnownLanguage.actions,
true,
);
t.deepEqual(credentials, []);
});

Copy link

Copilot AI Mar 1, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The new behavior behind skipUnusedRegistries is only tested for KnownLanguage.actions. Adding tests for at least one KnownLanguage value that is currently missing from NEW_LANGUAGE_TO_REGISTRY_TYPE (e.g. cpp or swift) would help catch cases where the "reduced mapping" unintentionally falls back to allowing all credentials for an unlisted language.

Suggested change
test("getCredentials returns all credentials for Cpp when using LANGUAGE_TO_REGISTRY_TYPE", async (t) => {
const credentialsInput = toEncodedJSON(mixedCredentials);
const credentials = startProxyExports.getCredentials(
getRunnerLogger(true),
undefined,
credentialsInput,
KnownLanguage.cpp,
false,
);
t.is(credentials.length, mixedCredentials.length);
});
test("getCredentials returns no credentials for Cpp when using NEW_LANGUAGE_TO_REGISTRY_TYPE", async (t) => {
const credentialsInput = toEncodedJSON(mixedCredentials);
const credentials = startProxyExports.getCredentials(
getRunnerLogger(true),
undefined,
credentialsInput,
KnownLanguage.cpp,
true,
);
t.deepEqual(credentials, []);
});

Copilot uses AI. Check for mistakes.
test("parseLanguage", async (t) => {
// Exact matches
t.deepEqual(parseLanguage("csharp"), KnownLanguage.csharp);
Expand Down
21 changes: 19 additions & 2 deletions src/start-proxy.ts
Original file line number Diff line number Diff line change
Expand Up @@ -224,7 +224,9 @@ function isPAT(value: string) {
]);
}

const LANGUAGE_TO_REGISTRY_TYPE: Partial<Record<KnownLanguage, string[]>> = {
type RegistryMapping = Partial<Record<KnownLanguage, string[]>>;

const LANGUAGE_TO_REGISTRY_TYPE: RegistryMapping = {
java: ["maven_repository"],
csharp: ["nuget_feed"],
javascript: ["npm_registry"],
Expand All @@ -234,6 +236,17 @@ const LANGUAGE_TO_REGISTRY_TYPE: Partial<Record<KnownLanguage, string[]>> = {
go: ["goproxy_server", "git_source"],
} as const;

const NEW_LANGUAGE_TO_REGISTRY_TYPE: RegistryMapping = {
actions: [],
java: ["maven_repository"],
csharp: ["nuget_feed"],
javascript: [],
python: [],
ruby: [],
rust: [],
go: ["goproxy_server", "git_source"],
} as const;
Comment on lines +239 to +248
Copy link

Copilot AI Mar 1, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

NEW_LANGUAGE_TO_REGISTRY_TYPE does not include all KnownLanguage values (e.g. cpp, swift). When skipUnusedRegistries is enabled and language is one of these missing keys, registryMapping[language] becomes undefined and the code stops filtering, so all credential types are accepted. If the intent is to only allow registries for Java/C#/Go, consider making the "missing key" case behave like an empty allowlist when skipUnusedRegistries is true (or explicitly add the missing languages with []).

Copilot uses AI. Check for mistakes.

/**
* Extracts an `Address` value from the given `Registry` value by determining whether it has
* a `url` value, or no `url` value but a `host` value.
Expand Down Expand Up @@ -267,9 +280,13 @@ export function getCredentials(
registrySecrets: string | undefined,
registriesCredentials: string | undefined,
language: KnownLanguage | undefined,
skipUnusedRegistries: boolean = false,
): Credential[] {
const registryMapping = skipUnusedRegistries
? NEW_LANGUAGE_TO_REGISTRY_TYPE
: LANGUAGE_TO_REGISTRY_TYPE;
const registryTypeForLanguage = language
? LANGUAGE_TO_REGISTRY_TYPE[language]
? registryMapping[language]
: undefined;

let credentialsStr: string;
Expand Down
Loading