Use `setup-codeql` logic for finding release assets in `start-proxy` by mbg · Pull Request #4198 · github/codeql-action

mbg · 2026-10-06T15:24:04Z

The start-proxy Action currently uses its own getReleaseByVersion function to get hold of the release that we expect to find the proxy assets at. That function has hard-coded owner and repo values for the default github/codeql-action repository. This repository may not be available in all environments. In such environments, getReleaseByVersion fails and we fall-back to the hard-coded release obtained from getFallbackUrl instead.

Broadly, this PR does the following:

getCodeQLActionRepository and getCodeQLBundleDownloadURL are refactored out of setup-codeql into a new setup/repository module.
We then use getCodeQLAssetDownloadURL (renamed from getCodeQLBundleDownloadURL) in the start-proxy action to apply the same logic for finding a suitable release as used by setup-codeql.
The hard-coded fallback has been removed. The default URL returned by getCodeQLBundleDownloadURL is essentially equivalent, except that it uses the linked version rather than a hard-coded one. We have been shipping proxy artifacts successfully with releases for a good while now, so the fallback shouldn't be needed anymore.

There are some drive-by improvements to logging and assertions for sinon stubs.

Risk assessment

For internal use only. Please select the risk level of this change:

Low risk: Changes are fully under feature flags, or have been fully tested and validated in pre-production environments and are highly observable, or are documentation or test only.

Which use cases does this change impact?

Workflow types:

Managed - Impacts users with dynamic workflows (Default Setup, Code Quality, ...).

Products:

Code Scanning - The changes impact analyses when analysis-kinds: code-scanning.
Code Quality - The changes impact analyses when analysis-kinds: code-quality.
Other first-party - The changes impact other first-party analyses.

Environments:

Dotcom - Impacts CodeQL workflows on github.com and/or GitHub Enterprise Cloud with Data Residency.
GHES - Impacts CodeQL workflows on GitHub Enterprise Server.

How did/will you validate this change?

Unit tests - I am depending on unit test coverage (i.e. tests in .test.ts files).
End-to-end tests - I am depending on PR checks (i.e. tests in pr-checks).

If something goes wrong after this change is released, what are the mitigation and rollback strategies?

Rollback - Change can only be disabled by rolling back the release or releasing a new version with a fix.

How will you know if something goes wrong after this change is released?

Telemetry - I rely on existing telemetry or have made changes to the telemetry.
- Dashboards - I will watch relevant dashboards for issues after the release. Consider whether this requires this change to be released at a particular time rather than as part of a regular release.
- Alerts - New or existing monitors will trip if something goes wrong with this change.

Are there any special considerations for merging or releasing this change?

No special considerations - This change can be merged at any time.

Merge / deployment checklist

Confirm this change is backwards compatible with existing workflows.
Consider adding a changelog entry for this change.
Confirm the readme and docs have been updated if necessary.

henrymercer · 2026-10-07T16:21:41Z

-test.serial("getCodeQLActionRepository", (t) => {
-  const logger = getRunnerLogger(true);
-
+test.serial("getCodeQLActionRepository", async (t) => {


Can this now be run in parallel with other tests?

Ah, I see it can't because initializeEnvironment updates process.env directly.

Well, it goes via exportVariable, which we know is causing problems in tests since we never resolved the issue that #3930 aims to address.

That PR predates ActionState, so maybe it's worth reviving that effort with a suitable method on the Env or Actions states. What do you think?

That PR predates ActionState, so maybe it's worth reviving that effort with a suitable method on the Env or Actions states. What do you think?

Sounds good to me.

Done in #4212

henrymercer · 2026-10-07T16:22:55Z

+/**A download source is a pair of strings. */
+export type DownloadSource = [string, string];


Could this be something like [DownloadURL, RepositoryNwo] instead (both of which could still be typed as strings)?

henrymercer · 2026-10-07T16:24:01Z

+): Promise<DownloadURL> {
+  const codeQLActionRepository = getCodeQLActionRepository(action);
+
+  const potentialDownloadSources: Array<[string, string]> = [


Why not DownloadSource[]?

henrymercer · 2026-10-07T16:24:33Z

+    },
+  );
+
+  for (const [apiURL, repository] of uniqueDownloadSources) {


This is just a URL, not an API URL, i.e. it doesn't start with api.

henrymercer · 2026-10-07T16:30:19Z

+  /**
+   * Asserts that `stub` must have been called once with at least the `expected` arguments.
+   */
+  onceWith: <TArgs extends readonly any[]>(


Beyond your later fix in f9a9962, I think this should just be calledWith, since unlike calledOnce / calledOnceWithExactly / calledOnceWithMatch we don't validate that the stub was only called once.

henrymercer · 2026-10-07T16:33:16Z

 export type DownloadURL = string;

+/** Gets the default GitHub.com download URL for `assetName` in a release tagged `tagName`. */
+export function getDefaultDotComDownloadURL(


Nit: elsewhere, we use Dotcom

henrymercer · 2026-10-07T16:42:31Z

@@ -569,15 +533,15 @@
 * @returns The path to the proxy binary.
 */
 export async function getProxyBinaryPath(


Consider creating a log group for the download step and including more progress information in the logs. In the PR check for instance "The CodeQL Action is checked out locally. Using the default CodeQL Action repository." is logged, and there's an untar, but it's unclear to most users what's going on.

henrymercer

Couple of additional comments

henrymercer · 2026-10-07T16:45:24Z

+/** Types that all of our logging functions accept. */
+export type Loggable = string | string[];


Looking back at this after a commit-by-commit review, does anything use this? If not, let's remove it.

henrymercer · 2026-10-07T16:51:33Z

+  );
+
+  for (const [apiURL, repository] of uniqueDownloadSources) {
+    // If we've reached the final case, short-circuit the API check since we know the bundle exists and is public.


Nit: update this comment to refer to an "asset"

henrymercer · 2026-10-07T17:03:24Z

  try {
    // Download the proxy archive from `url`. We let `downloadTool` choose where
    // to store it. The path to the downloaded file will be returned if successful.
    return toolcache.downloadTool(url, /* dest: */ undefined, authorization, {


Should this be awaited (so the try catches errors that happen asynchronously)?

henrymercer · 2026-10-07T17:12:34Z

+      SAMPLE_DOTCOM_API_DETAILS,
+    );
+
+    t.is(getReleaseByTag.callCount, 1);


An existing issue to some extent, but because mockGetReleaseByTag returns the result of mockGetApiClient, this is actually asserting the number of calls to getApiClient.

henrymercer · 2026-10-07T17:15:13Z

+    st.onceWith(extractTar, archivePath);
+    st.onceWith(cacheDir, extractedPath);
+
    t.assert(extractTar.calledOnceWith(archivePath));
    t.assert(cacheDir.calledOnceWith(extractedPath));


There's some duplication here

henrymercer · 2026-10-07T17:16:28Z

-test.serial("getCodeQLActionRepository", (t) => {
-  const logger = getRunnerLogger(true);
-
+test.serial("getCodeQLActionRepository", async (t) => {


Ah, I see it can't because initializeEnvironment updates process.env directly.

henrymercer · 2026-10-07T17:17:35Z

+  tagName: string,
+  assetName: string,
+): DownloadURL {
+  return `https://github.com/${CODEQL_DEFAULT_ACTION_REPOSITORY}/releases/download/${tagName}/${assetName}`;


Nit: we could use GITHUB_DOTCOM_URL here.

github-actions Bot added the size/L May be hard to review label Oct 6, 2026

mbg force-pushed the mbg/start-proxy/deprecate-fallback branch from 362e7d4 to cd87ccd Compare October 6, 2026 15:56

mbg added 8 commits October 6, 2026 17:07

Allow logging functions to accept string[] directly

909fda1

Refactor getCodeQLActionRepository out of setup-codeql

cb7acf5

Use ActionState for getCodeQLActionRepository

3f57a00

Refactor getCodeQLBundleDownloadURL out of setup-codeql

da07d40

Add utility for assertions on sinon stubs with better output by default

35f12de

Type the assetKind parameter

a4f9f6f

Add getDefaultDotComDownloadURL

de99f0e

Use getCodeQLAssetDownloadURL for start-proxy

133ffeb

mbg force-pushed the mbg/start-proxy/deprecate-fallback branch from cd87ccd to 133ffeb Compare October 6, 2026 16:10

mbg marked this pull request as ready for review October 6, 2026 16:12

mbg requested a review from a team as a code owner October 6, 2026 16:12

mbg requested review from henrymercer and a balanced review from Copilot October 6, 2026 16:12

Copilot started reviewing on behalf of mbg October 6, 2026 16:13 View session

This comment was marked as outdated.

Sign in to view

Fix onceWith not asserting the once part

f9a9962

github-actions Bot added size/XL May be very hard to review and removed size/L May be hard to review labels Oct 6, 2026

henrymercer reviewed Oct 7, 2026

View reviewed changes

mbg mentioned this pull request Oct 7, 2026

Do not use core.exportVariable in unit tests (2nd attempt) #4212

Open

		/*A download source is a pair of strings. /
		export type DownloadSource = [string, string];

		/** Types that all of our logging functions accept. */
		export type Loggable = string \| string[];

Conversation

mbg commented Oct 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Risk assessment

Which use cases does this change impact?

How did/will you validate this change?

If something goes wrong after this change is released, what are the mitigation and rollback strategies?

How will you know if something goes wrong after this change is released?

Are there any special considerations for merging or releasing this change?

Merge / deployment checklist

Uh oh!

This comment was marked as outdated.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

henrymercer left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

henrymercer Oct 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

This branch has not been deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

mbg commented Oct 6, 2026 •

edited

Loading

henrymercer Oct 7, 2026 •

edited

Loading