Merge remote-tracking branch 'origin/releases/v4' into backport-v3.37.2-e0647621c

# Conflicts: # lib/entry-points.js
2026-11-08 22:19:50 +00:00 · 2026-07-21 14:28:11 +00:00
parent c87e7fae54 e0647621c2
commit ab2931b320
29 changed files with 1527 additions and 628 deletions
--- a/lib/entry-points.js
+++ b/lib/entry-points.js
@@ -8941,7 +8941,7 @@ var require_proxy_agent = __commonJS({
        return this.#client.destroy(err);
      }
    };
-    var ProxyAgent = class extends DispatcherBase {
+    var ProxyAgent2 = class extends DispatcherBase {
      constructor(opts) {
        super();
        if (!opts || typeof opts === "object" && !(opts instanceof URL2) && !opts.uri) {
@@ -9082,7 +9082,7 @@ var require_proxy_agent = __commonJS({
        throw new InvalidArgumentError("Proxy-Authorization should be sent in ProxyAgent constructor");
      }
    }
-    module2.exports = ProxyAgent;
+    module2.exports = ProxyAgent2;
  }
 });

@@ -9092,7 +9092,7 @@ var require_env_http_proxy_agent = __commonJS({
    "use strict";
    var DispatcherBase = require_dispatcher_base();
    var { kClose, kDestroy, kClosed, kDestroyed, kDispatch, kNoProxyAgent, kHttpProxyAgent, kHttpsProxyAgent } = require_symbols();
-    var ProxyAgent = require_proxy_agent();
+    var ProxyAgent2 = require_proxy_agent();
    var Agent = require_agent();
    var DEFAULT_PORTS = {
      "http:": 80,
@@ -9116,13 +9116,13 @@ var require_env_http_proxy_agent = __commonJS({
        this[kNoProxyAgent] = new Agent(agentOpts);
        const HTTP_PROXY = httpProxy ?? process.env.http_proxy ?? process.env.HTTP_PROXY;
        if (HTTP_PROXY) {
-          this[kHttpProxyAgent] = new ProxyAgent({ ...agentOpts, uri: HTTP_PROXY });
+          this[kHttpProxyAgent] = new ProxyAgent2({ ...agentOpts, uri: HTTP_PROXY });
        } else {
          this[kHttpProxyAgent] = this[kNoProxyAgent];
        }
        const HTTPS_PROXY = httpsProxy ?? process.env.https_proxy ?? process.env.HTTPS_PROXY;
        if (HTTPS_PROXY) {
-          this[kHttpsProxyAgent] = new ProxyAgent({ ...agentOpts, uri: HTTPS_PROXY });
+          this[kHttpsProxyAgent] = new ProxyAgent2({ ...agentOpts, uri: HTTPS_PROXY });
        } else {
          this[kHttpsProxyAgent] = this[kHttpProxyAgent];
        }
@@ -18906,7 +18906,7 @@ var require_undici = __commonJS({
    var Pool = require_pool();
    var BalancedPool = require_balanced_pool();
    var Agent = require_agent();
-    var ProxyAgent = require_proxy_agent();
+    var ProxyAgent2 = require_proxy_agent();
    var EnvHttpProxyAgent = require_env_http_proxy_agent();
    var RetryAgent = require_retry_agent();
    var errors = require_errors();
@@ -18929,7 +18929,7 @@ var require_undici = __commonJS({
    module2.exports.Pool = Pool;
    module2.exports.BalancedPool = BalancedPool;
    module2.exports.Agent = Agent;
-    module2.exports.ProxyAgent = ProxyAgent;
+    module2.exports.ProxyAgent = ProxyAgent2;
    module2.exports.EnvHttpProxyAgent = EnvHttpProxyAgent;
    module2.exports.RetryAgent = RetryAgent;
    module2.exports.RetryHandler = RetryHandler;
@@ -141488,6 +141488,10 @@ var ReadOnlyEnv = class {
    this.vars = vars;
  }
  vars;
+  /** Clones the object while detaching the underlying environment from the original. */
+  clone() {
+    return Object.create(this, { vars: { value: { ...this.vars } } });
+  }
  /** Tries to get the value for `name` and throws if there isn't one. */
  getRequired(name) {
    return getRequiredEnvVar(this.vars, name);
@@ -145328,6 +145332,7 @@ function getDiffRangesJsonFilePath(env = getEnv()) {
 }
 function getActionVersion() {
 <<<<<<< HEAD
+<<<<<<< HEAD
 <<<<<<< HEAD
  return "3.36.3";
 =======
@@ -145336,6 +145341,9 @@ function getActionVersion() {
 =======
  return "4.37.1";
 >>>>>>> origin/releases/v4
+=======
+  return "4.37.2";
+>>>>>>> origin/releases/v4
 }
 function getWorkflowEventName(env = getEnv()) {
  return env.getRequired("GITHUB_EVENT_NAME" /* GITHUB_EVENT_NAME */);
@@ -145738,6 +145746,9 @@ function retry(octokit, octokitOptions) {
 }
 retry.VERSION = VERSION7;

+// src/api-client.ts
+var import_undici = __toESM(require_undici());
+
 // src/repository.ts
 function getRepositoryNwo() {
  return getRepositoryNwoFromEnv("GITHUB_REPOSITORY");
@@ -145765,9 +145776,40 @@ function parseRepositoryNwo(input) {
 // src/api-client.ts
 var GITHUB_ENTERPRISE_VERSION_HEADER = "x-github-enterprise-version";
 var DO_NOT_RETRY_STATUSES = [400, 410, 422, 451];
-function createApiClientWithDetails(apiDetails, { allowExternal = false } = {}) {
+function getRegistryProxyConfig(action) {
+  return {
+    host: action.env.getOptional("CODEQL_PROXY_HOST" /* PROXY_HOST */),
+    port: action.env.getOptional("CODEQL_PROXY_PORT" /* PROXY_PORT */),
+    ca: action.env.getOptional("CODEQL_PROXY_CA_CERTIFICATE" /* PROXY_CA_CERTIFICATE */)
+  };
+}
+function getRegistryProxy(action) {
+  const { host, port, ca } = getRegistryProxyConfig(action);
+  if (host && port) {
+    const uri = `http://${host}:${port}`;
+    action.logger.debug(
+      `Using private registry proxy at '${uri}' for API client.`
+    );
+    return new import_undici.ProxyAgent({
+      uri,
+      keepAliveTimeout: 10,
+      keepAliveMaxTimeout: 10,
+      requestTls: ca ? { ca } : void 0
+    });
+  }
+  return void 0;
+}
+function makeProxyRequestOptions(dispatcher) {
+  return {
+    fetch: (req, init2) => {
+      return (0, import_undici.fetch)(req, { ...init2, dispatcher });
+    }
+  };
+}
+function createApiClientWithDetails(apiDetails, { allowExternal = false, proxy = void 0 } = {}) {
  const auth2 = allowExternal && apiDetails.externalRepoAuth || apiDetails.auth;
  const retryingOctokit = githubUtils.GitHub.plugin(retry);
+  const requestOptions = proxy === void 0 ? void 0 : makeProxyRequestOptions(proxy);
  return new retryingOctokit(
    githubUtils.getOctokitOptions(auth2, {
      baseUrl: apiDetails.apiURL,
@@ -145778,6 +145820,7 @@ function createApiClientWithDetails(apiDetails, { allowExternal = false } = {})
        warn: core5.warning,
        error: core5.error
      },
+      request: requestOptions,
      retry: {
        doNotRetry: DO_NOT_RETRY_STATUSES
      }
@@ -145794,8 +145837,8 @@ function getApiDetails(env = getEnv()) {
 function getApiClient(env = getEnv()) {
  return createApiClientWithDetails(getApiDetails(env));
 }
-function getApiClientWithExternalAuth(apiDetails) {
-  return createApiClientWithDetails(apiDetails, { allowExternal: true });
+function getApiClientWithExternalAuth(apiDetails, proxy) {
+  return createApiClientWithDetails(apiDetails, { allowExternal: true, proxy });
 }
 function getAuthorizationHeaderFor(logger, apiDetails, url2) {
  if (url2.startsWith(`${apiDetails.url}/`) || apiDetails.apiURL && url2.startsWith(`${apiDetails.apiURL}/`)) {
@@ -146764,11 +146807,6 @@ var featureConfig = {
    envVar: "CODEQL_ACTION_JAVA_NETWORK_DEBUGGING",
    minimumVersion: void 0
  },
-  ["new_remote_file_addresses" /* NewRemoteFileAddresses */]: {
-    defaultValue: false,
-    envVar: "CODEQL_ACTION_NEW_REMOTE_FILE_ADDRESSES",
-    minimumVersion: void 0
-  },
  ["overlay_analysis" /* OverlayAnalysis */]: {
    defaultValue: false,
    envVar: "CODEQL_ACTION_OVERLAY_ANALYSIS",
@@ -146889,6 +146927,11 @@ var featureConfig = {
    legacyApi: true,
    minimumVersion: void 0
  },
+  ["proxy_api_requests" /* ProxyApiRequests */]: {
+    defaultValue: false,
+    envVar: "CODEQL_ACTION_PROXY_API_REQUESTS",
+    minimumVersion: void 0
+  },
  ["skip_file_coverage_on_prs" /* SkipFileCoverageOnPrs */]: {
    defaultValue: false,
    envVar: "CODEQL_ACTION_SKIP_FILE_COVERAGE_ON_PRS",
@@ -147826,11 +147869,6 @@ function getInvalidConfigFileMessage(configFile, messages) {
  const andMore = messages.length > 10 ? `, and ${messages.length - 10} more.` : ".";
  return `The configuration file "${configFile}" is invalid: ${messages.slice(0, 10).join(", ")}${andMore}`;
 }
-function getConfigFileRepoOldFormatInvalidMessage(configFile) {
-  let error3 = `The configuration file "${configFile}" is not a supported remote file reference.`;
-  error3 += " Expected format <owner>/<repository>/<file-path>@<ref>";
-  return error3;
-}
 function getConfigFileRepoFormatInvalidMessage(configFile) {
  let error3 = `The configuration file "${configFile}" is not a supported remote file reference.`;
  error3 += " Expected format [<owner>/]<repository>[@<ref>][:<file-path>]";
@@ -148343,14 +148381,6 @@ async function parseRemoteFileAddress(actionState, configFile) {
  if (oldFormatAddressResult.isSuccess()) {
    return oldFormatAddressResult.value;
  }
-  const allowNewFormat = await actionState.features.getValue(
-    "new_remote_file_addresses" /* NewRemoteFileAddresses */
-  );
-  if (!allowNewFormat) {
-    throw new ConfigurationError(
-      getConfigFileRepoOldFormatInvalidMessage(configFile)
-    );
-  }
  const newFormatAddressResult = parseNewRemoteFileAddress(
    actionState.env,
    configFile
@@ -148402,7 +148432,11 @@ async function getConfigFileInput({
 }
 async function getRemoteConfig(actionState, configFile, apiDetails) {
  const address = await parseRemoteFileAddress(actionState, configFile);
-  const response = await getApiClientWithExternalAuth(apiDetails).rest.repos.getContent({
+  const shouldProxyRequest = await actionState.features.getValue(
+    "proxy_api_requests" /* ProxyApiRequests */
+  );
+  const proxy = shouldProxyRequest ? getRegistryProxy(actionState) : void 0;
+  const response = await getApiClientWithExternalAuth(apiDetails, proxy).rest.repos.getContent({
    owner: address.owner,
    repo: address.repo,
    path: address.path,
@@ -149259,10 +149293,7 @@ async function downloadCacheWithTime(codeQL, languages, logger) {
  return { trapCaches, trapCacheDownloadTime };
 }
 async function loadUserConfig(actionState, configFile, workspacePath, apiDetails, tempDir) {
-  const allowNewFormat = await actionState.features.getValue(
-    "new_remote_file_addresses" /* NewRemoteFileAddresses */
-  );
-  if (isLocal(configFile, allowNewFormat)) {
+  if (isLocal(configFile)) {
    if (configFile !== userConfigFromActionPath(tempDir)) {
      configFile = path10.resolve(workspacePath, configFile);
      if (!(configFile + path10.sep).startsWith(workspacePath + path10.sep)) {
@@ -149276,7 +149307,7 @@ async function loadUserConfig(actionState, configFile, workspacePath, apiDetails
    );
    return getLocalConfig(actionState.logger, configFile, validateConfig);
  } else {
-    if (allowNewFormat && isExplicitRemotePath(configFile)) {
+    if (isExplicitRemotePath(configFile)) {
      configFile = configFile.substring(REMOTE_PATH_PREFIX.length);
    }
    return await getRemoteConfig(actionState, configFile, apiDetails);
@@ -149747,11 +149778,11 @@ function isExplicitRemotePath(configPath) {
 function containsAtRef(configPath) {
  return configPath.includes("@");
 }
-function isLocal(configPath, allowNewFormat) {
+function isLocal(configPath) {
  if (isExplicitLocalPath(configPath)) {
    return true;
  }
-  if (allowNewFormat && isExplicitRemotePath(configPath)) {
+  if (isExplicitRemotePath(configPath)) {
    return false;
  }
  return !containsAtRef(configPath);
@@ -162016,7 +162047,10 @@ function isPAT(value) {
    GITHUB_PAT_FINE_GRAINED_PATTERN
  ]);
 }
-var ALWAYS_ENABLED_REGISTRY_TYPE = ["git_source"];
+var ALWAYS_ENABLED_REGISTRY_TYPE = [
+  "git_source",
+  "docker_registry"
+];
 var LANGUAGE_TO_REGISTRY_TYPE = {
  actions: [],
  cpp: [],