From 909828cd53976350516a8ab34d4c50cec7511d32 Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Wed, 22 Jul 2026 06:43:21 +0100 Subject: [PATCH 1/3] Base custom request options on defaults, and add basic tests for `makeProxyRequestOptions` --- lib/entry-points.js | 6 +++++- src/api-client.test.ts | 21 +++++++++++++++++++++ src/api-client.ts | 18 +++++++++++------- 3 files changed, 37 insertions(+), 8 deletions(-) diff --git a/lib/entry-points.js b/lib/entry-points.js index 0183005a70..b91e8c1e06 100644 --- a/lib/entry-points.js +++ b/lib/entry-points.js @@ -145788,7 +145788,11 @@ function getRegistryProxy(action) { return void 0; } function makeProxyRequestOptions(dispatcher) { + if (dispatcher === void 0) { + return githubUtils.defaults.request; + } return { + ...githubUtils.defaults.request, fetch: (req, init2) => { return (0, import_undici.fetch)(req, { ...init2, dispatcher }); } @@ -145797,7 +145801,7 @@ function makeProxyRequestOptions(dispatcher) { function createApiClientWithDetails(apiDetails, { allowExternal = false, proxy = void 0 } = {}) { const auth2 = allowExternal && apiDetails.externalRepoAuth || apiDetails.auth; const retryingOctokit = githubUtils.GitHub.plugin(retry); - const requestOptions = proxy === void 0 ? githubUtils.defaults.request : makeProxyRequestOptions(proxy); + const requestOptions = makeProxyRequestOptions(proxy); return new retryingOctokit( githubUtils.getOctokitOptions(auth2, { baseUrl: apiDetails.apiURL, diff --git a/src/api-client.test.ts b/src/api-client.test.ts index e43f16ef29..ae8c6269b1 100644 --- a/src/api-client.test.ts +++ b/src/api-client.test.ts @@ -2,6 +2,7 @@ import * as github from "@actions/github"; import * as githubUtils from "@actions/github/lib/utils"; import test from "ava"; import * as sinon from "sinon"; +import { ProxyAgent } from "undici"; import * as actionsUtil from "./actions-util"; import * as api from "./api-client"; @@ -251,3 +252,23 @@ test("getRegistryProxyConfig - gets the configuration from the env vars", async ) .passes(t.like, { host, port, ca }); }); + +test("makeProxyRequestOptions - returns defaults without custom proxy", async (t) => { + t.deepEqual( + api.makeProxyRequestOptions(undefined), + githubUtils.defaults.request, + ); +}); + +test("makeProxyRequestOptions - returns fetch with custom proxy", async (t) => { + const opts = api.makeProxyRequestOptions( + new ProxyAgent("http://localhost:1080"), + ); + // Fetch should be different from the defaults. + t.notDeepEqual(opts?.fetch, githubUtils.defaults.request?.fetch); + // The options should be the same aside from that. + t.deepEqual( + { ...opts, fetch: githubUtils.defaults.request?.fetch }, + githubUtils.defaults.request, + ); +}); diff --git a/src/api-client.ts b/src/api-client.ts index 7c63b5a6fe..ba800a2587 100644 --- a/src/api-client.ts +++ b/src/api-client.ts @@ -108,12 +108,19 @@ export function getRegistryProxy( * Constructs a `RequestRequestOptions` with a custom `fetch` implementation * that uses `dispatcher` as a proxy for requests. * - * @param dispatcher The proxy to use. + * @param dispatcher The proxy to use, if any. */ export function makeProxyRequestOptions( - dispatcher: ProxyAgent, -): RequestRequestOptions { + dispatcher: ProxyAgent | undefined, +): RequestRequestOptions | undefined { + // If we don't have a custom `ProxyAgent`, return the defaults. + if (dispatcher === undefined) { + return githubUtils.defaults.request; + } + + // Otherwise, construct the custom `fetch` and add it onto the defaults. return { + ...githubUtils.defaults.request, fetch: (req: RequestInfo, init?: RequestInit) => { return undiciFetch(req, { ...init, dispatcher }); }, @@ -136,10 +143,7 @@ function createApiClientWithDetails( const auth = (allowExternal && apiDetails.externalRepoAuth) || apiDetails.auth; const retryingOctokit = githubUtils.GitHub.plugin(retry.retry); - const requestOptions = - proxy === undefined - ? githubUtils.defaults.request - : makeProxyRequestOptions(proxy); + const requestOptions = makeProxyRequestOptions(proxy); return new retryingOctokit( githubUtils.getOctokitOptions(auth, { baseUrl: apiDetails.apiURL, From 84ae30d972fec62c064734759d8ba9c3ee34746c Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Wed, 22 Jul 2026 07:23:08 +0100 Subject: [PATCH 2/3] Only allow traffic via the proxy in `global-proxy` test --- .github/workflows/__global-proxy.yml | 19 +++++++++++++++++++ pr-checks/checks/global-proxy.yml | 19 +++++++++++++++++++ 2 files changed, 38 insertions(+) diff --git a/.github/workflows/__global-proxy.yml b/.github/workflows/__global-proxy.yml index e3ba6ff101..6fc7a2da59 100644 --- a/.github/workflows/__global-proxy.yml +++ b/.github/workflows/__global-proxy.yml @@ -55,6 +55,24 @@ jobs: version: ${{ matrix.version }} use-all-platform-bundle: 'false' setup-kotlin: 'false' + - name: Block direct internet access to force proxy usage + run: | + apt-get update -qq && apt-get install -y -qq iptables >/dev/null 2>&1 + PROXY_IP=$(getent hosts squid-proxy | awk '{ print $1 }') + echo "Squid proxy IP: $PROXY_IP" + # Allow all traffic to the proxy container + iptables -A OUTPUT -d "$PROXY_IP" -j ACCEPT + # Allow DNS resolution + iptables -A OUTPUT -p udp --dport 53 -j ACCEPT + iptables -A OUTPUT -p tcp --dport 53 -j ACCEPT + # Allow loopback + iptables -A OUTPUT -o lo -j ACCEPT + # Allow already-established connections (from checkout/prepare-test) + iptables -A OUTPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT + # Block all other outbound HTTP and HTTPS, ensuring direct access fails + iptables -A OUTPUT -p tcp --dport 80 -j REJECT --reject-with tcp-reset + iptables -A OUTPUT -p tcp --dport 443 -j REJECT --reject-with tcp-reset + echo "Direct HTTP/HTTPS access is now blocked - all traffic must go through the proxy" - uses: ./../action/init with: languages: javascript @@ -66,6 +84,7 @@ jobs: CODEQL_ACTION_TEST_MODE: true container: image: ubuntu:22.04 + options: --cap-add=NET_ADMIN services: squid-proxy: image: ubuntu/squid:latest diff --git a/pr-checks/checks/global-proxy.yml b/pr-checks/checks/global-proxy.yml index 5f90022c04..8debe3c5b9 100644 --- a/pr-checks/checks/global-proxy.yml +++ b/pr-checks/checks/global-proxy.yml @@ -5,6 +5,7 @@ versions: - nightly-latest container: image: ubuntu:22.04 + options: --cap-add=NET_ADMIN services: squid-proxy: image: ubuntu/squid:latest @@ -14,6 +15,24 @@ env: https_proxy: http://squid-proxy:3128 CODEQL_ACTION_TOLERATE_MISSING_GIT_VERSION: true steps: + - name: Block direct internet access to force proxy usage + run: | + apt-get update -qq && apt-get install -y -qq iptables >/dev/null 2>&1 + PROXY_IP=$(getent hosts squid-proxy | awk '{ print $1 }') + echo "Squid proxy IP: $PROXY_IP" + # Allow all traffic to the proxy container + iptables -A OUTPUT -d "$PROXY_IP" -j ACCEPT + # Allow DNS resolution + iptables -A OUTPUT -p udp --dport 53 -j ACCEPT + iptables -A OUTPUT -p tcp --dport 53 -j ACCEPT + # Allow loopback + iptables -A OUTPUT -o lo -j ACCEPT + # Allow already-established connections (from checkout/prepare-test) + iptables -A OUTPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT + # Block all other outbound HTTP and HTTPS, ensuring direct access fails + iptables -A OUTPUT -p tcp --dport 80 -j REJECT --reject-with tcp-reset + iptables -A OUTPUT -p tcp --dport 443 -j REJECT --reject-with tcp-reset + echo "Direct HTTP/HTTPS access is now blocked - all traffic must go through the proxy" - uses: ./../action/init with: languages: javascript From a2bfb64790ec008b14f219b15582931a21495a31 Mon Sep 17 00:00:00 2001 From: "Michael B. Gale" Date: Wed, 22 Jul 2026 07:26:00 +0100 Subject: [PATCH 3/3] Set other proxy env vars --- .github/workflows/__global-proxy.yml | 11 ++++++++++- pr-checks/checks/global-proxy.yml | 11 ++++++++++- 2 files changed, 20 insertions(+), 2 deletions(-) diff --git a/.github/workflows/__global-proxy.yml b/.github/workflows/__global-proxy.yml index 6fc7a2da59..45df36f268 100644 --- a/.github/workflows/__global-proxy.yml +++ b/.github/workflows/__global-proxy.yml @@ -73,13 +73,22 @@ jobs: iptables -A OUTPUT -p tcp --dport 80 -j REJECT --reject-with tcp-reset iptables -A OUTPUT -p tcp --dport 443 -j REJECT --reject-with tcp-reset echo "Direct HTTP/HTTPS access is now blocked - all traffic must go through the proxy" + + - name: Set proxy environment variables + shell: bash + run: | + echo "http_proxy=http://squid-proxy:3128" >> $GITHUB_ENV + echo "HTTP_PROXY=http://squid-proxy:3128" >> $GITHUB_ENV + echo "https_proxy=http://squid-proxy:3128" >> $GITHUB_ENV + echo "HTTPS_PROXY=http://squid-proxy:3128" >> $GITHUB_ENV + - uses: ./../action/init with: languages: javascript tools: ${{ steps.prepare-test.outputs.tools-url }} + - uses: ./../action/analyze env: - https_proxy: http://squid-proxy:3128 CODEQL_ACTION_TOLERATE_MISSING_GIT_VERSION: true CODEQL_ACTION_TEST_MODE: true container: diff --git a/pr-checks/checks/global-proxy.yml b/pr-checks/checks/global-proxy.yml index 8debe3c5b9..9d9653c13c 100644 --- a/pr-checks/checks/global-proxy.yml +++ b/pr-checks/checks/global-proxy.yml @@ -12,7 +12,6 @@ services: ports: - 3128:3128 env: - https_proxy: http://squid-proxy:3128 CODEQL_ACTION_TOLERATE_MISSING_GIT_VERSION: true steps: - name: Block direct internet access to force proxy usage @@ -33,8 +32,18 @@ steps: iptables -A OUTPUT -p tcp --dport 80 -j REJECT --reject-with tcp-reset iptables -A OUTPUT -p tcp --dport 443 -j REJECT --reject-with tcp-reset echo "Direct HTTP/HTTPS access is now blocked - all traffic must go through the proxy" + + - name: Set proxy environment variables + shell: bash + run: | + echo "http_proxy=http://squid-proxy:3128" >> $GITHUB_ENV + echo "HTTP_PROXY=http://squid-proxy:3128" >> $GITHUB_ENV + echo "https_proxy=http://squid-proxy:3128" >> $GITHUB_ENV + echo "HTTPS_PROXY=http://squid-proxy:3128" >> $GITHUB_ENV + - uses: ./../action/init with: languages: javascript tools: ${{ steps.prepare-test.outputs.tools-url }} + - uses: ./../action/analyze